fix(dynamodb): some grant methods generate incorrect policies.

[tam0ri]

Issue

Problem 1

Generated policy by grantStreamRead and grantTableListStreams includes dynamodb:ListStreams as action, but stream ARN is specified as resource currently. ListStreams API does not support resource-level permissions, so generated policy will not grant access. Similar issue was fixed in Table v1 by #10631.

Problem 2

Generated policy by grantReadData and grantReadWriteData includes dynamodb:GetRecords and dynamodb:GetShardIterator as action, but table ARN is specified as resource currently. Those actions support only stream for resource-level permissions, so generated policy will not grant access to do those 2 actions. Those permissions should be granted by grantStreamRead.

Description of changes

• Correct resource from specific stream ARN to wildcard ('*') in grantTableListStreams
• Remove dynamodb:GetRecords and dynamodb:GetShardIterator from grantReadData and grantReadWriteData

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: 9482c63
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[tam0ri]

Exemption Request:
Security Guardian reported 3 issues by intrinsic scan. All of them are KMS key policies. However, it does not mean grant permissions to whole IAM principals under the account.
https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-overview.html

When the principal in a key policy statement is an AWS account principal expressed as arn:aws:iam::111122223333:root", the policy statement doesn't give permission to any IAM principal. Instead, it gives the AWS account permission to use IAM policies to delegate the permissions specified in the key policy. (A principal in arn:aws:iam::111122223333:root" format does not represent the AWS account root user, despite the use of "root" in the account identifier.