DynamoDBStreamReadPolicy is cumbersome to work with

[iamatypeofwalrus]

Hi!

I'm spinning up a toy Go lambda that reads stream events from a DynamoDB table. Both are specified in the same CloudFormation template.

The DynamoDBStreaReadPolicy requires the table name and a stream name. It looks like it's constructing the StreamArn under the hood.

The DynamoDB table resource already includes a return value for the StreamArn but it doesn't look like it gives access to the stream's name. Given that it's some sort of timestamp it looks like it will be difficult to infer the stream name without creating the stream first.

Can the DynamoDBStreaReadPolicy be updated to accept the StreamArn directly?

[brettstack]

Agreed. It's likely more simple to pass in the StreamArn directly. Could you try using the Split and Select functions https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-split.html to get the stream name?

StreamName: !Select [2, !Split ["/", !GetAtt Table.StreamArn]]

In order to make this change we would need to mark this policy template as deprecated and create a new one which accepts a StreamArn so as not to break backwards compatibility. Let me now if this works. And if it does, I'd love to see a PR to the examples directory.

[0xdevalias]

Not sure if this has changed since this issue was opened, but my stream reader looks like this and seems to work:

Table:
    Type: 'AWS::DynamoDB::Table'
    Properties:
      StreamSpecification:
        StreamViewType: NEW_AND_OLD_IMAGES
      ProvisionedThroughput:
        WriteCapacityUnits: 1
        ReadCapacityUnits: 1
      AttributeDefinitions:
        - AttributeName: id
          AttributeType: S
      KeySchema:
        - KeyType: HASH
          AttributeName: id

TableChanged:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${AWS::StackName}-TableChanged
      Description: Table stream watcher and event handler
      CodeUri: ./target
      Handler: tableChanged
      Runtime: go1.x
      Events:
        TableEventSource:
          Type: DynamoDB
          Properties:
            Stream: !GetAtt Table.StreamArn
            StartingPosition: TRIM_HORIZON
            BatchSize: 10
      Policies:
        - Statement:
          - Effect: Allow
            Action:
              - ses:SendEmail
            Resource: !Sub
              - "arn:${AWS::Partition}:ses:${region}:${AWS::AccountId}:identity/${identityName}"
              - { region: "us-east-1", identityName: "*" }

[honglu]

It works because SAM adds the AWSLambdaDynamoDBExecutionRole managed policy if a DynamoDB event source is configured on the AWS::Serverless::Function resource.

The DynamoDBStreamReadPolicy policy template is actually not valid due the following issues:

• The DynamoDB stream arn format is arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}/stream/${streamName} not arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}/${streamName}
• ListStreams action does not support specific stream. See doc

Can we please fix this policy template? It is incorrect and misleading.

[ShreyaGangishetty]

@honglu's comment is correct. To fix this bug the change needs to be made here.

[53ningen]

I opened the PR 1222 to fix the DynamoDB ARN format and the target resource for ListStreams action.