feat(dynamodb): add cross-account global table replication support by LeeroyHannigan · Pull Request #36895 · aws/aws-cdk

LeeroyHannigan · 2026-02-05T21:16:42Z

Reason for this change

DynamoDB global tables currently only support same-account replication across regions. Customers need the ability to replicate tables across AWS accounts for multi-tenant architectures, organizational boundaries, and disaster recovery scenarios.

Description of changes

Added support for cross-account DynamoDB global table replication through a new TableV2MultiAccountReplica construct and automatic permission management:

Core Changes:

Added TableV2MultiAccountReplica construct for creating replicas from source tables in different accounts
Added settingsReplicationMode property to control replication of table settings (indexes, streams, encryption)
Implemented automatic resource policy and KMS permissions for cross-account replication
Added TableGrants class with multiAccountReplicationTo() and multiAccountReplicationFrom() methods

Permission Management:

Source table resource policy grants dynamodb:AssociateTableReplica to replica account
Both tables grant DynamoDB replication service read/write permissions with aws:SourceAccount conditions
Automatic KMS key permissions when encryption is enabled

Design Decisions:

Used aws:SourceAccount condition instead of aws:SourceArn to avoid circular dependencies
Only pass encryptedResource when encryption key exists to avoid unnecessary policy statements
Validate that source and replica are in different regions
Require explicit table names for cross-account replicas when source uses generated names

Describe any new or updated permissions being added

DynamoDB Table Resource Policies:

dynamodb:AssociateTableReplica - Granted to replica account on source table
dynamodb:ReadDataForReplication, dynamodb:WriteDataForReplication, dynamodb:ReplicateSettings - Granted to replication.dynamodb.amazonaws.com service principal with aws:SourceAccount condition

KMS Key Permissions (when encryption enabled):

kms:Decrypt, kms:DescribeKey, kms:Encrypt, kms:ReEncrypt*, kms:GenerateDataKey* - Granted to replication.dynamodb.amazonaws.com service principal

Description of how you validated changes

Unit Tests:

Added tests for TableV2MultiAccountReplica construct
Added tests for cross-account replication permission grants
Added tests for KMS permission grants
Added tests for validation (same-region check, table name requirements)

Integration Tests:

Created integ.dynamodb-v2.cross-account-replica.ts - Tests full cross-account replication with both tables in same CDK app
Created integ.dynamodb-v2.cross-account-replica-imported.ts - Tests replication with imported source table from different account
Manually deployed and verified bidirectional replication works with SettingsReplicationMode.ALL

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

github-actions · 2026-02-05T21:19:10Z

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
Please try merge from main to avoid findings unrelated to the PR.

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results	120 ran	120 passed

Test	Result
No test annotations available

View Security Guardian Results

github-actions · 2026-02-05T21:19:13Z

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
Please try merge from main to avoid findings unrelated to the PR.

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results with resolved templates	120 ran	120 passed

Test	Result
No test annotations available

View Security Guardian Results with resolved templates

Abogical · 2026-02-06T10:55:42Z


+    // Validate replicaSourceTable if provided
+    if (props.replicaSourceTable) {
+      const sourceStack = Stack.of(props.replicaSourceTable);
+      const sourceRegion = sourceStack.splitArn(props.replicaSourceTable.tableArn, ArnFormat.SLASH_RESOURCE_NAME).region;
+      if (sourceRegion === this.region) {
+        throw new ValidationError(
+          `The region in \`replicaSourceArn\` (${sourceRegion}) cannot be the same as the stack region (${this.region}).`,
+          this,
+        );
+      }
+    }
+


Again, you don't set the replica properties here. Only set them on the replica class.

Abogical · 2026-02-06T11:06:04Z

+import { IKey } from '../../aws-kms';
 import { Grant } from '../../aws-iam';
 import type { IKey } from '../../aws-kms';
+>>>>>>> internal/main


This should be removed.

Suggested change

>>>>>>> internal/main

Pull request has been modified.

Abogical

Integration test snapshots would need to be updated: https://github.com/aws/aws-cdk/actions/runs/21766853798/job/62804783432?pr=36895#step:9:5905

Pull request has been modified.

Abogical · 2026-02-16T12:55:54Z

+    }
+
+    this.policyResource.addToResourcePolicy(new iam.PolicyStatement({
+      sid: 'AllowMultiAccountReplicaAssociation',


There may be a conflict in the SID if the table has multiple cross-account replicas. Multiple policies will be generated with the same SID's, leading to a deployment conflict. Can the SID include the destination account and table name to make sure it is deduplicated and unique?

Suggested change

sid: 'AllowMultiAccountReplicaAssociation',

sid: `AllowMultiAccountReplicaAssociation-${arnComponents.account}`,

Abogical · 2026-02-16T12:56:58Z

+    }));
+
+    this.policyResource.addToResourcePolicy(new iam.PolicyStatement({
+      sid: 'AllowReplicationServiceReadWrite',


Same suggestion as above.

This hasn't been addressed.

Pull request has been modified.

Abogical · 2026-02-16T14:42:55Z

+    }));
+
+    this.policyResource.addToResourcePolicy(new iam.PolicyStatement({
+      sid: 'AllowReplicationServiceReadWrite',


This hasn't been addressed.

Pull request has been modified.

Abogical

There is a unit test error, see: https://github.com/aws/aws-cdk/actions/runs/22067324790/job/63762511491?pr=36895#step:9:3500

aws-cdk-lib: FAI
aws-cdk-lib: L aws-
aws-cdk-lib: dynamodb/tes
aws-cdk-lib: t/table-v
aws-cdk-lib: 2.test.t
aws-cdk-lib: s (22.319
aws-cdk-lib:  s)
aws-cdk-lib:   
aws-cdk-lib: ● grantMulti
aws-cdk-lib: AccountRepl
aws-cdk-lib: icationTo
aws-cdk-lib:  adds req
aws-cdk-lib: uired resour
aws-cdk-lib: ce policy 
aws-cdk-lib: statement
aws-cdk-lib: s
aws-cdk-lib:     E
aws-cdk-lib: xpected valu
aws-cdk-lib: e   undefi
aws-cdk-lib: ned
aws-cdk-lib:     R
aws-cdk-lib: eceived:
aws-cdk-lib:    
aws-cdk-lib:    undefine
aws-cdk-lib: d
aws-cdk-lib:     Me
aws-cdk-lib: ssage:
aws-cdk-lib:      
aws-cdk-lib:  Template ha
aws-cdk-lib: s 1 resou
aws-cdk-lib: rces with
aws-cdk-lib:  type AWS
aws-cdk-lib: ::Dynamo
aws-cdk-lib: DB::GlobalTa
aws-cdk-lib: ble, but n
aws-cdk-lib: one matc
aws-cdk-lib: h as ex
aws-cdk-lib: pec
aws-cdk-lib: ted.
aws-cdk-lib:     
aws-cdk-lib: The 1 close
aws-cdk-lib: st match
aws-cdk-lib: es:
aws-cdk-lib:     T
aws-cdk-lib: ableCD117FA1
aws-cdk-lib:  :: {
aws-cdk-lib:   
aws-cdk-lib:     "DeletionPolicy
aws-cdk-lib: ": "Retain",
aws-cdk-lib:       "Properties": {
aws-cdk-lib:         "AttributeDefinitions": [ { ... } ],
aws-cdk-lib:         "BillingMode": "PAY_PER_REQUEST",
aws-cdk-lib:         "KeySchema": [ { ... } ],
aws-cdk-lib:         "Replicas": [
aws-cdk-lib:           {
aws-cdk-lib:             "Region": "us-east-2",
aws-cdk-lib:             "ResourcePolicy": {
aws-cdk-lib:               "Policy
aws-cdk-lib: D
aws-cdk-lib: ocument": {
aws-cdk-lib:                 "Statement": [
aws-cdk-lib:                   {
aws-cdk-lib:                     "Action": "dynamodb:AssociateTableReplica",
aws-cdk-lib:                     "Effect": "Allow",
aws-cdk-lib:                     "Principal": { "AWS": { "Fn::Join": [ ... ] } },
aws-cdk-lib:                     "Resource": "*",
aws-cdk-lib:     !!               Expected AllowMultiAccountReplicaAssociation but received AllowMultiAccountReplicaAssociation-222222222222
aws-cdk-lib:                     "Sid": "AllowMultiAccountReplicaAssociation-222222222222"
aws-cdk-lib:                   },
aws-cdk-lib:                   {
aws-cdk-lib:                     "Action": [ ... ],
aws-cdk-lib:                     "Condition": { "StringEquals": { "aws:SourceAccount": [ "111111111111", "222222222222" ] } },
aws-cdk-lib:                     "Effect": "Allow",
aws-cdk-lib:                     "Principal": { "Service": "replication.dynamodb.amazonaws.com" },
aws-cdk-lib:                     "Resource": "*",
aws-cdk-lib:     !!               Expected AllowReplicationServiceReadWrite but received AllowReplicationServiceReadWrite-222222222222
aws-cdk-lib:                     "Sid": "AllowReplicationServiceReadWrite-2222222
aws-cdk-lib: 22222"
aws-cdk-lib:                   }
aws-cdk-lib:                 ],
aws-cdk-lib:                 "Version": "2012-10-17"
aws-cdk-lib:               }
aws-cdk-lib:             }
aws-cdk-lib:           }
aws-cdk-lib:         ]
aws-cdk-lib:       },
aws-cdk-lib:       "Type": "AWS::DynamoDB::GlobalTable",
aws-cdk-lib:       "UpdateReplacePolicy": "Retain"
aws-cdk-lib:     }
aws-cdk-lib:     Difference:
aws-cdk-lib:     Compared values have no visual difference.
aws-cdk-lib:       106 |     const matchError = hasResourceProperties(this.template, type, props);
aws-cdk-lib:       107 |     if (matchError) {
aws-cdk-lib:     > 108 |       throw new AssertionError(matchError);
aws-cdk-lib:           |             ^
aws-cdk-lib:       109 |     }
aws-cdk-lib:       110 |   }
aws-cdk-lib:       111 |
aws-cdk-lib:       at Template.hasResourceProperties (assertions/lib/template.ts:108:13)
aws-cdk-lib:       at Object.<anonymous> (aws-dynamodb/test/table-v2.test.ts:3739:29)
aws-cdk-lib:   ● TableV2MultiAccountReplica creates replica with permissions
aws-cdk-lib:     Expected value   undefined
aws-cdk-lib:     Received:
aws-cdk-lib:       undefined
aws-cdk-lib:     Message:
aws-cdk-lib:       Template has 1 resources with type AWS::DynamoDB::GlobalTable, but none match as expected.
aws-cdk-lib:     The 1 closest matches:
aws-cdk-lib:     SourceTable70380C26 :: {
aws-cdk-lib:       "DeletionPolicy": "Retain
aws-cdk-lib: ",
aws-cdk-lib:       "Properties": {
aws-cdk-lib:         "AttributeDefinitions": [ { ... } ],
aws-cdk-lib:         "BillingMode": "PAY_PER_REQUEST",
aws-cdk-lib:         "KeySchema": [ { ... } ],
aws-cdk-lib:         "Replicas": [
aws-cdk-lib:           {
aws-cdk-lib:             "Region": "us-east-2",
aws-cdk-lib:             "ResourcePolicy": {
aws-cdk-lib:               "PolicyDocument": {
aws-cdk-lib:                 "Statement": [
aws-cdk-lib:     !!             Could not match arrayWith pattern 0. This is the closest match
aws-cdk-lib:                   {
aws-cdk-lib:                     "Action": "dynamodb:AssociateTableReplica",
aws-cdk-lib:                     "Effect": "Allow",
aws-cdk-lib:                     "Principal": { "AWS": { "Fn::Join": [ ... ] } },
aws-cdk-lib:                     "Resource": "*",
aws-cdk-lib:     !!               Expected type string but received object
aws-cdk-lib:                     "Sid": {
aws-cdk-lib:                       "Fn::Join": [ ... ]
aws-cdk-lib:                     }
aws-cdk-lib:                   },
aws-cdk-lib:                   { ... }
aws-cdk-lib:                 ],
aws-cdk-lib:                 "Version": "2012-10-17"
aws-cdk-lib:               }
aws-cdk-lib:             }
aws-cdk-lib:           }
aws-cdk-lib:         ],
aws-cdk-lib:         "TableName": "sourcestackstacksourcetable4d2d74602f5cc7577a18"
aws-cdk-lib:       },
aws-cdk-lib:       "Type": "AWS::DynamoDB::GlobalTable",
aws-cdk-lib:       "UpdateReplacePolicy": "Retain"
aws-cdk-lib:     }
aws-cdk-lib:     Difference:
aws-cdk-lib:     Compared values have no visual difference.
aws-cdk-lib:       106 |     const matchError = hasResourceProperties(this.template, type, props);
aws-cdk-lib:       107 |     if (matchError) {
aws-cdk-lib:     > 108 |       throw new AssertionError(matchError);
aws-cdk-lib:           |             ^
aws-cdk-lib:       109 |     }
aws-cdk-lib:       110 |   }
aws-cdk-lib:       111 |
aws-cdk-lib:       at Template.hasResourceProperties (assertions/lib/template.ts:108:13)
aws-cdk-lib:       at Object.<anonymous> (aws-dynamodb/test/table-v2.test.ts:3901:35)
aws-cdk-lib: Test Suites: 1 failed, 821 passed, 822 total
aws-cdk-lib: Tests:       2 failed, 3 skipped, 16921 passed, 16926 total
aws-cdk-lib: Snapshots:   13 passed, 13 total
aws-cdk-lib: Time:        252.958 s
aws-cdk-lib: Ran all test suites.
aws-cdk-lib: 
aws-cdk-lib: error Command failed with exit code 1.

Pull request has been modified.

Abogical · 2026-02-16T16:01:35Z

@Mergifyio update

mergify · 2026-02-16T16:01:49Z

update

❌ Mergify doesn't have permission to update

Details

For security reasons, Mergify can't update this pull request. Try updating locally.
GitHub response: refusing to allow a GitHub App to create or update workflow .github/workflows/integration-test-deployment.yml without workflows permission

Pull request has been modified.

mergify · 2026-02-16T16:45:58Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

mergify · 2026-02-16T16:46:09Z

mergify · 2026-02-16T17:15:45Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

github-actions · 2026-02-16T17:16:01Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

feat(dynamodb): add cross-account global table replication support

e46663d

aws-cdk-automation requested a review from a team February 5, 2026 21:16

github-actions Bot added valued-contributor [Pilot] contributed between 6-12 PRs to the CDK p2 labels Feb 5, 2026

aws-cdk-automation added the pr/needs-further-review PR requires additional review from our team specialists due to the scope or complexity of changes. label Feb 5, 2026

Merge remote-tracking branch 'upstream/main' into lhnng-multi

579dc43

pahud mentioned this pull request Feb 5, 2026

Failed CodeBuild CI - 14 PR(s) pahud/aws-cdk#17

Open

Abogical self-assigned this Feb 6, 2026

Abogical requested changes Feb 6, 2026

View reviewed changes

Comment thread packages/aws-cdk-lib/aws-dynamodb/lib/table-v2.ts Outdated

Changes to replicaTableSourceArn and IEncryptedResource based on review

03a96d5

Abogical requested changes Feb 6, 2026

View reviewed changes

Comment thread packages/aws-cdk-lib/aws-dynamodb/README.md

Abogical previously requested changes Feb 6, 2026

View reviewed changes

Comment thread packages/aws-cdk-lib/aws-dynamodb/lib/table-v2.ts

Use source tableName for destination replica

6ca387c

Lee Hannigan and others added 2 commits February 6, 2026 20:16

Adding docstring

cf99fbb

Merge branch 'main' into lhnng-multi

a7b4799

Abogical requested changes Feb 9, 2026

View reviewed changes

Comment thread packages/aws-cdk-lib/aws-dynamodb/lib/table-v2.ts

Abogical previously requested changes Feb 9, 2026

View reviewed changes

remove custom cfn schema, update snapshots with dry-run

f180b25

adding imports to READEME examples

e8115ff

Abogical previously requested changes Feb 16, 2026

View reviewed changes

Lee Hannigan added 2 commits February 16, 2026 14:31

making source table IAM policy SID unique per dest account

ad83ad8

Adding imports to README examples

d5caa7a

Abogical previously requested changes Feb 16, 2026

View reviewed changes

Adding unique SID for IAM resource policy

3558090

Abogical previously requested changes Feb 16, 2026

View reviewed changes

amending unit tests based on changes to SID for grants

033b21d

Abogical previously approved these changes Feb 16, 2026

View reviewed changes

Merge branch 'main' into lhnng-multi

3ac90ad

Abogical approved these changes Feb 16, 2026

View reviewed changes

Abogical added the priority-pr push the PR to priority squash queue label Feb 16, 2026

Merge branch 'main' into lhnng-multi

f4b0f06

mergify Bot mentioned this pull request Feb 16, 2026

feat(kinesisfirehose): support dynamic partitioning #35903

Merged

1 task

mergify Bot merged commit 353a9bb into aws:main Feb 16, 2026
22 of 23 checks passed

github-actions Bot locked as resolved and limited conversation to collaborators Feb 16, 2026

	sid: 'AllowMultiAccountReplicaAssociation',
	sid: `AllowMultiAccountReplicaAssociation-${arnComponents.account}`,

Conversation

LeeroyHannigan commented Feb 5, 2026

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

Uh oh!

github-actions Bot commented Feb 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Feb 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Abogical Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

Abogical Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Abogical left a comment

Choose a reason for hiding this comment

Uh oh!

Abogical Feb 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

LeeroyHannigan Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

Abogical Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

Abogical Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

LeeroyHannigan Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Abogical Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

Abogical left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Abogical commented Feb 16, 2026

Uh oh!

mergify Bot commented Feb 16, 2026

❌ Mergify doesn't have permission to update

Uh oh!

mergify Bot commented Feb 16, 2026

Uh oh!

mergify Bot commented Feb 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merge Queue Status

Uh oh!

mergify Bot commented Feb 16, 2026

Uh oh!

Uh oh!

github-actions Bot commented Feb 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions Bot commented Feb 5, 2026 •

edited

Loading

github-actions Bot commented Feb 5, 2026 •

edited

Loading

Abogical Feb 6, 2026 •

edited

Loading

Abogical Feb 16, 2026 •

edited

Loading

Abogical left a comment •

edited

Loading

mergify Bot commented Feb 16, 2026 •

edited

Loading