fix(dynamodb): fix hardcoded partition in replica-provider IAM policy

[jacklin213]

This PR replaces the hardcoded aws partition used in the IAM policy with ${Aws:Partition} to ensure the correct partition is used during policy generation.

Closes #25407

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[gitpod-io]

[aws-cdk-automation]

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

[jacklin213]

Clarification Request:
Currently there is 2 existing integ tests that cover the changes:

• packages/@aws-cdk-testing/framework-integ/test/aws-dynamodb/test/integ.global.js
• packages/@aws-cdk-testing/framework-integ/test/aws-dynamodb/test/integ.global-replicas-provisioned.js

No changes need to be made on the test but the snapshot needs to be updated.
When following https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md#creating-a-test to run the commands to update the snapshot
yarn integ --directory test/aws-dynamodb/test --update-on-failed
or directly on a test
yarn integ test/aws-dynamodb/test/integ.global-replicas-provisioned.js --update-on-failed

the tests will fail with CloudFormation throwing an error around the Custom Resource (code was not changed)

cdk-dynamodb-global-20191121 | 5:16:52 AM | CREATE_FAILED        | Custom::DynamoDBReplica    | Table/Replicaeu-west-2/Default (TableReplicaeuwest290D3CD3A) Received response status [FAILED] from custom resource. Message returned: index.onEventHandler is undefined or not exported

Logs: /aws/lambda/cdk-dynamodb-global-2019112-OnEventHandler42BEBAE0-vtrVfhgolHn0

    at Object.module.exports.load (/var/runtime/UserFunction.js:304:11)
    at Object.<anonymous> (/var/runtime/index.js:43:34)
    at Module._compile (internal/modules/cjs/loader.js:1114:14)
    at Object.Module._extensions..js (internal/modules/cjs/loader.js:1143:10)
    at Module.load (internal/modules/cjs/loader.js:979:32)
    at Function.Module._load (internal/modules/cjs/loader.js:819:12)
    at Function.executeUserEntryPoint [as runMain] (internal/modules/run_main.js:75:12)
    at internal/main/run_main_module.js:17:47 (RequestId: eb86698b-ff91-4a28-ace1-cf790210b531)

Looking for guidance on how to update the snapshots. Am I missing some other setup steps?

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[corymhall]

Looking for guidance on how to update the snapshots. Am I missing some other setup steps?

Can you try running it with the --disable-update-workflow? My hunch is that something in the existing snapshot is breaking the deployment and this flag will just deploy the new app.

[jacklin213]

@corymhall I figured it out. You were right about something in the existing snapshot breaking.
I had to nuke the previous global ddb related integ test snapshots, update the old integ tests to use the new IntegTests construct and then the integ tests successfully deployed as expected (CFN passed happily, didn't see any weird custom resource issues). My latest force push includes the integ test changes

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: ccd5e75
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).