fix(dynamodb): throw error when grantee is an unsupported ServicePrincipal by kumsmrit · Pull Request #37335 · aws/aws-cdk

kumsmrit · 2026-03-23T21:11:46Z

Issue # (if applicable)

Reason for this change

After v2.222.0, calling table.grantReadWriteData(new ServicePrincipal(...)) started generating DynamoDB resource-based policies containing service principals. This is a regression caused by the combination of #35554 (which fixed addToResourcePolicy to actually take effect) and #35817 (which enabled the grant framework to automatically discover DynamoDB resource policies). Previously, addToResourcePolicy was a no-op, so the grant silently did nothing.

For unsupported service principals (e.g. myservice.amazonaws.com), this produces an invalid resource policy that fails at CloudFormation deploy time with: "Invalid policy document: Policy contains invalid service principal".

However, DynamoDB does support specific service principals in resource policies:

redshift.amazonaws.com — Redshift zero-ETL integration
replication.dynamodb.amazonaws.com — Multi-account global tables
glue.amazonaws.com — SageMaker Lakehouse zero-ETL via AWS Glue

Description of changes

Throw ValidationError for unsupported service principals — Grant methods (grant, grantReadData, grantWriteData, grantReadWriteData, grantFullAccess) on both Table and TableV2 now detect ServicePrincipal grantees and throw a ValidationError at synth time, directing users to table.addToResourcePolicy() instead. This fails fast rather than producing an invalid template that fails at deploy time.
Allowlist known-valid service principals — Added KNOWN_DYNAMODB_SERVICE_PRINCIPALS allowlist in private/principal-utils.ts containing the three documented service principals. The new isUnsupportedServicePrincipal() function walks the principal wrapper chain (handling PrincipalWithConditions, SessionTagsPrincipal, etc.) to extract the service name and check it against the allowlist. Allowlisted principals pass through grant* methods normally.
Integration test — Added integ.dynamodb.grant-service-principal verifying the three allowlisted principals produce correct resource policies in the synthesized CloudFormation template.

Describe any new or updated permissions being added

No new or updated IAM permissions. This change prevents invalid IAM resource policy statements from being generated for unsupported service principals, while allowing valid ones through.

Description of how you validated changes

Unit tests: dynamodb.test.ts (186 passing), table-v2.test.ts (135 passing)
- Unsupported principals (bedrock.amazonaws.com, lambda.amazonaws.com) throw ValidationError
- Allowlisted principals (redshift, replication.dynamodb, glue) succeed
- Wrapped principals (via .withConditions()) handled correctly for both cases
Integration test: integ.dynamodb.grant-service-principal deployed successfully with snapshot containing resource policy statements for all three allowlisted principals

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

…ipal

aws-cdk-automation

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

github-actions · 2026-03-23T22:17:02Z

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
This security report is NOT a review blocker. Please try merge from main to avoid findings unrelated to the PR.

	Tests	Passed ☑️	Skipped	Failed ❌️
Security Guardian Results	48 ran	47 passed		1 failed

Test	Result
Security Guardian Results
packages/@aws-cdk-testing/framework-integ/test/aws-dynamodb/test/integ.dynamodb.grant-service-principal.js.snapshot/grant-service-principal-test-stack.template.json
resource-policy-root-principal-needs-conditions.guard	❌ failure

View Security Guardian Results

github-actions · 2026-03-23T22:17:04Z

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
This security report is NOT a review blocker. Please try merge from main to avoid findings unrelated to the PR.

	Tests	Passed ☑️	Skipped	Failed ❌️
Security Guardian Results with resolved templates	48 ran	47 passed		1 failed

Test	Result
Security Guardian Results with resolved templates
packages/@aws-cdk-testing/framework-integ/test/aws-dynamodb/test/integ.dynamodb.grant-service-principal.js.snapshot/grant-service-principal-test-stack.template.json
resource-policy-root-principal-needs-conditions.guard	❌ failure

View Security Guardian Results with resolved templates

mrgrain · 2026-03-24T15:04:40Z

packages/aws-cdk-lib/aws-dynamodb/lib/table-v2-base.ts

+    Annotations.of(this).addWarningV2(
+      '@aws-cdk/aws-dynamodb:servicePrincipalGrantDropped',
+      'DynamoDB grant* methods do not support ServicePrincipal grantees. ' +
+      'Use table.addToResourcePolicy() for an explicit service-specific table policy ' +
+      'with required service principal, actions, and conditions',
+    );
+    return Grant.drop(grantee, 'DynamoDB grant* does not support ServicePrincipal grantees');


Kinda sounds like that SPs are never allowed here, but elsewhere you have stated at a small limited list of SPs is actually allowed. I don't think we should drop all SPs, but have a allow list.

Yes, there are few SPs documented for DynamoDB resource policies, but they are integration-specific and require their own actions/conditions (e.g. replication.dynamodb.amazonaws.com). The generic grant* methods add standard data actions (dynamodb:GetItem, dynamodb:PutItem, etc.), which are not the right action set for those service-principal resource policies.
So even if we had an allowlist of permitted SPs, the actions being granted by grant* methods could produce incorrect resource policy which might not fail deployment, but it could still be functionally incorrect.

Because of that, I think the right path for SPs is the explicit addToResourcePolicy API, where the caller can provide the correct integration-specific principal, actions, and conditions.

aws-cdk-automation

(This review is outdated)

Verify that DynamoDB tables can grant access to the three allowlisted service principals (redshift, replication.dynamodb, glue) and that the resulting CloudFormation template contains the expected resource policy. 🤖 Assisted by the code-assist SOP

Abogical · 2026-03-27T16:37:12Z

Snapshot deployment passed: https://github.com/aws/aws-cdk/actions/runs/23655284133/job/68910779532?pr=37335

Removing label.

mergify · 2026-03-28T07:35:52Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

mergify · 2026-03-28T07:36:01Z

mergify · 2026-03-28T08:28:06Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

github-actions · 2026-03-28T08:28:20Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

fix(dynamodb): drop grant with warning when grantee is a ServicePrinc…

34f8f12

…ipal

kumsmrit temporarily deployed to automation March 23, 2026 21:11 — with GitHub Actions Inactive

github-actions bot added bug This issue is a bug. effort/medium Medium work item – several days of effort p1 labels Mar 23, 2026

kumsmrit temporarily deployed to automation March 23, 2026 21:12 — with GitHub Actions Inactive

aws-cdk-automation requested a review from a team March 23, 2026 21:12

mergify bot added the contribution/core This is a PR that came from AWS. label Mar 23, 2026

mergify bot temporarily deployed to automation March 23, 2026 21:12 Inactive

aws-cdk-automation previously requested changes Mar 23, 2026

View reviewed changes

added integration test

09e51b5

kumsmrit temporarily deployed to automation March 23, 2026 22:14 — with GitHub Actions Inactive

fix check

7de1197

kumsmrit temporarily deployed to automation March 24, 2026 00:25 — with GitHub Actions Inactive

kumsmrit marked this pull request as ready for review March 24, 2026 09:02

kumsmrit temporarily deployed to automation March 24, 2026 09:02 — with GitHub Actions Inactive

mrgrain reviewed Mar 24, 2026

View reviewed changes

aws-cdk-automation added the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Mar 24, 2026

aws-cdk-automation temporarily deployed to automation March 24, 2026 15:07 — with GitHub Actions Inactive

Abogical temporarily deployed to automation March 27, 2026 14:43 — with GitHub Actions Inactive

aws-cdk-automation previously requested changes Mar 27, 2026

View reviewed changes

Abogical temporarily deployed to automation March 27, 2026 15:38 — with GitHub Actions Inactive

Abogical changed the title ~~fix(dynamodb): throw error when grantee is a ServicePrincipal~~ fix(dynamodb): throw error when grantee is an unsupported ServicePrincipal Mar 27, 2026

Abogical temporarily deployed to automation March 27, 2026 15:42 — with GitHub Actions Inactive

Abogical temporarily deployed to automation March 27, 2026 15:57 — with GitHub Actions Inactive

Abogical added the pr/needs-integration-tests-deployment Requires the PR to deploy the integration test snapshots. label Mar 27, 2026

Abogical temporarily deployed to automation March 27, 2026 15:57 — with GitHub Actions Inactive

Abogical temporarily deployed to deployment-integ-test March 27, 2026 15:57 — with GitHub Actions Inactive

Abogical removed the pr-linter/exempt-integ-test The PR linter will not require integ test changes label Mar 27, 2026

Abogical temporarily deployed to automation March 27, 2026 15:57 — with GitHub Actions Inactive

Abogical temporarily deployed to automation March 27, 2026 15:58 — with GitHub Actions Inactive

Abogical removed pr/needs-integration-tests-deployment Requires the PR to deploy the integration test snapshots. labels Mar 27, 2026

Abogical temporarily deployed to automation March 27, 2026 16:37 — with GitHub Actions Inactive

rix0rrr approved these changes Mar 28, 2026

View reviewed changes

Merge branch 'main' into fix-dynamo-grants

6fd29d4

mergify bot temporarily deployed to automation March 28, 2026 07:36 Inactive

mergify bot merged commit d12754f into main Mar 28, 2026
19 of 24 checks passed

mergify bot deleted the fix-dynamo-grants branch March 28, 2026 08:28

github-actions bot locked as resolved and limited conversation to collaborators Mar 28, 2026

aws-cdk-automation removed the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Mar 28, 2026

aws-cdk-automation temporarily deployed to automation March 28, 2026 08:29 — with GitHub Actions Inactive

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(dynamodb): throw error when grantee is an unsupported ServicePrincipal#37335

fix(dynamodb): throw error when grantee is an unsupported ServicePrincipal#37335
mergify[bot] merged 7 commits intomainfrom
fix-dynamo-grants

kumsmrit commented Mar 23, 2026 •

edited by Abogical

Loading

Uh oh!

aws-cdk-automation left a comment •

edited

Loading

Uh oh!

github-actions bot commented Mar 23, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Mar 23, 2026 •

edited

Loading

Uh oh!

mrgrain Mar 24, 2026

Uh oh!

kumsmrit Mar 24, 2026

Uh oh!

aws-cdk-automation left a comment •

edited

Loading

Uh oh!

Abogical commented Mar 27, 2026

Uh oh!

mergify bot commented Mar 28, 2026

Uh oh!

mergify bot commented Mar 28, 2026 •

edited

Loading

Uh oh!

mergify bot commented Mar 28, 2026

Uh oh!

Uh oh!

github-actions bot commented Mar 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

kumsmrit commented Mar 23, 2026 • edited by Abogical Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue # (if applicable)

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

Uh oh!

aws-cdk-automation left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mrgrain Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

kumsmrit Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

aws-cdk-automation left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Abogical commented Mar 27, 2026

Uh oh!

mergify bot commented Mar 28, 2026

Uh oh!

mergify bot commented Mar 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merge Queue Status

Uh oh!

mergify bot commented Mar 28, 2026

Uh oh!

Uh oh!

github-actions bot commented Mar 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

kumsmrit commented Mar 23, 2026 •

edited by Abogical

Loading

aws-cdk-automation left a comment •

edited

Loading

github-actions bot commented Mar 23, 2026 •

edited

Loading

github-actions bot commented Mar 23, 2026 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

mergify bot commented Mar 28, 2026 •

edited

Loading