aws / aws/aws-cdk

Imported DynamoDB TableV2 with fromTableArn does not get access to indexes with grantFullAccess

Open
#33,896 3 comments 1 reaction 0 assignees View on GitHub
@aws-cdk/aws-dynamodb bug effort/medium p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

Related to [1540](https://github.com/aws/aws-cdk/issues/1540), but with a new caveat. There was previously a bug with granting constructs access to a table, where the policy it created would not grant access to any secondary indexes. This was addressed in [PR 1564](https://github.com/aws/aws-cdk/pull/1564). Notably, I think this was before `TableV2` was introduced.
However I have just found that, when importing with `cdk.aws_dynamodb.TableV2.fromTableArn`, `grantFullAccess` still does not give adequate permissions for indexes in that case.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Version

_No response_

### Expected Behavior

`grantFullAccess` should grant access to any indexes of the table.

### Current Behavior

`grantFullAccess` does not access to any indexes of the table.

### Reproduction Steps

1: Create a table with an index in AWS.
2: Import the table into a construct with `fromTableArn`
3: Do `grantFullAccess` to a lambda
4: Try to access the index from the lambda - this will fail to due inadequate permissions.

### Possible Solution

I presume either:
1 - The `ITableV2` created by `fromTableArn` may not be aware of the indexes on the imported table, so did not add permissions for them.
2 - Since `TableV2` is newer than the fix, this may have been a regression. However I have not tested a v1 `ITable` so I can't confirm this.

### Additional Information/Context

The table I imported where I discovered this is a couple of years old, and was originally created in AWS SAM, but that should not prevent this from working.

### CDK CLI Version

2.1005.0 (build be378de)

### Framework Version

2.181.1

### Node.js Version

v20.15.1

### OS

Ubuntu 24.04

### Language

TypeScript

### Language Version

5.6.3

### Other information

This is the policy that was added:
```
{
"Action": "dynamodb:*",
"Resource": "arn:aws:dynamodb:eu-west-1:[account]:table/[mytablename]",
"Effect": "Allow"
}

```
Notably lacking any permissions for `/index`

Contributor guide

Open the contributing guide

Research direction

Start at TableV2.fromTableArn and grantFullAccess, then reproduce the issue with an imported DynamoDB table that has a secondary index. Trace the generated policy and verify that the permissions cover the table's index ARN as well as the table ARN; done means a Lambda can access the imported table's indexes.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, databases
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.