fix(dynamodb): use concrete ARN account/region when resourceName is tokenized

[sanyamk23]

Issue # (if applicable)

Closes #38354

Description

The previous broad Token.isUnresolved(tableArn) guard in validateMultiAccountReplica skipped the splitArn extraction whenever any part of the source table ARN was tokenized — even if only the resourceName was a token with concrete account and region parts.

This caused sourceAccount and sourceRegion to fall back to the stack that owns the imported resource (often the same as the replica stack), which falsely triggered the MultiAccountReplicaMustBeDifferentAccount and MultiAccountReplicaMustBeDifferentRegion errors for imported tables whose ARN had a tokenized table name.

Changes

• packages/aws-cdk-lib/aws-dynamodb/lib/table-v2.ts: Always call splitArn; use the extracted account/region whenever they are concrete (not tokens), falling back to the stack's values only when the ARN's corresponding part is itself a token.
• packages/aws-cdk-lib/aws-dynamodb/test/table-v2.test.ts: New test asserting no false-positive error when the source table ARN has a concrete account/region but a tokenized resourceName (string-concatenated from Lazy.string).

Backwards compatibility

Additive — the previous behavior only changed the extracted values when the entire ARN was fully concrete, which made validation tighter than intended (false errors). The new behavior extracts concrete components whenever possible and per-field checks still skip validation when a part is a token — preserving the documented "skip if token" behavior at the per-field level.

🤖🤖🤖 Generated with AI - this code was authored with the help of an AI agent.

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license.

[aws-cdk-automation]

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[sanyamk23]

CI all green here. The build workflow is showing as action_required (GitHub fork protection needs a manual click on the Actions tab). Ready for review when someone has a moment.

[aws-cdk-automation]

The pull request linter fails with the following errors:

❌ Fixes must contain a change to an integration test file and the resulting snapshot.

If you believe this pull request should receive an exemption, please comment and provide a justification. A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed, add Clarification Request to a comment.

✅ A exemption request has been requested. Please wait for a maintainer's review.

[sanyamk23]

Exemption Request: This fix addresses a bug where TableV2MultiAccountReplica incorrectly throws when the source table ARN is partially tokenized (concrete account/region but tokenized table name). The exact scenario is fully covered by unit tests in table-v2.test.ts ('TableV2MultiAccountReplica does not throw with partially tokenized source ARN'). Generating an integration test snapshot would require a full aws-cdk-lib build (~30 min) plus deployment against real AWS infrastructure. The fix is minimal and surgical — it only refactors how splitArn results are validated per-field instead of guarding on the entire ARN string. Given comprehensive unit test coverage and the complexity of producing meaningful integration snapshots for cross-account replication scenarios, we request an exemption from the integration test requirement.

[sanyamk23]

Exemption Request - This fix corrects a false-positive validation error when a DynamoDB table ARN has a tokenized resourceName but concrete account/region. The change improves the existing validation logic without changing the public API. Unit tests thoroughly cover the validation behavior with various ARN patterns including tokenized parts. An integration test is not necessary as this is a validation logic fix, not a new feature.