Managing ASP.NET session state with Amazon DynamoDB - Amazon SDK for .NET
Create the ASP.NET_SessionState TableConfigure the Session State ProviderSecurity Considerations
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China.

Managing ASP.NET session state with Amazon DynamoDB

Note

The information in this topic is specific to projects based on .NET Framework and the Amazon SDK for .NET version 3.3 and earlier.

Warning

This topic is specific to ASP.NET; the information in this topic isn't necessarily applicable to ASP.NET Core.

ASP.NET applications often store session state data in memory. However, this approach doesn’t scale well. After the application grows beyond a single web server, the session state must be shared between servers. A common solution is to set up a dedicated session-state server with Microsoft SQL Server, but this approach also has drawbacks: you must administer another machine; the session-state server is a single point of failure; and the session-state server itself can become a performance bottleneck.

DynamoDB, a NoSQL database store from Amazon, provides an effective solution for sharing session state across web servers without incurring any of these drawbacks.

Note

Regardless of the solution you choose, be aware that Amazon DynamoDB enforces limits on the size of an item. None of the records you store in DynamoDB can exceed this limit. For more information, see Limits in DynamoDB in the Amazon DynamoDB Developer Guide.

The Amazon SDK for .NET includes AWS.SessionProvider.dll, which contains an ASP.NET session state provider. It also includes the AmazonDynamoDBSessionProviderSample sample, which demonstrates how to use Amazon DynamoDB as a session state provider.

For more information about using session state with ASP.NET applications, go to the Microsoft documentation.

Create the ASP.NET_SessionState Table

When your application starts, it looks for an Amazon DynamoDB table named, by default, ASP.NET_SessionState. We recommend you create this table before you run your application for the first time.

To create the ASP.NET_SessionState table

  1. Choose Create Table. The Create Table wizard opens.

  2. In the Table name text box, enter ASP.NET_SessionState.

  3. In the Primary key field, enter SessionId and set the type to String.

  4. When all your options are entered as you want them, choose Create.

The ASP.NET_SessionState table is ready for use when its status changes from CREATING to ACTIVE.

Note

If you decide not to create the table beforehand, the session state provider will create the table during its initialization. See the web.config options below for a list of attributes that act as configuration parameters for the session state table. If the provider creates the table, it will use these parameters.

Configure the Session State Provider

To configure an ASP.NET application to use DynamoDB as the session-state server

  1. Add references to both AWSSDK.dll and AWS.SessionProvider.dll to your Visual Studio ASP.NET project. These assemblies are available through NuGet packages or by installing assemblies manually.

    In earlier versions of the SDK, the functionality for the session state provider was contained in AWS.Extension.dll. To improve usability, the functionality was moved to AWS.SessionProvider.dll. For more information, see the blog post AWS.Extension renaming.

  2. Edit your application’s Web.config file. In the system.web element, replace the existing sessionState element with the following XML fragment:

    <sessionState timeout="20" mode="Custom" customProvider="DynamoDBSessionStoreProvider">
  <providers>
    <add name="DynamoDBSessionStoreProvider"
         type="Amazon.SessionProvider.DynamoDBSessionStateStore"
         AWSProfileName="{profile_name}"
         Region="us-west-2" />
  </providers>
</sessionState>

    The profile represents the Amazon credentials that are used to communicate with DynamoDB to store and retrieve the session state. If you are using the Amazon SDK for .NET and are specifying a profile in the appSettings section of your application’s Web.config file, you do not need to specify a profile in the providers section; the Amazon .NET client code will discover it at run time. For more information, see Configuring Your Amazon SDK for .NET Application.

    If the web server is running on an Amazon EC2 instance configured to use IAM roles for EC2 instances, then you do not need to specify any credentials in the Web.config file. In this case, the Amazon .NET client will use the IAM role credentials. For more information, see Granting Access Using an IAM Role and Security Considerations.

Web.config Options

You can use the following configuration attributes in the providers section of your Web.config file:

AWSAccessKey

Access key ID to use. This can be set either in the providers or appSettings section. We recommend not using this setting. Instead, specify credentials by using AWSProfileName to specify a profile.

AWSSecretKey

Secret key to use. This can be set either in the providers or appSettings section. We recommend not using this setting. Instead, specify credentials by using AWSProfileName to specify a profile.

AWSProfileName

The profile name associated with the credentials you want to use. For more information, see Configuring Your Amazon SDK for .NET Application.

Region

Required string attribute. The Amazon region in which to use Amazon DynamoDB. For a list of Amazon regions, see Regions and Endpoints: DynamoDB.

Application

Optional string attribute. The value of the Application attribute is used to partition the session data in the table so that the table can be used for more than one application.

Table

Optional string attribute. The name of the table used to store session data. The default is ASP.NET_SessionState.

ReadCapacityUnits

Optional int attribute. The read capacity units to use if the provider creates the table. The default is 10.

WriteCapacityUnits

Optional int attribute. The write capacity units to use if the provider creates the table. The default is 5.

CreateIfNotExist

Optional boolean attribute. The CreateIfNotExist attribute controls whether the provider will auto-create the table if it doesn’t exist. The default is true. If this flag is set to false and the table doesn’t exist, an exception will be thrown.

Security Considerations

After the DynamoDB table is created and the application is configured, sessions can be used as with any other session provider.

As a security best practice, we recommend you run your applications with the credentials of an IAM User Guide user. You can use either the IAM Management Console or the Amazon Toolkit for Visual Studio to create IAM users and define access policies.

The session state provider needs to be able to call the DeleteItem, DescribeTable, GetItem, PutItem, and UpdateItem operations for the table that stores the session data. The sample policy below can be used to restrict the IAM user to only the operations needed by the provider for an instance of DynamoDB running in us-west-2:

{ "Version" : "2012-10-17",
"Statement" : [
  {
    "Sid" : "1",
    "Effect" : "Allow",
    "Action" : [
        "dynamodb:DeleteItem",
        "dynamodb:DescribeTable",
        "dynamodb:GetItem",
        "dynamodb:PutItem",
        "dynamodb:UpdateItem"
    ],
    "Resource" : "arn:aws:dynamodb:us-west-2:{<YOUR-AWS-ACCOUNT-ID>}:table/ASP.NET_SessionState"
    }
  ]
}