dynamodb: CDK Error WIth Stacks Containing Dynamodb

[dalethompsonplx]

Describe the bug

[23:13:03] ValidationError: Circular dependency between resources:
Could not create a change set, will base the diff on template differences (run again with -v to see the reason)

Getting an error, I believe it with aws-cdk-lib 2.222.0

Any of my stack using dynamodb is having this problem

[23:13:02] Removing existing change set with name cdk-diff-change-set if it exists
[23:13:02] Attempting to create ChangeSet with name cdk-diff-change-set for stack
[23:13:03] ValidationError: Circular dependency between resources: []
Could not create a change set, will base the diff on template differences (run again with -v to see the reason)

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Library Version

2.221.1

Expected Behavior

Deployment and diff works

Current Behavior

Error and failure in deployment

Reproduction Steps

Run a deploy using 2.222.0

Possible Solution

The fix is revert

Additional Information/Context

No response

AWS CDK Library version (aws-cdk-lib)

2.222.0

AWS CDK CLI version

2.1031.1 (build a560d1e)

Node.js Version

NODE_VERSION=22.0.0

OS

"Debian GNU/Linux"

Language

TypeScript

Language Version

No response

Other information

No response

[pahud]

Hi @dalethompsonplx,

Thank you for reporting this issue. This appears to be related to changes in version 2.222.0 where we fixed a bug where addToResourcePolicy() had no effect (see #35062, PR #35554).

What Changed

In version 2.221.1, calling addToResourcePolicy() on DynamoDB tables was silently broken - it did nothing. In 2.222.0, we fixed this so it actually works. However, this means code that previously failed silently may now expose circular dependency issues.

Likely Cause

If you have code like this, it would have been a no-op in 2.221.1 but causes circular dependency in 2.222.0:

const table = new dynamodb.Table(this, 'MyTable', {
 partitionKey: { name: 'id', type: dynamodb.AttributeType.STRING },
});

table.addToResourcePolicy(new iam.PolicyStatement({
 actions: ['dynamodb:GetItem'],
 principals: [new iam.AccountRootPrincipal()],
 resources: [table.tableArn], // ← Circular: table references itself
}));

Why it's circular: The table's resource policy references table.tableArn, which creates a dependency loop.

Solution Options

Option 1: Use wildcard resources (recommended for auto-generated table names):

table.addToResourcePolicy(new iam.PolicyStatement({
 actions: ['dynamodb:GetItem'],
 principals: [new iam.AccountRootPrincipal()],
 resources: ['*'], // ✓ Avoids circular dependency
}));

Option 2: Use explicit table name with scoped resources:

const table = new dynamodb.Table(this, 'MyTable', {
 tableName: 'my-explicit-table-name', // Explicit name required
 partitionKey: { name: 'id', type: dynamodb.AttributeType.STRING },
});

table.addToResourcePolicy(new iam.PolicyStatement({
 actions: ['dynamodb:GetItem'],
 principals: [new iam.AccountRootPrincipal()],
 resources: [
   Fn.sub('arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/my-explicit-table-name')
 ],
}));

Can You Confirm?

Could you check if your code uses addToResourcePolicy() or passes resourcePolicy in table props? If so, please share the relevant snippet so we can provide specific guidance.

Temporary Workaround

If you need immediate relief, downgrade to 2.221.1:

npm install aws-cdk-lib@2.221.1

Let us know if this resolves your issue or if you need further assistance!

[dalethompsonplx]

No we dont use that construct, but we do use the grandReadData(new AccountRootPrincipal())

[dalethompsonplx]

const jobHistoryTable = new DynamoDbTable(this, 'JobHistoryTable', {
tableName: job-history,
partitionKey: { name: 'pk', type: DynamoDbAttributeType.NUMBER },
sortKey: { name: 'sk', type: DynamoDbAttributeType.STRING },
billingMode: DynamoDbBillingMode.PAY_PER_REQUEST,
pointInTimeRecovery: true,
timeToLiveAttribute: 'expireAt'
});

jobHistoryTable.grantReadData(new AccountRootPrincipal());

tags.forEach((tag) => {
  Tags.of(jobHistoryTable).add(tag.key, tag.value);
});
Tags.of(jobHistoryTable).add('Name', 'JobHistoryTable');

}

[pahud]

Hi @dalethompsonplx,

When you call grantReadData(new AccountRootPrincipal()), it internally creates a resource policy that references table.tableArn. This creates a circular dependency:

Table → ResourcePolicy → table.tableArn → Table (circular!)

Solution

Since you're using grantReadData() with AccountRootPrincipal, you can work around this by using a wildcard resource in the policy. We need to update grantReadData to handle this case automatically. I will submit a immediate PR for that.

Workarounds

Before the PR is ready, you have some workarounds:

Option 1: Use wildcard resources (recommended for auto-generated table names):

table.addToResourcePolicy(new iam.PolicyStatement({
  actions: ['dynamodb:GetItem', 'dynamodb:Query', 'dynamodb:Scan'],
  principals: [new iam.AccountRootPrincipal()],
  resources: ['*'], // ✓ Avoids circular dependency
}));

Option 2: Use explicit table name with constructed ARN:

const table = new dynamodb.Table(this, 'MyTable', {
  tableName: 'my-explicit-table-name', // Explicit name required
  // ... other props
});

table.addToResourcePolicy(new iam.PolicyStatement({
  actions: ['dynamodb:GetItem'],
  principals: [new iam.AccountRootPrincipal()],
  resources: [
    `arn:aws:dynamodb:${this.region}:${this.account}:table/my-explicit-table-name`
  ],
}));

For immediate relief: Downgrade to CDK 2.221.1 temporarily.