fix(policy-templates): update arn format of DynamoDBStreamReadPolicy (#1222)

53ningen · Shreya · commit 0976434e8c8d · 2019-12-06T13:37:37.000-08:00
diff --git a/samtranslator/policy_templates_data/policy_templates.json b/samtranslator/policy_templates_data/policy_templates.json
@@ -609,12 +609,11 @@
             "Action": [
               "dynamodb:DescribeStream",
               "dynamodb:GetRecords",
-              "dynamodb:GetShardIterator",
-              "dynamodb:ListStreams"
+              "dynamodb:GetShardIterator"
             ],
             "Resource": {
               "Fn::Sub": [
-                "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}/${streamName}",
+                "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}/stream/${streamName}",
                 {
                   "tableName": {
                     "Ref": "TableName"
@@ -625,6 +624,22 @@
                 }
               ]
             }
+          },
+          {
+            "Effect": "Allow",
+            "Action": [
+              "dynamodb:ListStreams"
+            ],
+            "Resource": {
+              "Fn::Sub": [
+                "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}/stream/*",
+                {
+                  "tableName": {
+                    "Ref": "TableName"
+                  }
+                }
+              ]
+            }
           }
         ]
       }
diff --git a/tests/translator/output/all_policy_templates.json b/tests/translator/output/all_policy_templates.json
@@ -474,19 +474,32 @@
                   "Action": [
                     "dynamodb:DescribeStream",
                     "dynamodb:GetRecords",
-                    "dynamodb:GetShardIterator",
-                    "dynamodb:ListStreams"
+                    "dynamodb:GetShardIterator"
                   ],
                   "Resource": {
                     "Fn::Sub": [
-                      "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}/${streamName}",
+                      "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}/stream/${streamName}",
                       {
                         "streamName": "name",
                         "tableName": "name"
                       }
                     ]
                   },
                   "Effect": "Allow"
+                },
+                {
+                  "Action": [
+                    "dynamodb:ListStreams"
+                  ],
+                  "Resource": {
+                    "Fn::Sub": [
+                      "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}/stream/*",
+                      {
+                        "tableName": "name"
+                      }
+                    ]
+                  },
+                  "Effect": "Allow"
                 }
               ]
             }
diff --git a/tests/translator/output/aws-cn/all_policy_templates.json b/tests/translator/output/aws-cn/all_policy_templates.json
@@ -473,19 +473,32 @@
                   "Action": [
                     "dynamodb:DescribeStream",
                     "dynamodb:GetRecords",
-                    "dynamodb:GetShardIterator",
-                    "dynamodb:ListStreams"
+                    "dynamodb:GetShardIterator"
                   ],
                   "Resource": {
                     "Fn::Sub": [
-                      "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}/${streamName}",
+                      "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}/stream/${streamName}",
                       {
                         "streamName": "name",
                         "tableName": "name"
                       }
                     ]
                   },
                   "Effect": "Allow"
+                },
+                {
+                  "Action": [
+                    "dynamodb:ListStreams"
+                  ],
+                  "Resource": {
+                    "Fn::Sub": [
+                      "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}/stream/*",
+                      {
+                        "tableName": "name"
+                      }
+                    ]
+                  },
+                  "Effect": "Allow"
                 }
               ]
             }
diff --git a/tests/translator/output/aws-us-gov/all_policy_templates.json b/tests/translator/output/aws-us-gov/all_policy_templates.json
@@ -473,19 +473,32 @@
                   "Action": [
                     "dynamodb:DescribeStream",
                     "dynamodb:GetRecords",
-                    "dynamodb:GetShardIterator",
-                    "dynamodb:ListStreams"
+                    "dynamodb:GetShardIterator"
                   ],
                   "Resource": {
                     "Fn::Sub": [
-                      "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}/${streamName}",
+                      "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}/stream/${streamName}",
                       {
                         "streamName": "name",
                         "tableName": "name"
                       }
                     ]
                   },
                   "Effect": "Allow"
+                },
+                {
+                  "Action": [
+                    "dynamodb:ListStreams"
+                  ],
+                  "Resource": {
+                    "Fn::Sub": [
+                      "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}/stream/*",
+                      {
+                        "tableName": "name"
+                      }
+                    ]
+                  },
+                  "Effect": "Allow"
                 }
               ]
             }

Original file line number	Diff line number	Diff line change
`@@ -609,12 +609,11 @@`
`609`	`609`	`"Action": [`
`610`	`610`	`"dynamodb:DescribeStream",`
`611`	`611`	`"dynamodb:GetRecords",`
`612`		`- "dynamodb:GetShardIterator",`
`613`		`- "dynamodb:ListStreams"`
	`612`	`+ "dynamodb:GetShardIterator"`
`614`	`613`	`],`
`615`	`614`	`"Resource": {`
`616`	`615`	`"Fn::Sub": [`
`617`		`- "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}/${streamName}",`
	`616`	`+ "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}/stream/${streamName}",`
`618`	`617`	`{`
`619`	`618`	`"tableName": {`
`620`	`619`	`"Ref": "TableName"`
`@@ -625,6 +624,22 @@`
`625`	`624`	`}`
`626`	`625`	`]`
`627`	`626`	`}`
	`627`	`+ },`
	`628`	`+ {`
	`629`	`+ "Effect": "Allow",`
	`630`	`+ "Action": [`
	`631`	`+ "dynamodb:ListStreams"`
	`632`	`+ ],`
	`633`	`+ "Resource": {`
	`634`	`+ "Fn::Sub": [`
	`635`	`+ "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}/stream/*",`
	`636`	`+ {`
	`637`	`+ "tableName": {`
	`638`	`+ "Ref": "TableName"`
	`639`	`+ }`
	`640`	`+ }`
	`641`	`+ ]`
	`642`	`+ }`
`628`	`643`	`}`
`629`	`644`	`]`
`630`	`645`	`}`