(dynamodb): grantReadData() should always grant permissions to secondary indexes

Reproduction Steps

myTable.grantReadData(myLambda);

Then we query on a secondary index on myTable and get

AccessDeniedException

What did you expect to happen?

Expected the lambda to be able to query the table, including on secondary indices.

What actually happened?

AccessDeniedException

Environment

• CDK CLI Version : v1.89.0
• Framework Version: v1.89.0
• Node.js Version: v15.10.0
• OS : MacOS
• Language (Version): TypeScript (4.2.2)

Other

Resolved / workaround by adding

   myLambda.addToRolePolicy(
      new iam.PolicyStatement({
        actions: ['dynamodb:Query'],
        resources: [`${myTable.arn}/index/*`],
      }),
    );

The fix probably belongs somewhere near https://github.com/aws/aws-cdk/blob/0ea4b19afd639541e5f1d7c1783032ee480c307e/packages/%40aws-cdk/aws-dynamodb/lib/table.ts#L906

---

This is 🐛 Bug Report

[pszabop]

Note that if you import dynamodb using fromTableAttributes() the problem probably fixes itself both for lambda and appsync (appsync I just tested)

example:

    const recipeTable = dynamodb.Table.fromTableAttributes(this, 'importedRecipeTable', {
      tableArn: recipeTableArn.toString(),  // ARN recieved from another stack's output 
      localIndexes: [ 'byName' ],  // should be from another stack's output, hardcoded for quick verification
    }) as dynamodb.Table;

Note my reason for separating databases and APIs/non-storage deployments is lifetime: It’s okay to blow destroyt stateless stuff like APIs in case of re-entrancy bugs in CDK or CloudFormation, but really bad to have to destroy databases and recreate them.

From what I can tell, sharing objects does not let you have independent lifetimes for databases and APIs, but export/import does.

[skinny85]

I’m not completely opposed to this idea @ahammond . I’m turning this into a feature request.

PRs are welcome, as always 😉.