fix(dynamodb): use concrete ARN account/region when resourceName is tokenized - #38485
Open
sanyamk23 wants to merge 2 commits into
Open
fix(dynamodb): use concrete ARN account/region when resourceName is tokenized#38485sanyamk23 wants to merge 2 commits into
sanyamk23 wants to merge 2 commits into
Conversation
github-actions
Bot
added
bug
github-actions
Bot
added
the
beginning-contributor
Contributor
|
👋 It looks like your PR description references an issue, but not in the expected location. The issue number must appear in the first section of the description (the first two lines), following the template format: Please move your issue reference to the top of the description. |
aws-cdk-automation
previously requested changes
Aug 3, 2026
…okenized The previous broad `Token.isUnresolved(tableArn)` guard in `validateMultiAccountReplica` skipped splitArn extraction whenever any part of the source table ARN was tokenized, even if just the resourceName was a token with concrete account and region components. This caused `sourceAccount` and `sourceRegion` to fall back to the stack that owns the imported resource (often the same as the replica stack), which falsely triggered the `MultiAccountReplicaMustBeDifferentAccount` and `MultiAccountReplicaMustBeDifferentRegion` errors for imported tables whose ARN had a tokenized table name. Now `splitArn` is always called and the extracted account/region are used whenever they are concrete, falling back to the stack's values only when the ARN's corresponding part is itself a token. Closes aws#38354 🤖🤖🤖 Generated with AI - this code was authored with the help of an AI agent
sanyamk23
force-pushed
the
fix/dynamodb-table-v2-partial-arn-validation
branch
from
August 3, 2026 17:43
3ada80b to
eba4d7f
Compare
…tReplica Add integration test case that exercises the fix for extracting concrete account/region from ARNs when resourceName is tokenized. Includes updated snapshot with the new ReplicaPartial GlobalTable resource.
aws-cdk-automation
dismissed
their stale review
August 3, 2026 20:30
✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The previous broad
Token.isUnresolved(tableArn)guard invalidateMultiAccountReplicaskipped thesplitArnextraction whenever any part of the source table ARN was tokenized — even if only the resourceName was a token with concrete account and region parts.This caused
sourceAccountandsourceRegionto fall back to the stack that owns the imported resource (often the same as the replica stack), which falsely triggered theMultiAccountReplicaMustBeDifferentAccountandMultiAccountReplicaMustBeDifferentRegionerrors for imported tables whose ARN had a tokenized table name.Changes
packages/aws-cdk-lib/aws-dynamodb/lib/table-v2.ts: Always callsplitArn; use the extracted account/region whenever they are concrete (not tokens), falling back to the stack's values only when the ARN's corresponding part is itself a token.packages/aws-cdk-lib/aws-dynamodb/test/table-v2.test.ts: New test asserting no false-positive error when the source table ARN has a concrete account/region but a tokenized resourceName (string-concatenated fromLazy.string).Backwards compatibility
Additive — the previous behavior only changed the extracted values when the entire ARN was fully concrete, which made validation tighter than intended (false errors). The new behavior extracts concrete components whenever possible and per-field checks still skip validation when a part is a token — preserving the documented "skip if token" behavior at the per-field level.
Closes #38354
🤖🤖🤖 Generated with AI - this code was authored with the help of an AI agent.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license.