gobridge

Runbook: DynamoDB Store Outage / Throttling

Applies to: deployments backing the lease, outbox, or DLQ stores with DynamoDB (the AWS store adapters). Audience: on-call operators. Risk: medium to high — throttling slows lease renewal and outbox drain; a full store outage stops durable progress and can trigger failover.

Symptom

Diagnosis

  1. Confirm the pressure is store-side, not broker-side. The lease and outbox latency metrics under GoBridge/Runtime (monitoring.md#key-metrics) isolate the store path:
    • LeaseRenewLatency rising with LeaseAcquireFailures — the owner is struggling to renew against DynamoDB, not to reach the broker.
    • OutboxDrainLatency rising with OutboxDeferred — claimed records miss their batch deadline because store calls are slow.
    • OutboxDepthFailures — the pending-count query returned a real read error; the drainer skipped the OutboxDepth gauge that cycle, so investigate the store, not the backlog.
  2. Read the DynamoDB CloudWatch metrics for each affected table (lease, outbox, DLQ) and its GSIs:
    • ThrottledRequests, ReadThrottleEvents, WriteThrottleEvents > 0 — capacity is the bottleneck.
    • ConsumedReadCapacityUnits / ConsumedWriteCapacityUnits against the provisioned WCU/RCU (or on-demand account limits).
    • SystemErrors (5xx) > 0 — a service-side outage rather than throttling.
  3. Separate throttling from a conditional-write conflict. Repeated OutboxClaimConflicts or conditional-check-failed responses on the outbox table point at claim contention between drainers, not raw capacity. A STALE_FENCING_TOKEN (troubleshooting.md#stale_fencing_token) means a lease CAS lost, expected during failover but not sustained.

  4. Rule out access and shape problems that masquerade as an outage:
    • IAM: the task role must allow dynamodb:GetItem/PutItem/UpdateItem/Query and Query on the GSIs. A revoked grant surfaces as NOT_AUTHORIZED, not THROTTLED.
    • GSI: an outbox depth/claim query needs its index present and ACTIVE. A missing or backfilling GSI throttles or errors — see DynamoDB outbox table schema.

Action

Rollback criteria

If you scaled capacity or changed the table to on-demand and OutboxDepth is still not draining after two poll cycles, revert the capacity change and escalate — the bottleneck is not capacity (check OutboxDrainStalled for a wedged sender, Outbox backlog / stuck drain). Never delete or truncate a lease/outbox/DLQ table to clear pressure: it strands durable records and drops in-flight messages.