Skip to content

Commit 4a44a65

Browse files
chris-smith-zocdocchris-smith-zocdoc
authored
fix(dynamodb): grant*Data() methods are missing the dynamodb:DescribeTable permission (#19129)
Fixes #18773 This allows the high level dynamodb clients to function correctly ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 59ef06a commit 4a44a65

11 files changed

+44
-21
lines changed

‎packages/@aws-cdk-containers/ecs-service-extensions/test/integ.assign-public-ip.expected.json

+2-1
Original file line numberDiff line numberDiff line change
@@ -766,7 +766,8 @@
766766
"dynamodb:BatchWriteItem",
767767
"dynamodb:PutItem",
768768
"dynamodb:UpdateItem",
769-
"dynamodb:DeleteItem"
769+
"dynamodb:DeleteItem",
770+
"dynamodb:DescribeTable"
770771
],
771772
"Effect": "Allow",
772773
"Resource": [

‎packages/@aws-cdk/aws-appsync/test/integ.api-import.expected.json

+2-1
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,8 @@
8585
"dynamodb:BatchWriteItem",
8686
"dynamodb:PutItem",
8787
"dynamodb:UpdateItem",
88-
"dynamodb:DeleteItem"
88+
"dynamodb:DeleteItem",
89+
"dynamodb:DescribeTable"
8990
],
9091
"Effect": "Allow",
9192
"Resource": [

‎packages/@aws-cdk/aws-appsync/test/integ.auth-apikey.expected.json

+2-1
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,8 @@
6868
"dynamodb:BatchWriteItem",
6969
"dynamodb:PutItem",
7070
"dynamodb:UpdateItem",
71-
"dynamodb:DeleteItem"
71+
"dynamodb:DeleteItem",
72+
"dynamodb:DescribeTable"
7273
],
7374
"Effect": "Allow",
7475
"Resource": [

‎packages/@aws-cdk/aws-appsync/test/integ.graphql-iam.expected.json

+2-1
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,8 @@
9999
"dynamodb:BatchWriteItem",
100100
"dynamodb:PutItem",
101101
"dynamodb:UpdateItem",
102-
"dynamodb:DeleteItem"
102+
"dynamodb:DeleteItem",
103+
"dynamodb:DescribeTable"
103104
],
104105
"Effect": "Allow",
105106
"Resource": [

‎packages/@aws-cdk/aws-appsync/test/integ.graphql-schema.expected.json

+2-1
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,8 @@
6767
"dynamodb:BatchWriteItem",
6868
"dynamodb:PutItem",
6969
"dynamodb:UpdateItem",
70-
"dynamodb:DeleteItem"
70+
"dynamodb:DeleteItem",
71+
"dynamodb:DescribeTable"
7172
],
7273
"Effect": "Allow",
7374
"Resource": [

‎packages/@aws-cdk/aws-appsync/test/integ.graphql.expected.json

+6-3
Original file line numberDiff line numberDiff line change
@@ -147,7 +147,8 @@
147147
"dynamodb:BatchWriteItem",
148148
"dynamodb:PutItem",
149149
"dynamodb:UpdateItem",
150-
"dynamodb:DeleteItem"
150+
"dynamodb:DeleteItem",
151+
"dynamodb:DescribeTable"
151152
],
152153
"Effect": "Allow",
153154
"Resource": [
@@ -360,7 +361,8 @@
360361
"dynamodb:BatchWriteItem",
361362
"dynamodb:PutItem",
362363
"dynamodb:UpdateItem",
363-
"dynamodb:DeleteItem"
364+
"dynamodb:DeleteItem",
365+
"dynamodb:DescribeTable"
364366
],
365367
"Effect": "Allow",
366368
"Resource": [
@@ -752,7 +754,8 @@
752754
"dynamodb:BatchWriteItem",
753755
"dynamodb:PutItem",
754756
"dynamodb:UpdateItem",
755-
"dynamodb:DeleteItem"
757+
"dynamodb:DeleteItem",
758+
"dynamodb:DescribeTable"
756759
],
757760
"Effect": "Allow",
758761
"Resource": [

‎packages/@aws-cdk/aws-dynamodb/lib/perms.ts

+2
Original file line numberDiff line numberDiff line change
@@ -29,3 +29,5 @@ export const READ_STREAM_DATA_ACTIONS = [
2929
'dynamodb:GetRecords',
3030
'dynamodb:GetShardIterator',
3131
];
32+
33+
export const DESCRIBE_TABLE = 'dynamodb:DescribeTable';

‎packages/@aws-cdk/aws-dynamodb/lib/table.ts

+8-6
Original file line numberDiff line numberDiff line change
@@ -679,15 +679,16 @@ abstract class TableBase extends Resource implements ITable {
679679

680680
/**
681681
* Permits an IAM principal all data read operations from this table:
682-
* BatchGetItem, GetRecords, GetShardIterator, Query, GetItem, Scan.
682+
* BatchGetItem, GetRecords, GetShardIterator, Query, GetItem, Scan, DescribeTable.
683683
*
684684
* Appropriate grants will also be added to the customer-managed KMS key
685685
* if one was configured.
686686
*
687687
* @param grantee The principal to grant access to
688688
*/
689689
public grantReadData(grantee: iam.IGrantable): iam.Grant {
690-
return this.combinedGrant(grantee, { keyActions: perms.KEY_READ_ACTIONS, tableActions: perms.READ_DATA_ACTIONS });
690+
const tableActions = perms.READ_DATA_ACTIONS.concat(perms.DESCRIBE_TABLE);
691+
return this.combinedGrant(grantee, { keyActions: perms.KEY_READ_ACTIONS, tableActions });
691692
}
692693

693694
/**
@@ -724,30 +725,31 @@ abstract class TableBase extends Resource implements ITable {
724725

725726
/**
726727
* Permits an IAM principal all data write operations to this table:
727-
* BatchWriteItem, PutItem, UpdateItem, DeleteItem.
728+
* BatchWriteItem, PutItem, UpdateItem, DeleteItem, DescribeTable.
728729
*
729730
* Appropriate grants will also be added to the customer-managed KMS key
730731
* if one was configured.
731732
*
732733
* @param grantee The principal to grant access to
733734
*/
734735
public grantWriteData(grantee: iam.IGrantable): iam.Grant {
736+
const tableActions = perms.WRITE_DATA_ACTIONS.concat(perms.DESCRIBE_TABLE);
735737
const keyActions = perms.KEY_READ_ACTIONS.concat(perms.KEY_WRITE_ACTIONS);
736-
return this.combinedGrant(grantee, { keyActions, tableActions: perms.WRITE_DATA_ACTIONS });
738+
return this.combinedGrant(grantee, { keyActions, tableActions });
737739
}
738740

739741
/**
740742
* Permits an IAM principal to all data read/write operations to this table.
741743
* BatchGetItem, GetRecords, GetShardIterator, Query, GetItem, Scan,
742-
* BatchWriteItem, PutItem, UpdateItem, DeleteItem
744+
* BatchWriteItem, PutItem, UpdateItem, DeleteItem, DescribeTable
743745
*
744746
* Appropriate grants will also be added to the customer-managed KMS key
745747
* if one was configured.
746748
*
747749
* @param grantee The principal to grant access to
748750
*/
749751
public grantReadWriteData(grantee: iam.IGrantable): iam.Grant {
750-
const tableActions = perms.READ_DATA_ACTIONS.concat(perms.WRITE_DATA_ACTIONS);
752+
const tableActions = perms.READ_DATA_ACTIONS.concat(perms.WRITE_DATA_ACTIONS).concat(perms.DESCRIBE_TABLE);
751753
const keyActions = perms.KEY_READ_ACTIONS.concat(perms.KEY_WRITE_ACTIONS);
752754
return this.combinedGrant(grantee, { keyActions, tableActions });
753755
}

‎packages/@aws-cdk/aws-dynamodb/test/dynamodb.test.ts

+10-3
Original file line numberDiff line numberDiff line change
@@ -643,6 +643,7 @@ testLegacyBehavior('if an encryption key is included, encrypt/decrypt permission
643643
'dynamodb:PutItem',
644644
'dynamodb:UpdateItem',
645645
'dynamodb:DeleteItem',
646+
'dynamodb:DescribeTable',
646647
],
647648
Effect: 'Allow',
648649
Resource: [
@@ -1919,18 +1920,18 @@ describe('grants', () => {
19191920

19201921
test('"grantReadData" allows the principal to read data from the table', () => {
19211922
testGrant(
1922-
['BatchGetItem', 'GetRecords', 'GetShardIterator', 'Query', 'GetItem', 'Scan', 'ConditionCheckItem'], (p, t) => t.grantReadData(p));
1923+
['BatchGetItem', 'GetRecords', 'GetShardIterator', 'Query', 'GetItem', 'Scan', 'ConditionCheckItem', 'DescribeTable'], (p, t) => t.grantReadData(p));
19231924
});
19241925

19251926
test('"grantWriteData" allows the principal to write data to the table', () => {
19261927
testGrant(
1927-
['BatchWriteItem', 'PutItem', 'UpdateItem', 'DeleteItem'], (p, t) => t.grantWriteData(p));
1928+
['BatchWriteItem', 'PutItem', 'UpdateItem', 'DeleteItem', 'DescribeTable'], (p, t) => t.grantWriteData(p));
19281929
});
19291930

19301931
test('"grantReadWriteData" allows the principal to read/write data', () => {
19311932
testGrant([
19321933
'BatchGetItem', 'GetRecords', 'GetShardIterator', 'Query', 'GetItem', 'Scan',
1933-
'ConditionCheckItem', 'BatchWriteItem', 'PutItem', 'UpdateItem', 'DeleteItem',
1934+
'ConditionCheckItem', 'BatchWriteItem', 'PutItem', 'UpdateItem', 'DeleteItem', 'DescribeTable',
19341935
], (p, t) => t.grantReadWriteData(p));
19351936
});
19361937

@@ -2092,6 +2093,7 @@ describe('grants', () => {
20922093
'dynamodb:GetItem',
20932094
'dynamodb:Scan',
20942095
'dynamodb:ConditionCheckItem',
2096+
'dynamodb:DescribeTable',
20952097
],
20962098
'Effect': 'Allow',
20972099
'Resource': [
@@ -2244,6 +2246,7 @@ describe('import', () => {
22442246
'dynamodb:GetItem',
22452247
'dynamodb:Scan',
22462248
'dynamodb:ConditionCheckItem',
2249+
'dynamodb:DescribeTable',
22472250
],
22482251
'Effect': 'Allow',
22492252
'Resource': [
@@ -2290,6 +2293,7 @@ describe('import', () => {
22902293
'dynamodb:PutItem',
22912294
'dynamodb:UpdateItem',
22922295
'dynamodb:DeleteItem',
2296+
'dynamodb:DescribeTable',
22932297
],
22942298
'Effect': 'Allow',
22952299
'Resource': [
@@ -2432,6 +2436,7 @@ describe('import', () => {
24322436
'dynamodb:GetItem',
24332437
'dynamodb:Scan',
24342438
'dynamodb:ConditionCheckItem',
2439+
'dynamodb:DescribeTable',
24352440
],
24362441
Resource: [
24372442
{
@@ -2606,6 +2611,7 @@ describe('global', () => {
26062611
'dynamodb:GetItem',
26072612
'dynamodb:Scan',
26082613
'dynamodb:ConditionCheckItem',
2614+
'dynamodb:DescribeTable',
26092615
],
26102616
Effect: 'Allow',
26112617
Resource: [
@@ -2760,6 +2766,7 @@ describe('global', () => {
27602766
'dynamodb:GetItem',
27612767
'dynamodb:Scan',
27622768
'dynamodb:ConditionCheckItem',
2769+
'dynamodb:DescribeTable',
27632770
],
27642771
Effect: 'Allow',
27652772
Resource: [

‎packages/@aws-cdk/aws-dynamodb/test/integ.dynamodb.expected.json

+4-2
Original file line numberDiff line numberDiff line change
@@ -387,7 +387,8 @@
387387
"dynamodb:Query",
388388
"dynamodb:GetItem",
389389
"dynamodb:Scan",
390-
"dynamodb:ConditionCheckItem"
390+
"dynamodb:ConditionCheckItem",
391+
"dynamodb:DescribeTable"
391392
],
392393
"Effect": "Allow",
393394
"Resource": [
@@ -410,7 +411,8 @@
410411
"dynamodb:Query",
411412
"dynamodb:GetItem",
412413
"dynamodb:Scan",
413-
"dynamodb:ConditionCheckItem"
414+
"dynamodb:ConditionCheckItem",
415+
"dynamodb:DescribeTable"
414416
],
415417
"Effect": "Allow",
416418
"Resource": [

‎packages/@aws-cdk/aws-dynamodb/test/integ.dynamodb.sse.expected.json

+4-2
Original file line numberDiff line numberDiff line change
@@ -497,7 +497,8 @@
497497
"dynamodb:Query",
498498
"dynamodb:GetItem",
499499
"dynamodb:Scan",
500-
"dynamodb:ConditionCheckItem"
500+
"dynamodb:ConditionCheckItem",
501+
"dynamodb:DescribeTable"
501502
],
502503
"Effect": "Allow",
503504
"Resource": [
@@ -533,7 +534,8 @@
533534
"dynamodb:Query",
534535
"dynamodb:GetItem",
535536
"dynamodb:Scan",
536-
"dynamodb:ConditionCheckItem"
537+
"dynamodb:ConditionCheckItem",
538+
"dynamodb:DescribeTable"
537539
],
538540
"Effect": "Allow",
539541
"Resource": [

0 commit comments

Comments
 (0)