diff --git a/services/blob/src/constants.rs b/services/blob/src/constants.rs
--- a/services/blob/src/constants.rs
+++ b/services/blob/src/constants.rs
@@ -29,6 +29,28 @@
 pub const BLOB_DOWNLOAD_CHUNK_SIZE: u64 = 5 * 1024 * 1024;
 
 // DynamoDB constants
+pub mod db {
+  /// Reserved holder value that indicates the row is a blob item
+  pub const BLOB_ITEM_ROW_HOLDER_VALUE: &str = "_";
+
+  pub const BLOB_TABLE_NAME: &str = "blob-service-blobs";
+  pub const BLOB_PARTITION_KEY: &str = ATTR_BLOB_HASH;
+  pub const BLOB_SORT_KEY: &str = ATTR_HOLDER;
+
+  pub const UNCHECKED_INDEX_NAME: &str = "unchecked-index";
+  pub const UNCHECKED_INDEX_PARTITION_KEY: &str = ATTR_UNCHECKED;
+  pub const UNCHECKED_INDEX_SORT_KEY: &str = ATTR_LAST_MODIFIED;
+
+  /// attribute names
+  pub const ATTR_BLOB_HASH: &str = "blob_hash";
+  pub const ATTR_HOLDER: &str = "holder";
+  pub const ATTR_CREATED_AT: &str = "created_at";
+  pub const ATTR_LAST_MODIFIED: &str = "last_modified";
+  pub const ATTR_S3_PATH: &str = "s3_path";
+  pub const ATTR_UNCHECKED: &str = "unchecked";
+}
+
+// old DynamoDB constants
 
 pub const BLOB_TABLE_NAME: &str = "blob-service-blob";
 pub const BLOB_TABLE_BLOB_HASH_FIELD: &str = "blobHash";
diff --git a/services/terraform/modules/shared/dynamodb.tf b/services/terraform/modules/shared/dynamodb.tf
--- a/services/terraform/modules/shared/dynamodb.tf
+++ b/services/terraform/modules/shared/dynamodb.tf
@@ -86,6 +86,42 @@
   }
 }
 
+resource "aws_dynamodb_table" "blob-service-blobs" {
+  name      = "blob-service-blobs"
+  hash_key  = "blob_hash"
+  range_key = "holder"
+  billing_mode = "PAY_PER_REQUEST"
+
+  attribute {
+    name = "blob_hash"
+    type = "S"
+  }
+
+  attribute {
+    name = "holder"
+    type = "S"
+  }
+
+  attribute {
+    name = "last_modified"
+    type = "N"
+  }
+
+  attribute {
+    name = "unchecked"
+    type = "S"
+  }
+
+  global_secondary_index {
+    name      = "unchecked-index"
+    hash_key  = "unchecked"
+    range_key = "last_modified"
+
+    projection_type    = "INCLUDE"
+    non_key_attributes = ["blob_hash", "holder"]
+  }
+}
+
 resource "aws_dynamodb_table" "tunnelbroker-undelivered-messages" {
   name           = "tunnelbroker-undelivered-messages"
   hash_key       = "deviceID"