[dynamodb] global table grantReadWriteData not working for replicas of global Table
See original GitHub issueMy cdk stack is this :
- 1 ddb global table in us-east-1 replicating onto 3 other regions.
- global table nature for sync across regions
- lambda and api gateway in all 4 regions.
- lambda for each region interacting with the replica ddbs in that region.
I am using “@aws-cdk/aws-dynamodb”: “1.32.2”, in my package.json
when I use below command I see that the inline policy on my Lambda executionRole has all the desired Actions on only the us-east-1 table and not on the replicating regions
dynamoDBTable.grantReadWriteData(lambdaFunction as IGrantable);
Reproduction Steps
- create cdk application
- create ddb table in us-east-1
- for other regions [eu-west-1, ap-northeast1, us-west-2] iterate over each and create lambdaFunction in each
- dynamoDBTable.grantReadWriteData(lambdaFunction as IGrantable);
- after cdk deploy open the lambdaFunction for eu-west-1 region on aws console and see executionRole in permissions
- you will notice inline policy of that role to contain only permission on us-east-1 instead of eu-west-1
What did you expect to happen?
- inline policy of lambdaExecution role to contain permission on eu-west-1 table
- ensure execution role for each lambda in each region exists on corresponding ddb table (created via replication)
What actually happened?
- execution role created only for original region (us-east-1) where the dynamodb Table got created using
new dynamoDB.Table(scope, id, tableProps);
Environment
- CLI Version : NA
- Framework Version: CDK 1.32.2
- Node.js Version: v12.18.3
- OS : mac
- Language (Version): TypeScript
Other
similar to https://github.com/aws/aws-cdk/pull/7453/files
This is 🐛 Bug Report
Issue Analytics
- State:
- Created 3 years ago
- Comments:7 (3 by maintainers)
Top Results From Across the Web
Troubleshoot DynamoDB error "cannot create a replica of table"
I'm trying to add a replica to an Amazon DynamoDB global table. but the operation fails with the exception “LimitExceededException” and throws ...
Read more >@aws-cdk/aws-dynamodb - npm
You only pay for what you use and there is no read and write capacity for the table or its global secondary indexes....
Read more >AWS CDK and Amazon DynamoDB global tables
The problem is that replicas created via the custom resource will not inherit that removalPolicy . This setting will only apply to the...
Read more >AWS CDK Lambda and DynamoDB dependency management
A discussion about issues we've stumbled upon and a solution that simplified our ... Managing dependencies between Lambdas and DynamoDB tables can get...
Read more >Global tables: How it works - Amazon DynamoDB - 亚马逊云科技
Do not modify these attributes or create attributes with the same name. You can add replica tables to the global table so that...
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
You need to upgrade all your @aws-cdk dependencies to at least 1.36.0
@cdebojit the fix in https://github.com/aws/aws-cdk/pull/7453 has been released in v1.36.0 and you are apparently using v1.32.2? Can you try with a version >= 1.36.0?