Added dynamodb:DescribeTable to DynamoDBCrudPolicy and DynamoDBReadPo…

[sliedig]

Issue #, if available:
#509

Description of changes:
Added dynamodb:DescribeTable to DynamoDBCrudPolicy and DynamoDBReadPolicy policy templates

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[brettstack]

@sliedig could you rebase this on latest develop?

[sliedig]

Done

[brettstack]

Thanks. Unfortunately there's still a couple of issues:

1. You've revived the docs/ JSON file which has been removed. You'll need to delete the file.
2. You'll need to update the policy template test so that the expected output includes your changes.

[sliedig]

I see that. Apologies, let me sort that out. Thanks.

[brettstack]

Thanks! 🎉

[turjachaudhuri]

Any idea when this will be merged into the master branch . I faced the same issue , and for now , I have to manually add the policy from IAM to get it working after my app is deployed from the serverless app repository?
Thanks in advance.

[keetonian]

Per company policy I can't give you an exact date, but we are currently rolling out SAM v1.7.0 and are planning another release very soon for SAM that will have these changes (among other recent items) in it.

[sliedig]

I take it this PR did not make it into the v1.7.0 release?

[jlhood]

It was not in the v1.7.0 release, but it is currently in the v1.8.0 candidate release branch.

[MattiAstedrone]

Should the DynamoDBReadPolicy policy also give permission to the table's Global Secondary Indexes? I was hoping it would but that doesn't seem to be the case.

Using the policy, my lambda throws this error:
"User: arn:aws:sts::1234:assumed-role/CodeStarWorker-Lambda/awscodestar-lambda-1K9 is not authorized to perform: dynamodb:Query on resource: arn:aws:dynamodb:eu-west-1:1234:table/awscodestar-lambda-TokenTable-1VL/index/token-index"

I can fix it manually by adding * to the end of the IAM policy resource (tablename), like "awscodestar-lambda-TokenTable-1VL" -> "awscodestar-lambda-TokenTable-1VL*". But if I update the lambda, the change gets overwritten.

I tried to add the * in the SAM template but it didn't work out. Like this:

• DynamoDBReadPolicy:
  TableName: !Join ['', [!Ref TokenTable, '*' ]]

[keetonian]

This feature has now been released with 1.8.0

[sliedig]

Thank you! :-)