fix(dynamodb): unsupported actions added to table resource policy

[Abogical]

Issue # (if applicable)

Closes #32230.

Reason for this change

Table and TableV2 were adding actions GetShardItem and GetRecord to the table's resource policy for cross-account resources, service and account principals. The issue is that these actions are not supported in the resource policies. Hence creating a deployment failure

Description of changes

Separated these actions to only be added to the IAM principal, but not the resource for Table and TableV2 constructs.

Describe any new or updated permissions being added

No new permissions are added. The GetShardItem and GetRecord permissions are removed for resource policies.

Description of how you validated changes

Unit and Integration tests have been modified. The integration test failed to deploy before the fix, but now it succeeds after this fix.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[kumvprat]

Can you attach a documentation link which talks about this ?

Mainly a documentation link that talks about the specific actions here being segregated into resource and principal only are limited to their respective counterparts.

[Abogical]

I couldn't really find an official documentation that specifies which action is supported by resources and which is only supported by the principal. I only know by deploying these 2 actions that they fail to be attached to the resource.

[kumvprat]

You can see : #36228 (comment)

[kumvprat]

This should be okay since READ_STREAM_DATA_ACTIONS also contains dynamodb:DescribeStream which is missing from these set of read permissions

This change should be backward compatible with existing setups and avoid giving full stream read accesses to users due to missing permissions

Dynamo DB Actions

[mergify]

Merge Queue Status

✅ The pull request has been merged

This pull request spent 38 minutes 53 seconds in the queue, including 38 minutes 45 seconds waiting for CI.
The checks were run in-place.

Required conditions to merge

• #approved-reviews-by >= 1 [🛡 GitHub branch protection]
  • fix(dynamodb): unsupported actions added to table resource policy #36228
• #changes-requested-reviews-by = 0 [🛡 GitHub branch protection]
  • fix(dynamodb): unsupported actions added to table resource policy #36228
• any of [🛡 GitHub branch protection]:
  • check-success = validate-pr
  • check-neutral = validate-pr
  • check-skipped = validate-pr
• any of [🛡 GitHub branch protection]:
  • check-success = build
  • check-neutral = build
  • check-skipped = build

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.