wso2 · DimuthuMadushan · Sep 8, 2026 · Sep 7, 2026 · Sep 7, 2026 · Sep 7, 2026
@@ -4,7 +4,7 @@ title: "Overview"
 
 # Overview
 
-AWS Marketplace Entitlement Service (MPE) enables AWS Marketplace sellers to programmatically determine the entitlements of customers who have subscribed to their products. The Ballerina `ballerinax/aws.marketplace.mpe` connector wraps the AWS Marketplace Entitlement Service API, allowing you to query customer entitlements from your Ballerina integration flows.
+AWS Marketplace Entitlement Service (MPE) enables AWS Marketplace sellers to programmatically determine the entitlements of customers who have subscribed to their products. The MPE connector wraps the AWS Marketplace Entitlement Service API, allowing you to query customer entitlements from your Ballerina integration flows.
 
 
 ## Key features

@@ -4,7 +4,7 @@ title: "Overview"
 
 # Overview
 
-AWS Marketplace Metering Service enables SaaS providers to report customer usage for products listed on AWS Marketplace. The Ballerina `ballerinax/aws.marketplace.mpm` connector provides programmatic access to the AWS Marketplace Metering API, allowing you to resolve customers from registration tokens and submit batch metering usage records for billing purposes.
+AWS Marketplace Metering Service enables SaaS providers to report customer usage for products listed on AWS Marketplace. The MPM connector provides programmatic access to the AWS Marketplace Metering API, allowing you to resolve customers from registration tokens and submit batch metering usage records for billing purposes.
 
 
 ## Key features

@@ -4,7 +4,7 @@ title: "Overview"
 
 # Overview
 
-Amazon Simple Notification Service (SNS) is a fully managed pub/sub messaging and notification service for coordinating the delivery of messages to subscribing endpoints and clients. The Ballerina `ballerinax/aws.sns` connector provides programmatic access to AWS SNS, enabling you to create topics, manage subscriptions, publish messages, and manage platform applications and SMS capabilities from your Ballerina integration flows.
+Amazon Simple Notification Service (SNS) is a fully managed pub/sub messaging and notification service for coordinating the delivery of messages to subscribing endpoints and clients. The SNS connector provides programmatic access to AWS SNS, enabling you to create topics, manage subscriptions, publish messages, and manage platform applications and SMS capabilities from your Ballerina integration flows.
 
 
 ## Key features

@@ -7,14 +7,14 @@ description: "How to set up and configure the ballerinax/aws.dynamodb connector.
 
 # Setup Guide
 
-This guide explains how to configure Amazon DynamoDB and obtain the AWS credentials required to use the connector.
+This guide walks you through setting up your AWS account and obtaining the credentials required to use the AWS DynamoDB connector.
 
 ## Prerequisites
 
 - An active AWS account ([sign up at aws.amazon.com](https://aws.amazon.com/))
 - Sufficient IAM permissions to create users, policies, and DynamoDB tables in your target region
 
-## Create a DynamoDB table
+## Step 1: Create a DynamoDB table
 
 You can create the table your application operates on either through the connector itself (using `createTable`) or ahead of time in the [DynamoDB console](https://console.aws.amazon.com/dynamodbv2).
 
@@ -24,58 +24,82 @@ A DynamoDB table is defined by its primary key, which is either a partition key
 If you create the table through the AWS console before running your Ballerina application, note the table name and region — you will need them when configuring the connector.
 :::
 
-## Obtain IAM user credentials
-
-To generate an IAM access key, follow the [obtaining IAM user credentials](https://central.ballerina.io/ballerinax/aws/latest#obtaining-iam-user-credentials) guide on Ballerina Central.
-
-Once you have a user, attach an IAM policy granting the DynamoDB permissions your application needs. The control-plane actions (creating and describing tables) and the data-plane actions (reading and writing items) are granted separately:
-
-```json
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Effect": "Allow",
-            "Action": [
-                "dynamodb:CreateTable",
-                "dynamodb:DescribeTable",
-                "dynamodb:UpdateTable",
-                "dynamodb:DeleteTable",
-                "dynamodb:DescribeTimeToLive",
-                "dynamodb:CreateBackup",
-                "dynamodb:PutItem",
-                "dynamodb:GetItem",
-                "dynamodb:UpdateItem",
-                "dynamodb:DeleteItem",
-                "dynamodb:Query",
-                "dynamodb:Scan",
-                "dynamodb:BatchGetItem",
-                "dynamodb:BatchWriteItem"
-            ],
-            "Resource": "arn:aws:dynamodb:<REGION>:<ACCOUNT_ID>:table/<TABLE_NAME>"
-        },
-        {
-            "Effect": "Allow",
-            "Action": "dynamodb:DeleteBackup",
-            "Resource": "arn:aws:dynamodb:<REGION>:<ACCOUNT_ID>:table/<TABLE_NAME>/backup/*"
-        },
-        {
-            "Effect": "Allow",
-            "Action": [
-                "dynamodb:ListTables",
-                "dynamodb:DescribeLimits"
-            ],
-            "Resource": "*"
-        }
-    ]
-}
-```
+## Step 2: Create an IAM user
+
+1. Log in to the [AWS Management Console](https://console.aws.amazon.com/).
+2. Navigate to **IAM** (Identity and Access Management).
+3. Select **Users** in the left sidebar, then select **Create user**.
+4. Enter a user name (for example, `ballerina-dynamodb-connector`) and select **Next**.
+5. Select **Attach policies directly**.
+6. Select **Create policy**, open the **JSON** tab, and paste the policy below, then attach it. Replace `<REGION>`, `<ACCOUNT_ID>`, and `<TABLE_NAME>` with the values for your table, or use `table/*` to grant access to every table in the account.
+
+   ```json
+   {
+       "Version": "2012-10-17",
+       "Statement": [
+           {
+               "Effect": "Allow",
+               "Action": [
+                   "dynamodb:CreateTable",
+                   "dynamodb:DescribeTable",
+                   "dynamodb:UpdateTable",
+                   "dynamodb:DeleteTable",
+                   "dynamodb:DescribeTimeToLive",
+                   "dynamodb:CreateBackup",
+                   "dynamodb:PutItem",
+                   "dynamodb:GetItem",
+                   "dynamodb:UpdateItem",
+                   "dynamodb:DeleteItem",
+                   "dynamodb:Query",
+                   "dynamodb:Scan",
+                   "dynamodb:BatchGetItem",
+                   "dynamodb:BatchWriteItem"
+               ],
+               "Resource": "arn:aws:dynamodb:<REGION>:<ACCOUNT_ID>:table/<TABLE_NAME>"
+           },
+           {
+               "Effect": "Allow",
+               "Action": "dynamodb:DeleteBackup",
+               "Resource": "arn:aws:dynamodb:<REGION>:<ACCOUNT_ID>:table/<TABLE_NAME>/backup/*"
+           },
+           {
+               "Effect": "Allow",
+               "Action": [
+                   "dynamodb:ListTables",
+                   "dynamodb:DescribeLimits"
+               ],
+               "Resource": "*"
+           }
+       ]
+   }
+   ```
+
+   `dynamodb:ListTables` and `dynamodb:DescribeLimits` are account-level actions and cannot be scoped to a table ARN, so they stay in their own statement scoped to `*`; omit that statement entirely if your application calls neither operation. `dynamodb:DeleteBackup` is scoped to the backup resource rather than the table, which is why it needs a statement of its own.
+
+7. Select **Next**, review the settings, and select **Create user**.
 
 :::note
-`dynamodb:ListTables` and `dynamodb:DescribeLimits` are account-level actions and cannot be scoped to a table ARN — AWS denies them when the resource is anything other than `*`. Omit that statement entirely if your application calls neither operation.
+For a screenshot-by-screenshot walkthrough of the IAM user creation and access key generation steps, see the [AWS SQS setup guide](../../messaging/aws.sqs/setup-guide.md). The console flow is identical, only the attached policy differs.
 :::
 
-## Choose an authentication method
+:::tip
+For production workloads, consider using an IAM role with temporary credentials via AWS STS instead of long-lived access keys.
+:::
+
+## Step 3: Generate access keys
+
+1. In the IAM console, select the user you created.
+2. Go to the **Security credentials** tab.
+3. Under **Access keys**, select **Create access key**.
+4. Select the **Application running outside AWS** use case and select **Next**.
+5. Optionally add a description tag, then select **Create access key**.
+6. Copy the **Access key ID** and **Secret access key**.
+
+:::warning
+The secret access key is shown only once at creation time. Store it securely and do not commit it to source control. Use Ballerina's `configurable` feature and a `Config.toml` file to supply credentials at runtime.
+:::
+
+## Step 4: Choose an authentication method
 
 The connector supports multiple credential strategies. Use whichever matches your deployment environment:
 
@@ -85,4 +109,4 @@ The connector supports multiple credential strategies. Use whichever matches you
 
 ## Next steps
 
-- [Action Reference](actions.md) - Available operations
+- [Action Reference](actions.md) - Available operations