fix(dynamodb): use concrete ARN account/region when resourceName is tokenized

The previous broad `Token.isUnresolved(tableArn)` guard in
`validateMultiAccountReplica` skipped splitArn extraction whenever any
part of the source table ARN was tokenized, even if just the resourceName
was a token with concrete account and region components. This caused
`sourceAccount` and `sourceRegion` to fall back to the stack that owns
the imported resource (often the same as the replica stack), which
falsely triggered the `MultiAccountReplicaMustBeDifferentAccount` and
`MultiAccountReplicaMustBeDifferentRegion` errors for imported tables
whose ARN had a tokenized table name.

Now `splitArn` is always called and the extracted account/region are
used whenever they are concrete, falling back to the stack's values only
when the ARN's corresponding part is itself a token.

Closes #38354

🤖🤖🤖 Generated with AI - this code was authored with the help of an AI agent

Author: sanyamk23

packages/aws-cdk-lib/aws-dynamodb/lib/table-v2.ts

@@ -1603,11 +1603,21 @@ export class TableV2MultiAccountReplica extends TableBaseV2 {
     let sourceAccount = sourceStack.account;
     let sourceRegion = sourceStack.region;
 
-    // For imported tables, extract account/region from ARN instead of stack
-    if (!Token.isUnresolved(props.replicaSourceTable!.tableArn)) {
-      const arnParts = this.stack.splitArn(props.replicaSourceTable!.tableArn, ArnFormat.SLASH_RESOURCE_NAME);
-      if (arnParts.account) sourceAccount = arnParts.account;
-      if (arnParts.region) sourceRegion = arnParts.region;
+    // For imported tables, extract account/region from ARN even when the ARN is
+    // only partially tokenized (e.g., the resourceName is a token but the
+    // account and region are concrete). `splitArn` returns concrete values for
+    // parts that are not tokens and undefined for parts that are tokenized, so
+    // the per-field `Token.isUnresolved` checks below handle the latter case.
+    // The previous broad `Token.isUnresolved(tableArn)` guard caused the
+    // validation to fall back to the stack that owns the imported resource,
+    // leading to false-positive "must be in a different account/region" errors
+    // when the source and replica stacks happened to share an environment.
+    const arnParts = this.stack.splitArn(props.replicaSourceTable!.tableArn, ArnFormat.SLASH_RESOURCE_NAME);
+    if (arnParts.account && !Token.isUnresolved(arnParts.account)) {
+      sourceAccount = arnParts.account;
+    }
+    if (arnParts.region && !Token.isUnresolved(arnParts.region)) {
+      sourceRegion = arnParts.region;
     }
 
     // Validate different account (skip if token)

packages/aws-cdk-lib/aws-dynamodb/test/table-v2.test.ts

@@ -4116,6 +4116,32 @@ test('TableV2MultiAccountReplica on imported table does not throw', () => {
   expect(warnings[0].entry.data).toContain('manually configure multi-account replication permissions');
 });
 
+test('TableV2MultiAccountReplica does not throw with partially tokenized source ARN', () => {
+  const app = new App();
+  const replicaStack = new Stack(app, 'ReplicaStack', { env: { account: '222222222222', region: 'us-east-1' } });
+
+  // Source ARN has concrete account (`111111111111`) and region (`us-east-2`),
+  // but a tokenized table name. `Token.isUnresolved(tableArn)` returns true for
+  // the whole ARN (because the resourceName is a token), but `splitArn`
+  // correctly extracts the concrete account/region components. The
+  // validation must use those extracted components, not fall back to the
+  // replica stack's own account/region — that fallback would falsely trigger
+  // "must be in a different account" because the fallback equals
+  // `this.stack.account`.
+  const dynamicTableName = Lazy.string({ produce: () => 'dynamic-source-table' });
+  const importedTable = TableV2.fromTableArn(
+    replicaStack,
+    'ImportedTable',
+    `arn:aws:dynamodb:us-east-2:111111111111:table/${dynamicTableName}`,
+  );
+
+  expect(() => {
+    new TableV2MultiAccountReplica(replicaStack, 'ReplicaTable', {
+      replicaSourceTable: importedTable,
+    });
+  }).not.toThrow();
+});
+
 test('TableV2MultiAccountReplica works with fromTableArn without key schema', () => {
   const app = new App();
   const replicaStack = new Stack(app, 'ReplicaStack', { env: { account: '222222222222', region: 'us-east-1' } });