Skip to content

Commit 0b03eb0

Browse files
fix(dynamodb): replication regions are incompatible with resource policies in TableV2 and feature flag (#31513)
### Issue # (if applicable) Closes #30705 ### Reason for this change Resource policies were shared across all replicas in a region. ### Description of changes Changed the logic to only apply resource policy to the local replica region, or to specific replicas only when defined. ### Description of how you validated changes yes ### Checklist - [X] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 58dfda0 commit 0b03eb0

13 files changed

+570
-5
lines changed

packages/@aws-cdk-testing/framework-integ/test/aws-dynamodb/test/integ.dynamodb-v2.policy-ff.js.snapshot/ResourcePolicyTest-v2-FF.assets.json

Lines changed: 20 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
{
2+
"Resources": {
3+
"TableTestV215EEA02B7": {
4+
"Type": "AWS::DynamoDB::GlobalTable",
5+
"Properties": {
6+
"AttributeDefinitions": [
7+
{
8+
"AttributeName": "id",
9+
"AttributeType": "S"
10+
}
11+
],
12+
"BillingMode": "PAY_PER_REQUEST",
13+
"KeySchema": [
14+
{
15+
"AttributeName": "id",
16+
"KeyType": "HASH"
17+
}
18+
],
19+
"Replicas": [
20+
{
21+
"Region": "eu-west-2"
22+
},
23+
{
24+
"Region": "eu-west-1",
25+
"ResourcePolicy": {
26+
"PolicyDocument": {
27+
"Statement": [
28+
{
29+
"Action": "dynamodb:*",
30+
"Effect": "Allow",
31+
"Principal": {
32+
"AWS": {
33+
"Fn::Join": [
34+
"",
35+
[
36+
"arn:aws:iam::",
37+
{
38+
"Ref": "AWS::AccountId"
39+
},
40+
":root"
41+
]
42+
]
43+
}
44+
},
45+
"Resource": "*"
46+
}
47+
],
48+
"Version": "2012-10-17"
49+
}
50+
}
51+
}
52+
],
53+
"StreamSpecification": {
54+
"StreamViewType": "NEW_AND_OLD_IMAGES"
55+
}
56+
},
57+
"UpdateReplacePolicy": "Delete",
58+
"DeletionPolicy": "Delete"
59+
}
60+
},
61+
"Parameters": {
62+
"BootstrapVersion": {
63+
"Type": "AWS::SSM::Parameter::Value<String>",
64+
"Default": "/cdk-bootstrap/hnb659fds/version",
65+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
66+
}
67+
},
68+
"Rules": {
69+
"CheckBootstrapVersion": {
70+
"Assertions": [
71+
{
72+
"Assert": {
73+
"Fn::Not": [
74+
{
75+
"Fn::Contains": [
76+
[
77+
"1",
78+
"2",
79+
"3",
80+
"4",
81+
"5"
82+
],
83+
{
84+
"Ref": "BootstrapVersion"
85+
}
86+
]
87+
}
88+
]
89+
},
90+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
91+
}
92+
]
93+
}
94+
}
95+
}

packages/@aws-cdk-testing/framework-integ/test/aws-dynamodb/test/integ.dynamodb-v2.policy-ff.js.snapshot/cdk.out

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

packages/@aws-cdk-testing/framework-integ/test/aws-dynamodb/test/integ.dynamodb-v2.policy-ff.js.snapshot/integ.json

Lines changed: 12 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

packages/@aws-cdk-testing/framework-integ/test/aws-dynamodb/test/integ.dynamodb-v2.policy-ff.js.snapshot/manifest.json

Lines changed: 115 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

packages/@aws-cdk-testing/framework-integ/test/aws-dynamodb/test/integ.dynamodb-v2.policy-ff.js.snapshot/tablev2resourcepolicyintegtestDefaultTestDeployAssertBE3353C7.assets.json

Lines changed: 19 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

packages/@aws-cdk-testing/framework-integ/test/aws-dynamodb/test/integ.dynamodb-v2.policy-ff.js.snapshot/tablev2resourcepolicyintegtestDefaultTestDeployAssertBE3353C7.template.json

Lines changed: 36 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)