Skip to content

(dynamodb): grantReadData() should always grant permissions to secondary indexes #13703

@ahammond

Description

@ahammond

Reproduction Steps

myTable.grantReadData(myLambda);

Then we query on a secondary index on myTable and get

AccessDeniedException

What did you expect to happen?

Expected the lambda to be able to query the table, including on secondary indices.

What actually happened?

AccessDeniedException

Environment

  • CDK CLI Version : v1.89.0
  • Framework Version: v1.89.0
  • Node.js Version: v15.10.0
  • OS : MacOS
  • Language (Version): TypeScript (4.2.2)

Other

Resolved / workaround by adding

   myLambda.addToRolePolicy(
      new iam.PolicyStatement({
        actions: ['dynamodb:Query'],
        resources: [`${myTable.arn}/index/*`],
      }),
    );

The fix probably belongs somewhere near


This is 🐛 Bug Report

Metadata

Metadata

Assignees

No one assigned

    Labels

    @aws-cdk/aws-dynamodbRelated to Amazon DynamoDBeffort/smallSmall work item – less than a day of effortfeature-requestA feature should be added or improved.feature/enhancementA new API to make things easier or more intuitive. A catch-all for general feature requests.p1

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions