feat(dynamodb): add TableGrants and StreamGrants

[otaviomacedo]

What is changing?

This PR introduces two new classes, TableGrants and StreamGrants, that allow the assignment of permissions, in a uniform way, to both L1s and L2s:

const table = new Table(...); // or new CfnTable(...)
const role = new Role(...);

// Allow the role to read data from the table
const grant = TableGrants._fromTable(table).readData(role);

To make the interface more similar to the auto-generated grants (e.g., TopicGrants), TableGrants._fromTable() takes a new interface, IIndexableRegionalTable as a parameter.

export interface IIndexableRegionalTable extends ITableRef {  
  /**  
   * Additional regions other than the main one that this table is replicated to    *   
   * @default no regions  
   */  
   readonly regions?: string[];  
  
  /**  
   * Whether this table has indexes   
   *   
   * If so, permissions are granted on all table indexes as well.   
   *   
   * @default false  
   */  
   readonly hasIndex?: boolean;  
}

And now TableBase implements IIndexableRegionalTable. TableBase has also gained two additional public immutable properties: grants and streamGrants, that should be used to grant permissions on a table. The existing grant*() methods will be deprecated soon.

Why did the integration test templates change?

The current implementation uses Lazy.string() to produce the regional ARNs. Since the produce() method has to return something, it returned Aws.NO_VALUE when there was no real value to produce. In TableGrants, by contrast, the ARNs are computed eagerly in the constructor, so there is no need for pseudo-values. This is what caused the integration test templates to change. There are additional changes that are purely in the order of JSON properties.

Why does StreamGrants not have a _fromStream() static method?

Unlike table, a table stream is not a resource in CloudFormation. So, although we could try to mimic one, by creating interfaces like ITableStream, ITableStreamRef, TableStreamReference, there is nothing to gain from it. The consumer would still have to assemble an object from properties of a Table of CfnTable anyway.

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[rix0rrr]

Approved but we said we would do consturctor parameters over the interface implementation

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.