dynamodb: Table.grantStreamRead doesn't grant ListStreams

[chillitom]

grantStreamRead documentation says that it will grant ListStreams but in practice it only grants dynamodb:GetShardIterator, dynamodb:DescribeStream,dynamodb:GetRecords.

Not sure whether it's the documentation or implementation at fault but they seem inconsistent.

Reproduction Steps

        const authenticatedRole = new iam.Role(this, 'CognitoDefaultAuthenticatedRole', {
            assumedBy: new iam.FederatedPrincipal('cognito-identity.amazonaws.com', {
                'StringEquals': { 'cognito-identity.amazonaws.com:aud': identityPool.ref },
                'ForAnyValue:StringLike': { 'cognito-identity.amazonaws.com:amr': 'authenticated' },
            }, 'sts:AssumeRoleWithWebIdentity'),
        })

        const table = new dynamodb.Table(this, 'table', {
            partitionKey: {
                name: 'id',
                type: dynamodb.AttributeType.STRING,
            },
            tableName: 'table',
            stream: dynamodb.StreamViewType.NEW_IMAGE,
        })
        table .grantReadData(authenticatedRole)
        table .grantStreamRead(authenticatedRole)

Environment

• CDK 1.15.0
• Typescript