DynamoDB Cannot insert anything but Key - amazon-web-services

Question

I am experimenting with DynamoDB to insert some data in a table test-table.
With postman and Lambda, I am trying to insert some values.
Currently, my table has a Key called node, and if I try to insert a new record doing the following in the body works:
{
"TableName": "test-table",
"Key": {"note":"test node"}
}
However, I want to add some new data to my record, for example:
{
"TableName": "test-table",
"Key": {"note":"test node"},
"Title": "This is a test"
}
But doing this does not save the second property Title, only the key get saved.
What am I missing here?
Here is my Lambda code that receives data with API Gateway:
const AWS = require('aws-sdk');
const dynamo = new AWS.DynamoDB.DocumentClient();
exports.handler = async (event, context) => {
//console.log('Received event:', JSON.stringify(event, null, 2));
let body;
let statusCode = '200';
const headers = {
'Content-Type': 'application/json',
};
try {
switch (event.httpMethod) {
case 'DELETE':
body = await dynamo.delete(JSON.parse(event.body)).promise();
break;
case 'GET':
body = await dynamo.scan({ TableName: event.queryStringParameters.TableName }).promise();
break;
case 'POST':
body = await dynamo.put(JSON.parse(event.body)).promise();
break;
case 'PUT':
body = await dynamo.update(JSON.parse(event.body)).promise();
break;
default:
throw new Error(`Unsupported method "${event.httpMethod}"`);
}
} catch (err) {
statusCode = '400';
body = err.message;
} finally {
body = JSON.stringify(body);
}
return {
statusCode,
body,
headers,
};
};

Answer 1

When using the DynamoDB Document Client, your code should ultimately look like this:
const params = { "TableName": "test-table", "Item": { "note": "test", "title": "fred" }};
const rc = await dynamo.put(params).promise();
Note specifically that the top-level attributes in the params that you pass to the put() method are TableName and Item, rather than TableName and Key. So, be sure that your parsed HTTP body matches that.
Also, because your client (the web page) is actually supplying the table name to your Lambda function, be sure to secure this application from the Confused Deputy Problem where someone hacks the HTTP body to reference a different table, such as employees or students.