Skip to content

Conversation

@fossamagna
Copy link
Contributor

Description of changes

This pull request adds new tests and a minor enhancement to the AmplifyDynamoDBTable construct to improve permissions handling for DynamoDB tables and their indexes. The main changes focus on ensuring that permissions granted via tableFromAttr correctly include both the table and its indexes, and that this behavior is tested.

  • Set grantIndexPermissions: true when creating the tableFromAttr property in AmplifyDynamoDBTable, ensuring that permission grants include both the table and its indexes.
CDK / CloudFormation Parameters Changed

Issue #, if available

fix aws-amplify/amplify-backend#3054

Description of how you validated changes

  • Unit Tests
  • Added a new tableFromAttr test suite to verify that grantReadData grants read access to both the table and its indexes, including validation of the generated IAM policy.
  • Added a test for grantReadWriteData to ensure read and write permissions are correctly granted to the table and its indexes, with checks for the expected IAM policy actions and resources.

Checklist

  • PR description included
  • yarn test passes
  • E2E test run linked
  • Tests are changed or added
  • Relevant documentation is changed or added (and PR referenced)
  • New AWS SDK calls or CloudFormation actions have been added to relevant test and service IAM policies
  • Any CDK or CloudFormation parameter changes are called out explicitly

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

@fossamagna fossamagna requested a review from a team as a code owner November 28, 2025 05:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Amplify DynamoDB Table's grantReadWriteData does not grant permissions on indexes

1 participant