aws-dynamodb: Unable to set resource policy on DDB streams
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
There does not seem to be a way to set resource policy on DynamoDB stream through L2 constructs.
`addReplica` method does not allow setting stream resource policy nor is it available in `TableOptionsV2`.
We can only set resource policy for the table itself.
### Regression Issue
- [ ] Select this option if this issue appears to be a regression.
### Last Known Working CDK Version
_No response_
### Expected Behavior
I expect to be able to set a resource policy for DDB streams via L2 constructs.
### Current Behavior
Currently it's is not possible to set resource policy for DDB streams via L2 constructs.
### Reproduction Steps
Try creating DynamoDB table and set resource policy for DDB streams (not table).
### Possible Solution
Expose `streamResourcePolicy` in `TableOptionsV2`.
### Additional Information/Context
I'm currently setting the policy by getting the L1 construct and resolving the replicas property.
```Javascript
const cfnTable = table.node.defaultChild as CfnGlobalTable
if (cfnTable && props.streamResourcePolicy) {
// At this stage, cfnTable.replicas is a Lazy.any() and needs to be resolved for us to be able to set new properties.
const replicas = Stack.of(this).resolve(cfnTable.replicas) as CfnGlobalTable.ReplicaSpecificationProperty[]
if (Array.isArray(replicas)) {
cfnTable.replicas = replicas.map(replica => {
return {
...replica,
replicaStreamSpecification: {
resourcePolicy: {
policyDocument: props.streamResourcePolicy,
},
},
}
})
}
}
```
### CDK CLI Version
2.154.1
### Framework Version
_No response_
### Node.js Version
v20.15.0
### OS
MacOS Sonoma 14.5 (23F79)
### Language
TypeScript
### Language Version
5.4.5
### Other information
_No response_
Contributor guide
Research direction
Start at the addReplica method and TableOptionsV2, then trace how CfnGlobalTable.replicas and ReplicaSpecificationProperty represent stream settings. Compare the existing table resource-policy support with the requested stream policy path. Done means an L2 construct can configure a DynamoDB stream resource policy without resolving and modifying the L1 replicas property directly.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, databases
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 34/100