fix(dynamodb): addtoresourcepolicy fix for table (v1) construct #31516
Conversation
github-actions
bot
added
beginning-contributor
LeeroyHannigan
changed the title
| @@ -564,7 +564,7 @@ export abstract class TableBase extends Resource implements ITable, iam.IResourc | |||
| * @param actions The set of actions to allow (i.e. "dynamodb:PutItem", "dynamodb:GetItem", ...) | |||
| */ | |||
| public grant(grantee: iam.IGrantable, ...actions: string[]): iam.Grant { | |||
| return iam.Grant.addToPrincipalOrResource({ | |||
| return iam.Grant.addToPrincipal({ | |||
There was a problem hiding this comment.
Why does this need to become addToPrincipal? We are for example already using the resource policy to grant cross-account access to a table directly. We build the policy in CDK from external account ArnPrincipals.
There was a problem hiding this comment.
Because addToPrincipalOrResource never adds to the resource, as IAM is missing methods. So I'm putting it back to how it was before I changed it until I have time to implement the missing methods in IAM
There was a problem hiding this comment.
I don't fully understand what methods are missing. Looking at Grant, it seems to be handling this already, if given the resource in the call: https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-iam/lib/grant.ts#L145-L157. It's just that Table.addToResourcePolicy is not functional, but instead adds statements to a policy instance not bound with the internal CfnTable.
| @@ -958,11 +941,11 @@ export abstract class TableBase extends Resource implements ITable, iam.IResourc | |||
| produce: () => this.hasIndex ? `${arn}/index/*` : Aws.NO_VALUE, | |||
| })), | |||
| ]; | |||
| const ret = iam.Grant.addToPrincipalOrResource({ | |||
| const ret = iam.Grant.addToPrincipal({ | |||
There was a problem hiding this comment.
Same as above, this would break Table v1 for us.
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
aws-cdk-automation
added
the
pr/needs-community-review
Issue # (if applicable)
Closes #30793.
Reason for this change
addToResourcePolicy()was not correctly adding a policy statement to the tableDescription of changes
Fixed the method to correctly add the policy to the table constructor.
Description of how you validated changes
Tests added
Checklist
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license