feat(dynamodb): process GlobalSecondaryIndexUpdates in UpdateTable

[vieiralucas]

Summary

Batch 12 — second batch driving the DynamoDB tfacc deny-list down. Implements GSI lifecycle ops on `UpdateTable`.

Real AWS DynamoDB `UpdateTable` accepts a `GlobalSecondaryIndexUpdates` list with three op types — `Create`, `Update`, `Delete` — to manage GSIs across the table's lifetime. fakecloud was silently ignoring the entire list, which broke any Terraform `aws_dynamodb_table` workflow that mutated GSI capacity, projection, or membership after create.

• Create: add a new GSI from the supplied `KeySchema`, `Projection`, and `ProvisionedThroughput`. Replaces any existing GSI with the same name (idempotent re-create).
• Update: change `ProvisionedThroughput` on an existing GSI by name.
• Delete: drop a GSI by name.

Closes the `TestAccDynamoDBTable_gsiUpdateCapacity` gap; removes it from the tfacc deny-list. The other GSI gap entries (BillingMode transitions, on-demand throughput) need separate fakecloud work and stay denied.

Test plan

• New e2e test `dynamodb_update_table_processes_global_secondary_index_updates` covers Update path — passes
• `cargo test -p fakecloud-dynamodb` clean (98 unit tests)
• `cargo clippy -p fakecloud-dynamodb -p fakecloud-tfacc -p fakecloud-e2e --all-targets -- -D warnings` clean
• Conformance suite locally clean
• Upstream locally: `TestAccDynamoDBTable_gsiUpdateCapacity` passes (~14s)
• CI `tfacc dynamodb` green
• All other tfacc jobs still green
• Cubic clean

---

Summary by cubic

Adds full GlobalSecondaryIndexUpdates support to DynamoDB UpdateTable, matching AWS behavior for GSI create, update, and delete. This unblocks Terraform aws_dynamodb_table GSI lifecycle updates and removes TestAccDynamoDBTable_gsiUpdateCapacity from the fakecloud-tfacc deny-list.

• New Features
  • Implemented GSI Create (idempotent by name), Update (provisioned throughput), and Delete in UpdateTable (fakecloud-dynamodb).
  • Exposed parse_projection for GSI Create logic.
  • Added e2e test dynamodb_update_table_processes_global_secondary_index_updates (fakecloud-e2e) and updated fakecloud-tfacc/allowlist.rs.

^{Written for commit d4b1d7e. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 4 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="crates/fakecloud-dynamodb/src/service/tables.rs">

<violation number="1" location="crates/fakecloud-dynamodb/src/service/tables.rs:365">
P2: Do not swallow `KeySchema` parse errors when creating a GSI; this currently accepts invalid input and creates malformed index state.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P2: Do not swallow KeySchema parse errors when creating a GSI; this currently accepts invalid input and creates malformed index state.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At crates/fakecloud-dynamodb/src/service/tables.rs, line 365:

<comment>Do not swallow `KeySchema` parse errors when creating a GSI; this currently accepts invalid input and creates malformed index state.</comment>

<file context>
@@ -346,6 +349,52 @@ impl DynamoDbService {
+                        Some(n) => n.to_string(),
+                        None => continue,
+                    };
+                    let key_schema = parse_key_schema(&create["KeySchema"]).unwrap_or_default();
+                    let projection = parse_projection(&create["Projection"]);
+                    let provisioned_throughput =
</file context>

Suggested change

	let key_schema = parse_key_schema(&create["KeySchema"]).unwrap_or_default();
	let key_schema = parse_key_schema(&create["KeySchema"])?;