Creating a DAX cluster using the AWS CLI

Create a file named service-trust-relationship.json with the following contents.

{
    "Version": "2012-10-17",
    "Statement": [
       {
            "Effect": "Allow",
            "Principal": {
                "Service": "dax.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

Create the service role.

aws iam create-role \
    --role-name DAXServiceRoleForDynamoDBAccess \
    --assume-role-policy-document file://service-trust-relationship.json

Create a file named service-role-policy.json with the following contents.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "dynamodb:DescribeTable",
                "dynamodb:PutItem",
                "dynamodb:GetItem",
                "dynamodb:UpdateItem",
                "dynamodb:DeleteItem",
                "dynamodb:Query",
                "dynamodb:Scan",
                "dynamodb:BatchGetItem",
                "dynamodb:BatchWriteItem",
                "dynamodb:ConditionCheckItem"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:dynamodb:us-west-2:accountID:*"
            ]
        }
    ]
}

Replace accountID with your AWS account ID. To find your AWS account ID, in the upper-right corner of the console, choose your login ID. Your AWS account ID appears in the drop-down menu.

In the Amazon Resource Name (ARN) in the example, accountID must be a 12-digit number. Don't use hyphens or any other punctuation.

Create an IAM policy for the service role.

aws iam create-policy \
    --policy-name DAXServicePolicyForDynamoDBAccess \
    --policy-document file://service-role-policy.json

In the output, note the ARN for the policy that you created, as in the following example.

arn:aws:iam::123456789012:policy/DAXServicePolicyForDynamoDBAccess

Attach the policy to the service role. Replace arn in the following code with the actual role ARN from the previous step.

aws iam attach-role-policy \
    --role-name DAXServiceRoleForDynamoDBAccess \
    --policy-arn arn

To determine the identifier for your default VPC, enter the following command.

aws ec2 describe-vpcs

In the output, note the identifier for your default VPC, as in the following example.

vpc-12345678

Determine the subnet IDs associated with your default VPC. Replace vpcID with your actual VPC ID—for example, vpc-12345678.

aws ec2 describe-subnets \
    --filters "Name=vpc-id,Values=vpcID" \
    --query "Subnets[*].SubnetId"

In the output, note the subnet identifiers—for example, subnet-11111111.

Create the subnet group. Ensure that you specify at least one subnet ID in the --subnet-ids parameter.

aws dax create-subnet-group \
    --subnet-group-name my-subnet-group \
    --subnet-ids subnet-11111111 subnet-22222222 subnet-33333333 subnet-44444444

Get the Amazon Resource Name (ARN) for your service role.

aws iam get-role \
    --role-name DAXServiceRoleForDynamoDBAccess \
    --query "Role.Arn" --output text

In the output, note the service role ARN, as in the following example.

arn:aws:iam::123456789012:role/DAXServiceRoleForDynamoDBAccess

Create the DAX cluster. Replace roleARN with the ARN from the previous step.

aws dax create-cluster \
    --cluster-name mydaxcluster \
    --node-type dax.r4.large \
    --replication-factor 3 \
    --iam-role-arn roleARN \
    --subnet-group my-subnet-group \
    --sse-specification Enabled=true \
    --region us-west-2

All of the nodes in the cluster are of type dax.r4.large (--node-type). There are three nodes (--replication-factor)—one primary node and two replicas.

To determine the default security group identifier, enter the following command. Replace vpcID with your actual VPC ID (from Step 2: Create a subnet group).

aws ec2 describe-security-groups \
    --filters Name=vpc-id,Values=vpcID Name=group-name,Values=default \
    --query "SecurityGroups[*].{GroupName:GroupName,GroupId:GroupId}"

In the output, note the security group identifier—for example, sg-01234567.

Then enter the following. Replace sgID with your actual security group identifier. Use port 8111 for unencrypted clusters and 9111 for encrypted clusters.

aws ec2 authorize-security-group-ingress \
    --group-id sgID --protocol tcp --port 8111