aws/aws-cdk

aws-dynamodb: TableV2 with DynamoEventSource triggers deprecated TableGrantsProps#policyResource and #encryptedResource warnings during synth

Open

#37,221 创建于 2026年3月11日

在 GitHub 查看
 (5 评论) (4 反应) (0 负责人)TypeScript (10,710 star) (3,530 fork)batch import
@aws-cdk/aws-dynamodbbugeffort/smallgood first issuep2

描述

Describe the bug

Using TableV2 with dynamo_stream=StreamViewType.NEW_IMAGE and attaching a DynamoEventSource to a Lambda produces deprecation warnings during cdk synth. The warnings originate inside CDK's own grantStreamRead() call — not from user code. There is no way to avoid them from user-land.

doing cdk synth leads to warnings:

Regression Issue

  • Select this option if this issue appears to be a regression.

Last Known Working CDK Library Version

No response

Expected Behavior

No deprecation warnings when using only supported, non-deprecated APIs.

Current Behavior

Warnings appear once per TableV2 instance that has a DynamoEventSource attached.

Reproduction Steps

table = dynamodb.TableV2(
    self, "MyTable",
    partition_key=dynamodb.Attribute(name="pk", type=dynamodb.AttributeType.STRING),
    dynamo_stream=dynamodb.StreamViewType.NEW_IMAGE,
    billing=dynamodb.Billing.on_demand(),
)

fn.add_event_source(
    lvs.DynamoEventSource(
        table=table,
        starting_position=lbd.StartingPosition.LATEST,
    )
)



### Possible Solution

Root cause (suspected by claude :-))
DynamoEventSource.bind() internally calls table.grantStreamRead(), which constructs TableGrantsProps with the deprecated policyResource and encryptedResource fields. This is CDK-internal usage; user code cannot influence it.

### Additional Information/Context

#### WARNING OUTPUT:

[WARNING] aws-cdk-lib.aws_dynamodb.TableGrantsProps#policyResource is deprecated.
  - Leave this field undefined. A best-effort attempt will be made to discover a resource policy and add permissions to it.
  This API will be removed in the next major release.
[WARNING] aws-cdk-lib.aws_dynamodb.TableGrantsProps#encryptedResource is deprecated.
  - Leave this field undefined. If the table is encrypted with a customer-managed KMS key, appropriate grants to the key will be automatically added.
  This API will be removed in the next major release.

### AWS CDK Library version (aws-cdk-lib)

2.242.0

### AWS CDK CLI version

2.1110.0 (build 970da46)

### Node.js Version

2.242.0

### OS

Linux TRANSDEV 5.15.167.4-microsoft-standard-WSL2 #1 SMP Tue Nov 5 00:21:55 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux

### Language

Python

### Language Version

3.13.9

### Other information

_No response_

贡献者指南

技术栈
typescriptpython
领域
cloudinfrastructuretooling
议题类型
bug
难度面向新贡献者的预计实现难度，1 表示很小改动，5 表示专家级工作。
4
预计时间有经验贡献者完成调查、实现、测试并准备 pull request 的粗略时间范围。
1-2 days
活动状态议题当前的可参与程度：新鲜、活跃、陈旧、阻塞或等待维护者输入。
fresh
清晰度议题是否清楚说明期望改动、验收标准和下一步。
clear
前置要求
AWS CDK internalsTypeScriptDeprecation patterns
新手友好度1-100 的估计分数，表示该议题对首次贡献者的友好程度。
20
研究方向
Investigate the DynamoEventSource.bind() method in aws cdk lib/aws lambda/lib/event sources/dynamodb.ts and the grantStreamRead() method in aws cdk lib/aws dynamodb/lib/table v2.ts. The issue is that grantStreamRead internally constructs TableGrantsProps with deprecated fields policyResource and encryptedResource. The fix should modify the internal code to avoid using these deprecated props, likely by updating the grant call to omit them or use a new API. Check for any existing PRs or comments on this issue for guidance. The reproduction steps in Python hint that the bug occurs when attaching a DynamoEventSource to a Lambda.
aws-dynamodb: TableV2 with DynamoEventSource triggers deprecated TableGrantsProps#policyResource and #encryptedResource warnings during synth · aws/aws-cdk#37221 | Good First Issue