fix(dynamodb): Support iampolicy minimize credential

[watany-dev]

fixes #20545

As noted in the link below, the following IAM Policy permissions appear sufficient for this support.

• dynamodb:DescribeTable
• dynamodb: UpdateTable

#20545 (comment)

---

All Submissions:

• Have you followed the guidelines in our Contributing guide?

Adding new Unconventional Dependencies:

• This PR adds new unconventional dependencies following the process described here

New Features

• Have you added the new feature to an integration test?
  • Did you use yarn integ to deploy the infrastructure and generate the snapshot (i.e. yarn integ without --dry-run)?

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[gitpod-io]

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: a981920
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[TheRealAmazonKendra]

I'm concerned that this has the potential to break user's functionality. How do we know that these are the only two permissions needed?

[watany-dev]

I'll explain some of the overlap with what I wrote in this link
#20545 (comment)

The IAMRole (onEvent) to which privileges are added in this process is granted to this Lambda.

https://github.com/aws/aws-cdk/blob/75bfce70dbc57fe688c96b3c5cbb67fc4e6fcc56/packages/%40aws-cdk/aws-dynamodb/lib/replica-handler/index.ts

When checking the AWS SDK for this code, I confirmed that only two DynamoDB actions are available.

[TheRealAmazonKendra]

I'll explain some of the overlap with what I wrote in this link #20545 (comment)

The IAMRole (onEvent) to which privileges are added in this process is granted to this Lambda.

https://github.com/aws/aws-cdk/blob/75bfce70dbc57fe688c96b3c5cbb67fc4e6fcc56/packages/%40aws-cdk/aws-dynamodb/lib/replica-handler/index.ts

When checking the AWS SDK for this code, I confirmed that only two DynamoDB actions are available.

The problem is that often under the hood, the visible APIs call other APIs that this change may now remove permissions for. This is especially true for CloudFormation calls. They are often doing more under the hood than is visible. This comment block gives me even more pause.

[aws-cdk-automation]

This PR has been in the CHANGES REQUESTED state for 3 weeks, and looks abandoned. To keep this PR from being closed, please continue work on it. If not, it will automatically be closed in a week.

[aws-cdk-automation]

This PR has been deemed to be abandoned, and will be automatically closed. Please create a new PR for these changes if you think this decision has been made in error.

[aws-cdk-automation]

The Pull Request Linter fails with the following errors:

❌ Fixes must contain a change to an integration test file and the resulting snapshot.

PRs must pass status checks before we can provide a meaningful review.