grant-ing dynamodb table constructs does not allow access to indices

[mipearson]

Saw in my lambda output:

User: arn:aws:sts::REDACTED:assumed-role/REDACTED is not authorized to perform: dynamodb:Query on resource: arn:aws:dynamodb:us-east-1:REDACTED:table/REDACTED/index/uuid

cdk was set up as so:

    const table = new dynamodb.Table(this, "Alerts", {...});
    table.addLocalSecondaryIndex({indexName: "uuid", ...});
    
    const fn = new lambda.Function(...);
    table.grantReadWriteData(fn.role);

Googling found me https://stackoverflow.com/questions/51537795/accessdenied-on-dynamodb-gsi-index

Applied a kind of hacky workaround to replace the .grantReadWrite:

   fn.addToRolePolicy(
      new PolicyStatement()
        .addAction("dynamodb:*")
        .addResources(
          `${table.tableArn}/index/*`,
          table.tableArn,
        )
    );

This resolved the error.

Looking at the source, it looks like the dynamodb construct needs to call addResource once again for the index if one is defined.

[aveeday]

When I use Table.fromTableArn then there are no access to table indices with grantReadData

[skinny85]

@aveeday see #11445