Class: AWSCDK::DynamoDB::CfnGlobalTable::ResourcePolicyProperty

Inherits:

Jsii::Struct

• Object
• Jsii::Struct
• AWSCDK::DynamoDB::CfnGlobalTable::ResourcePolicyProperty

Defined in:

dynamo_db/cfn_global_table.rb

Overview

Creates or updates a resource-based policy document that contains the permissions for DynamoDB resources, such as a table, its indexes, and stream.

Resource-based policies let you define access permissions by specifying who has access to each resource, and the actions they are allowed to perform on each resource.

In a CloudFormation template, you can provide the policy in JSON or YAML format because CloudFormation converts YAML to JSON before submitting it to DynamoDB . For more information about resource-based policies, see Using resource-based policies for DynamoDB and Resource-based policy examples .

While defining resource-based policies in your CloudFormation templates, the following considerations apply:

• The maximum size supported for a resource-based policy document in JSON format is 20 KB. DynamoDB counts whitespaces when calculating the size of a policy against this limit.
• Resource-based policies don't support drift detection . If you update a policy outside of the CloudFormation stack template, you'll need to update the CloudFormation stack with the changes.
• Resource-based policies don't support out-of-band changes. If you add, update, or delete a policy outside of the CloudFormation template, the change won't be overwritten if there are no changes to the policy within the template.

For example, say that your template contains a resource-based policy, which you later update outside of the template. If you don't make any changes to the policy in the template, the updated policy in DynamoDB won’t be synced with the policy in the template.

Conversely, say that your template doesn’t contain a resource-based policy, but you add a policy outside of the template. This policy won’t be removed from DynamoDB as long as you don’t add it to the template. When you add a policy to the template and update the stack, the existing policy in DynamoDB will be updated to match the one defined in the template.

• Within a resource-based policy, if the action for a DynamoDB service-linked role (SLR) to replicate data for a global table is denied, adding or deleting a replica will fail with an error.
• The AWS ::DynamoDB::GlobalTable resource doesn't support creating a replica in the same stack update in Regions other than the Region where you deploy the stack update.

For a full list of all considerations, see Resource-based policy considerations .

See Also:

• http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-dynamodb-globaltable-resourcepolicy.html

Instance Attribute Summary

• #policy_document ⇒ Object readonly

  A resource-based policy document that contains permissions to add to the specified DynamoDB table, its indexes, and stream.

Class Method Summary

• .jsii_properties ⇒ Object

Instance Method Summary

• #initialize(policy_document:) ⇒ ResourcePolicyProperty constructor

  A new instance of ResourcePolicyProperty.

• #to_jsii ⇒ Object

Constructor Details

#initialize(policy_document:) ⇒ ResourcePolicyProperty

Returns a new instance of ResourcePolicyProperty.

Parameters:

• policy_document (Object) —

  A resource-based policy document that contains permissions to add to the specified DynamoDB table, its indexes, and stream.

# File 'dynamo_db/cfn_global_table.rb', line 1832

def initialize(policy_document:)
  @policy_document = policy_document
  Jsii::Type.check_type(@policy_document, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJhbnkifQ==")), "policyDocument")
end

Instance Attribute Details

#policy_document ⇒ Object (readonly)

A resource-based policy document that contains permissions to add to the specified DynamoDB table, its indexes, and stream.

In a CloudFormation template, you can provide the policy in JSON or YAML format because CloudFormation converts YAML to JSON before submitting it to DynamoDB . For more information about resource-based policies, see Using resource-based policies for DynamoDB and Resource-based policy examples .

Returns:

• (Object)

See Also:

• http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-dynamodb-globaltable-resourcepolicy.html#cfn-dynamodb-globaltable-resourcepolicy-policydocument

# File 'dynamo_db/cfn_global_table.rb', line 1843

def policy_document
  @policy_document
end

Class Method Details

.jsii_properties ⇒ Object

# File 'dynamo_db/cfn_global_table.rb', line 1845

def self.jsii_properties
  {
    :policy_document => "policyDocument",
  }
end

Instance Method Details

#to_jsii ⇒ Object

# File 'dynamo_db/cfn_global_table.rb', line 1851

def to_jsii
  result = {}
  result.merge!({
    "policyDocument" => @policy_document,
  })
  result.compact
end