aws / aws/aws-cdk

aws-dynamodb: Unable to set resource policy on DDB streams

Open
#31,229 2 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-dynamodb effort/medium feature-request p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

There does not seem to be a way to set resource policy on DynamoDB stream through L2 constructs.
`addReplica` method does not allow setting stream resource policy nor is it available in `TableOptionsV2`.
We can only set resource policy for the table itself.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Version

_No response_

### Expected Behavior

I expect to be able to set a resource policy for DDB streams via L2 constructs.

### Current Behavior

Currently it's is not possible to set resource policy for DDB streams via L2 constructs.

### Reproduction Steps

Try creating DynamoDB table and set resource policy for DDB streams (not table).

### Possible Solution

Expose `streamResourcePolicy` in `TableOptionsV2`.

### Additional Information/Context

I'm currently setting the policy by getting the L1 construct and resolving the replicas property.

```Javascript
const cfnTable = table.node.defaultChild as CfnGlobalTable
if (cfnTable && props.streamResourcePolicy) {
// At this stage, cfnTable.replicas is a Lazy.any() and needs to be resolved for us to be able to set new properties.
const replicas = Stack.of(this).resolve(cfnTable.replicas) as CfnGlobalTable.ReplicaSpecificationProperty[]
if (Array.isArray(replicas)) {
cfnTable.replicas = replicas.map(replica => {
return {
...replica,
replicaStreamSpecification: {
resourcePolicy: {
policyDocument: props.streamResourcePolicy,
},
},
}
})
}
}
```

### CDK CLI Version

2.154.1

### Framework Version

_No response_

### Node.js Version

v20.15.0

### OS

MacOS Sonoma 14.5 (23F79)

### Language

TypeScript

### Language Version

5.4.5

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start at the addReplica method and TableOptionsV2, then trace how CfnGlobalTable.replicas and ReplicaSpecificationProperty represent stream settings. Compare the existing table resource-policy support with the requested stream policy path. Done means an L2 construct can configure a DynamoDB stream resource policy without resolving and modifying the L1 replicas property directly.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, databases
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
34/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.