DynamoDB Global Table's grant*() gives permission only to regional resources

new Table(...).grant(grantee, ...actions), new Table(...).grantFullAccess(grantee), new Table(...).grantReadData(grantee) and new Table(...).grantReadWriteData(grantee) grant access to the table and its indexes only in the region in which the table is created, even when replicationRegions is not undefined.

Reproduction Steps

1. Create a global table in a stack with us-east-1 region:

table1 = new dynamodb.Table(this, 'Table1', {
...
...
tableName: 'Table1', // You need to share this table across environments
replicationRegions: ['us-west-1']
});

1. Share the above table to a different stack with us-west-1 region.

2. In the us-west-1 stack, create a lambda function and grant it the read permission of the global table.

myLambda = new lambda.Function(...);

table1.grantWriteAccess(myLambda);

Unfortunately, the myLambda won’t be able to read from the same region (us-west-1) table1 replica because of wrong iam permissions. If you look at the service role for myLambda, you’ll find this policy statement:

{
            "Action": [
                "dynamodb:Query",
               ...
               ...
            ],
            "Resource": [
                "arn:aws:dynamodb:us-east-1:<account no.>:table/Table1",
               "arn:aws:dynamodb:us-east-1:<account no.>:table/Table1/index/*"
            ],
            "Effect": "Allow"
        }

After finding replicationRegions, CDK should either replace us-east-1 with * or add more regional arns to Resource.

I also can’t modify the table1 arn to create my own iam policy statement.

table1.tableArn.replace('us-east-1', '*');

This doesn’t work because tableArn is not a string at runtime even if I give physical name to the table.

I had to manually edit policy statements in production which has created a drift in CloudFormation Stack.

Error Log

No error log. Human introspection is needed.

Environment

• CLI Version : 1.32.0
• Framework Version: 1.32.0
• OS : Windows 10 Pro
• Language : Typescript

---

This is 🐛 Bug Report

[skinny85]

A little besides the issue, but cross-region/account tokens are definitely possible 😃. Through something called physical names (set here in DynamoDB, and later used here).

[jogold]

it’s not granting read access to indexes of the table as before.

Good point.