aws-cdk-lib 2.143.1__py3-none-any.whl → 2.145.0__py3-none-any.whl

aws_cdk/aws_dynamodb/__init__.py

@@ -623,6 +623,36 @@ If you intend to use the `tableStreamArn` (including indirectly, for example by
 
 To grant permissions to indexes for a referenced table you can either set `grantIndexPermissions` to `true`, or you can provide the indexes via the `globalIndexes` or `localIndexes` properties. This will enable `grant*` methods to also grant permissions to *all* table indexes.
 
+## Resource Policy
+
+Using `resourcePolicy` you can add a [resource policy](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/access-control-resource-based.html) to a table in the form of a `PolicyDocument`:
+
+```
+    // resource policy document
+    const policy = new iam.PolicyDocument({
+      statements: [
+        new iam.PolicyStatement({
+          actions: ['dynamodb:GetItem'],
+          principals: [new iam.AccountRootPrincipal()],
+          resources: ['*'],
+        }),
+      ],
+    });
+
+    // table with resource policy
+    new dynamodb.TableV2(this, 'TableTestV2-1', {
+      partitionKey: {
+        name: 'id',
+        type: dynamodb.AttributeType.STRING,
+      },
+      removalPolicy: RemovalPolicy.DESTROY,
+      resourcePolicy: policy,
+    });
+```
+
+TableV2 doesn’t support creating a replica and adding a resource-based policy to that replica in the same stack update in Regions other than the Region where you deploy the stack update.
+To incorporate a resource-based policy into a replica, you'll need to initially deploy the replica without the policy, followed by a subsequent update to include the desired policy.
+
 ## Grants
 
 Using any of the `grant*` methods on an instance of the `TableV2` construct will only apply to the primary table, its indexes, and any associated `encryptionKey`. As an example, `grantReadData` used below will only apply the table in `us-west-2`:
@@ -905,7 +935,14 @@ from ..aws_cloudwatch import (
     MetricOptions as _MetricOptions_1788b62f,
     Unit as _Unit_61bc6f70,
 )
-from ..aws_iam import Grant as _Grant_a7ae64f8, IGrantable as _IGrantable_71c4f5de
+from ..aws_iam import (
+    AddToResourcePolicyResult as _AddToResourcePolicyResult_1d0a53ad,
+    Grant as _Grant_a7ae64f8,
+    IGrantable as _IGrantable_71c4f5de,
+    IResourceWithPolicy as _IResourceWithPolicy_720d64fc,
+    PolicyDocument as _PolicyDocument_3ac34393,
+    PolicyStatement as _PolicyStatement_0fe33853,
+)
 from ..aws_kinesis import IStream as _IStream_4e2457d2
 from ..aws_kms import IKey as _IKey_5f11635f
 from ..aws_s3 import IBucket as _IBucket_42e086fd
@@ -9634,7 +9671,7 @@ class TableAttributesV2:
         )
 
 
-@jsii.implements(ITable)
+@jsii.implements(ITable, _IResourceWithPolicy_720d64fc)
 class TableBase(
     _Resource_45bc6135,
     metaclass=jsii.JSIIAbstractClass,
@@ -9671,6 +9708,24 @@ class TableBase(
 
         jsii.create(self.__class__, self, [scope, id, props])
 
+    @jsii.member(jsii_name="addToResourcePolicy")
+    def add_to_resource_policy(
+        self,
+        statement: _PolicyStatement_0fe33853,
+    ) -> _AddToResourcePolicyResult_1d0a53ad:
+        '''Adds a statement to the resource policy associated with this file system.
+
+        A resource policy will be automatically created upon the first call to ``addToResourcePolicy``.
+
+        Note that this does not work with imported file systems.
+
+        :param statement: The policy statement to add.
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__9998fbfc8fdb03f3fe5356d84b9b9390d26bd73efb0eab172a4c638aeae5fc01)
+            check_type(argname="argument statement", value=statement, expected_type=type_hints["statement"])
+        return typing.cast(_AddToResourcePolicyResult_1d0a53ad, jsii.invoke(self, "addToResourcePolicy", [statement]))
+
     @jsii.member(jsii_name="grant")
     def grant(
         self,
@@ -10310,6 +10365,21 @@ class TableBase(
         '''
         ...
 
+    @builtins.property
+    @jsii.member(jsii_name="resourcePolicy")
+    @abc.abstractmethod
+    def resource_policy(self) -> typing.Optional[_PolicyDocument_3ac34393]:
+        '''Resource policy to assign to table.
+
+        :attribute: true
+        '''
+        ...
+
+    @resource_policy.setter
+    @abc.abstractmethod
+    def resource_policy(self, value: typing.Optional[_PolicyDocument_3ac34393]) -> None:
+        ...
+
 
 class _TableBaseProxy(
     TableBase,
@@ -10353,11 +10423,27 @@ class _TableBaseProxy(
         '''
         return typing.cast(typing.Optional[builtins.str], jsii.get(self, "tableStreamArn"))
 
+    @builtins.property
+    @jsii.member(jsii_name="resourcePolicy")
+    def resource_policy(self) -> typing.Optional[_PolicyDocument_3ac34393]:
+        '''Resource policy to assign to table.
+
+        :attribute: true
+        '''
+        return typing.cast(typing.Optional[_PolicyDocument_3ac34393], jsii.get(self, "resourcePolicy"))
+
+    @resource_policy.setter
+    def resource_policy(self, value: typing.Optional[_PolicyDocument_3ac34393]) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__385df27fafa61fd6d1e8ebb872e4af26b3119795ee6bb9684e56f891cd86ba94)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "resourcePolicy", value)
+
 # Adding a "__jsii_proxy_class__(): typing.Type" function to the abstract class
 typing.cast(typing.Any, TableBase).__jsii_proxy_class__ = lambda : _TableBaseProxy
 
 
-@jsii.implements(ITableV2)
+@jsii.implements(ITableV2, _IResourceWithPolicy_720d64fc)
 class TableBaseV2(
     _Resource_45bc6135,
     metaclass=jsii.JSIIAbstractClass,
@@ -10396,6 +10482,24 @@ class TableBaseV2(
 
         jsii.create(self.__class__, self, [scope, id, props])
 
+    @jsii.member(jsii_name="addToResourcePolicy")
+    def add_to_resource_policy(
+        self,
+        statement: _PolicyStatement_0fe33853,
+    ) -> _AddToResourcePolicyResult_1d0a53ad:
+        '''Adds a statement to the resource policy associated with this file system.
+
+        A resource policy will be automatically created upon the first call to ``addToResourcePolicy``.
+
+        Note that this does not work with imported file systems.
+
+        :param statement: The policy statement to add.
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__8ddb2818dbfcaf1b52fed7edb8ce145b274541d665df431c417e676bd4f69dec)
+            check_type(argname="argument statement", value=statement, expected_type=type_hints["statement"])
+        return typing.cast(_AddToResourcePolicyResult_1d0a53ad, jsii.invoke(self, "addToResourcePolicy", [statement]))
+
     @jsii.member(jsii_name="grant")
     def grant(
         self,
@@ -11055,6 +11159,18 @@ class TableBaseV2(
         '''
         ...
 
+    @builtins.property
+    @jsii.member(jsii_name="resourcePolicy")
+    @abc.abstractmethod
+    def resource_policy(self) -> typing.Optional[_PolicyDocument_3ac34393]:
+        '''The resource policy for the table.'''
+        ...
+
+    @resource_policy.setter
+    @abc.abstractmethod
+    def resource_policy(self, value: typing.Optional[_PolicyDocument_3ac34393]) -> None:
+        ...
+
 
 class _TableBaseV2Proxy(
     TableBaseV2,
@@ -11112,6 +11228,19 @@ class _TableBaseV2Proxy(
         '''
         return typing.cast(typing.Optional[builtins.str], jsii.get(self, "tableStreamArn"))
 
+    @builtins.property
+    @jsii.member(jsii_name="resourcePolicy")
+    def resource_policy(self) -> typing.Optional[_PolicyDocument_3ac34393]:
+        '''The resource policy for the table.'''
+        return typing.cast(typing.Optional[_PolicyDocument_3ac34393], jsii.get(self, "resourcePolicy"))
+
+    @resource_policy.setter
+    def resource_policy(self, value: typing.Optional[_PolicyDocument_3ac34393]) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__cb944fe3dd5a924cda3570a3226b526ff95d46099b3de4b4ab2a005c34091870)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "resourcePolicy", value)
+
 # Adding a "__jsii_proxy_class__(): typing.Type" function to the abstract class
 typing.cast(typing.Any, TableBaseV2).__jsii_proxy_class__ = lambda : _TableBaseV2Proxy
 
@@ -11264,6 +11393,7 @@ typing.cast(typing.Any, TableEncryptionV2).__jsii_proxy_class__ = lambda : _Tabl
         "removal_policy": "removalPolicy",
         "replication_regions": "replicationRegions",
         "replication_timeout": "replicationTimeout",
+        "resource_policy": "resourcePolicy",
         "stream": "stream",
         "table_class": "tableClass",
         "time_to_live_attribute": "timeToLiveAttribute",
@@ -11288,6 +11418,7 @@ class TableOptions(SchemaOptions):
         removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
         replication_regions: typing.Optional[typing.Sequence[builtins.str]] = None,
         replication_timeout: typing.Optional[_Duration_4839e8c3] = None,
+        resource_policy: typing.Optional[_PolicyDocument_3ac34393] = None,
         stream: typing.Optional[StreamViewType] = None,
         table_class: typing.Optional[TableClass] = None,
         time_to_live_attribute: typing.Optional[builtins.str] = None,
@@ -11311,6 +11442,7 @@ class TableOptions(SchemaOptions):
         :param removal_policy: The removal policy to apply to the DynamoDB Table. Default: RemovalPolicy.RETAIN
         :param replication_regions: Regions where replica tables will be created. Default: - no replica tables are created
         :param replication_timeout: The timeout for a table replication operation in a single region. Default: Duration.minutes(30)
+        :param resource_policy: Resource policy to assign to table. Default: - No resource policy statement
         :param stream: When an item in the table is modified, StreamViewType determines what information is written to the stream for this table. Default: - streams are disabled unless ``replicationRegions`` is specified
         :param table_class: Specify the table class. Default: STANDARD
         :param time_to_live_attribute: The name of TTL attribute. Default: - TTL is disabled
@@ -11325,12 +11457,14 @@ class TableOptions(SchemaOptions):
             # The values are placeholders you should change.
             import aws_cdk as cdk
             from aws_cdk import aws_dynamodb as dynamodb
+            from aws_cdk import aws_iam as iam
             from aws_cdk import aws_kms as kms
             from aws_cdk import aws_s3 as s3
             
             # bucket: s3.Bucket
             # input_format: dynamodb.InputFormat
             # key: kms.Key
+            # policy_document: iam.PolicyDocument
             
             table_options = dynamodb.TableOptions(
                 partition_key=dynamodb.Attribute(
@@ -11358,6 +11492,7 @@ class TableOptions(SchemaOptions):
                 removal_policy=cdk.RemovalPolicy.DESTROY,
                 replication_regions=["replicationRegions"],
                 replication_timeout=cdk.Duration.minutes(30),
+                resource_policy=policy_document,
                 sort_key=dynamodb.Attribute(
                     name="name",
                     type=dynamodb.AttributeType.BINARY
@@ -11390,6 +11525,7 @@ class TableOptions(SchemaOptions):
             check_type(argname="argument removal_policy", value=removal_policy, expected_type=type_hints["removal_policy"])
             check_type(argname="argument replication_regions", value=replication_regions, expected_type=type_hints["replication_regions"])
             check_type(argname="argument replication_timeout", value=replication_timeout, expected_type=type_hints["replication_timeout"])
+            check_type(argname="argument resource_policy", value=resource_policy, expected_type=type_hints["resource_policy"])
             check_type(argname="argument stream", value=stream, expected_type=type_hints["stream"])
             check_type(argname="argument table_class", value=table_class, expected_type=type_hints["table_class"])
             check_type(argname="argument time_to_live_attribute", value=time_to_live_attribute, expected_type=type_hints["time_to_live_attribute"])
@@ -11422,6 +11558,8 @@ class TableOptions(SchemaOptions):
             self._values["replication_regions"] = replication_regions
         if replication_timeout is not None:
             self._values["replication_timeout"] = replication_timeout
+        if resource_policy is not None:
+            self._values["resource_policy"] = resource_policy
         if stream is not None:
             self._values["stream"] = stream
         if table_class is not None:
@@ -11570,6 +11708,17 @@ class TableOptions(SchemaOptions):
         result = self._values.get("replication_timeout")
         return typing.cast(typing.Optional[_Duration_4839e8c3], result)
 
+    @builtins.property
+    def resource_policy(self) -> typing.Optional[_PolicyDocument_3ac34393]:
+        '''Resource policy to assign to table.
+
+        :default: - No resource policy statement
+
+        :see: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-dynamodb-table.html#cfn-dynamodb-table-resourcepolicy
+        '''
+        result = self._values.get("resource_policy")
+        return typing.cast(typing.Optional[_PolicyDocument_3ac34393], result)
+
     @builtins.property
     def stream(self) -> typing.Optional[StreamViewType]:
         '''When an item in the table is modified, StreamViewType determines what information is written to the stream for this table.
@@ -11658,6 +11807,7 @@ class TableOptions(SchemaOptions):
         "deletion_protection": "deletionProtection",
         "kinesis_stream": "kinesisStream",
         "point_in_time_recovery": "pointInTimeRecovery",
+        "resource_policy": "resourcePolicy",
         "table_class": "tableClass",
         "tags": "tags",
     },
@@ -11670,6 +11820,7 @@ class TableOptionsV2:
         deletion_protection: typing.Optional[builtins.bool] = None,
         kinesis_stream: typing.Optional[_IStream_4e2457d2] = None,
         point_in_time_recovery: typing.Optional[builtins.bool] = None,
+        resource_policy: typing.Optional[_PolicyDocument_3ac34393] = None,
         table_class: typing.Optional[TableClass] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
@@ -11679,6 +11830,7 @@ class TableOptionsV2:
         :param deletion_protection: Whether deletion protection is enabled. Default: false
         :param kinesis_stream: Kinesis Data Stream to capture item level changes. Default: - no Kinesis Data Stream
         :param point_in_time_recovery: Whether point-in-time recovery is enabled. Default: false
+        :param resource_policy: Resource policy to assign to DynamoDB Table. Default: - No resource policy statements are added to the created table.
         :param table_class: The table class. Default: TableClass.STANDARD
         :param tags: Tags to be applied to the table or replica table. Default: - no tags
 
@@ -11689,8 +11841,10 @@ class TableOptionsV2:
             # The code below shows an example of how to instantiate this type.
             # The values are placeholders you should change.
             from aws_cdk import aws_dynamodb as dynamodb
+            from aws_cdk import aws_iam as iam
             from aws_cdk import aws_kinesis as kinesis
             
+            # policy_document: iam.PolicyDocument
             # stream: kinesis.Stream
             
             table_options_v2 = dynamodb.TableOptionsV2(
@@ -11698,6 +11852,7 @@ class TableOptionsV2:
                 deletion_protection=False,
                 kinesis_stream=stream,
                 point_in_time_recovery=False,
+                resource_policy=policy_document,
                 table_class=dynamodb.TableClass.STANDARD,
                 tags=[CfnTag(
                     key="key",
@@ -11711,6 +11866,7 @@ class TableOptionsV2:
             check_type(argname="argument deletion_protection", value=deletion_protection, expected_type=type_hints["deletion_protection"])
             check_type(argname="argument kinesis_stream", value=kinesis_stream, expected_type=type_hints["kinesis_stream"])
             check_type(argname="argument point_in_time_recovery", value=point_in_time_recovery, expected_type=type_hints["point_in_time_recovery"])
+            check_type(argname="argument resource_policy", value=resource_policy, expected_type=type_hints["resource_policy"])
             check_type(argname="argument table_class", value=table_class, expected_type=type_hints["table_class"])
             check_type(argname="argument tags", value=tags, expected_type=type_hints["tags"])
         self._values: typing.Dict[builtins.str, typing.Any] = {}
@@ -11722,6 +11878,8 @@ class TableOptionsV2:
             self._values["kinesis_stream"] = kinesis_stream
         if point_in_time_recovery is not None:
             self._values["point_in_time_recovery"] = point_in_time_recovery
+        if resource_policy is not None:
+            self._values["resource_policy"] = resource_policy
         if table_class is not None:
             self._values["table_class"] = table_class
         if tags is not None:
@@ -11763,6 +11921,17 @@ class TableOptionsV2:
         result = self._values.get("point_in_time_recovery")
         return typing.cast(typing.Optional[builtins.bool], result)
 
+    @builtins.property
+    def resource_policy(self) -> typing.Optional[_PolicyDocument_3ac34393]:
+        '''Resource policy to assign to DynamoDB Table.
+
+        :default: - No resource policy statements are added to the created table.
+
+        :see: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-dynamodb-globaltable-replicaspecification.html#cfn-dynamodb-globaltable-replicaspecification-resourcepolicy
+        '''
+        result = self._values.get("resource_policy")
+        return typing.cast(typing.Optional[_PolicyDocument_3ac34393], result)
+
     @builtins.property
     def table_class(self) -> typing.Optional[TableClass]:
         '''The table class.
@@ -11810,6 +11979,7 @@ class TableOptionsV2:
         "removal_policy": "removalPolicy",
         "replication_regions": "replicationRegions",
         "replication_timeout": "replicationTimeout",
+        "resource_policy": "resourcePolicy",
         "stream": "stream",
         "table_class": "tableClass",
         "time_to_live_attribute": "timeToLiveAttribute",
@@ -11836,6 +12006,7 @@ class TableProps(TableOptions):
         removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
         replication_regions: typing.Optional[typing.Sequence[builtins.str]] = None,
         replication_timeout: typing.Optional[_Duration_4839e8c3] = None,
+        resource_policy: typing.Optional[_PolicyDocument_3ac34393] = None,
         stream: typing.Optional[StreamViewType] = None,
         table_class: typing.Optional[TableClass] = None,
         time_to_live_attribute: typing.Optional[builtins.str] = None,
@@ -11859,6 +12030,7 @@ class TableProps(TableOptions):
         :param removal_policy: The removal policy to apply to the DynamoDB Table. Default: RemovalPolicy.RETAIN
         :param replication_regions: Regions where replica tables will be created. Default: - no replica tables are created
         :param replication_timeout: The timeout for a table replication operation in a single region. Default: Duration.minutes(30)
+        :param resource_policy: Resource policy to assign to table. Default: - No resource policy statement
         :param stream: When an item in the table is modified, StreamViewType determines what information is written to the stream for this table. Default: - streams are disabled unless ``replicationRegions`` is specified
         :param table_class: Specify the table class. Default: STANDARD
         :param time_to_live_attribute: The name of TTL attribute. Default: - TTL is disabled
@@ -11917,6 +12089,7 @@ class TableProps(TableOptions):
             check_type(argname="argument removal_policy", value=removal_policy, expected_type=type_hints["removal_policy"])
             check_type(argname="argument replication_regions", value=replication_regions, expected_type=type_hints["replication_regions"])
             check_type(argname="argument replication_timeout", value=replication_timeout, expected_type=type_hints["replication_timeout"])
+            check_type(argname="argument resource_policy", value=resource_policy, expected_type=type_hints["resource_policy"])
             check_type(argname="argument stream", value=stream, expected_type=type_hints["stream"])
             check_type(argname="argument table_class", value=table_class, expected_type=type_hints["table_class"])
             check_type(argname="argument time_to_live_attribute", value=time_to_live_attribute, expected_type=type_hints["time_to_live_attribute"])
@@ -11951,6 +12124,8 @@ class TableProps(TableOptions):
             self._values["replication_regions"] = replication_regions
         if replication_timeout is not None:
             self._values["replication_timeout"] = replication_timeout
+        if resource_policy is not None:
+            self._values["resource_policy"] = resource_policy
         if stream is not None:
             self._values["stream"] = stream
         if table_class is not None:
@@ -12103,6 +12278,17 @@ class TableProps(TableOptions):
         result = self._values.get("replication_timeout")
         return typing.cast(typing.Optional[_Duration_4839e8c3], result)
 
+    @builtins.property
+    def resource_policy(self) -> typing.Optional[_PolicyDocument_3ac34393]:
+        '''Resource policy to assign to table.
+
+        :default: - No resource policy statement
+
+        :see: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-dynamodb-table.html#cfn-dynamodb-table-resourcepolicy
+        '''
+        result = self._values.get("resource_policy")
+        return typing.cast(typing.Optional[_PolicyDocument_3ac34393], result)
+
     @builtins.property
     def stream(self) -> typing.Optional[StreamViewType]:
         '''When an item in the table is modified, StreamViewType determines what information is written to the stream for this table.
@@ -12209,6 +12395,7 @@ class TableProps(TableOptions):
         "deletion_protection": "deletionProtection",
         "kinesis_stream": "kinesisStream",
         "point_in_time_recovery": "pointInTimeRecovery",
+        "resource_policy": "resourcePolicy",
         "table_class": "tableClass",
         "tags": "tags",
         "partition_key": "partitionKey",
@@ -12232,6 +12419,7 @@ class TablePropsV2(TableOptionsV2):
         deletion_protection: typing.Optional[builtins.bool] = None,
         kinesis_stream: typing.Optional[_IStream_4e2457d2] = None,
         point_in_time_recovery: typing.Optional[builtins.bool] = None,
+        resource_policy: typing.Optional[_PolicyDocument_3ac34393] = None,
         table_class: typing.Optional[TableClass] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
         partition_key: typing.Union[Attribute, typing.Dict[builtins.str, typing.Any]],
@@ -12252,6 +12440,7 @@ class TablePropsV2(TableOptionsV2):
         :param deletion_protection: Whether deletion protection is enabled. Default: false
         :param kinesis_stream: Kinesis Data Stream to capture item level changes. Default: - no Kinesis Data Stream
         :param point_in_time_recovery: Whether point-in-time recovery is enabled. Default: false
+        :param resource_policy: Resource policy to assign to DynamoDB Table. Default: - No resource policy statements are added to the created table.
         :param table_class: The table class. Default: TableClass.STANDARD
         :param tags: Tags to be applied to the table or replica table. Default: - no tags
         :param partition_key: Partition key attribute definition.
@@ -12294,6 +12483,7 @@ class TablePropsV2(TableOptionsV2):
             check_type(argname="argument deletion_protection", value=deletion_protection, expected_type=type_hints["deletion_protection"])
             check_type(argname="argument kinesis_stream", value=kinesis_stream, expected_type=type_hints["kinesis_stream"])
             check_type(argname="argument point_in_time_recovery", value=point_in_time_recovery, expected_type=type_hints["point_in_time_recovery"])
+            check_type(argname="argument resource_policy", value=resource_policy, expected_type=type_hints["resource_policy"])
             check_type(argname="argument table_class", value=table_class, expected_type=type_hints["table_class"])
             check_type(argname="argument tags", value=tags, expected_type=type_hints["tags"])
             check_type(argname="argument partition_key", value=partition_key, expected_type=type_hints["partition_key"])
@@ -12318,6 +12508,8 @@ class TablePropsV2(TableOptionsV2):
             self._values["kinesis_stream"] = kinesis_stream
         if point_in_time_recovery is not None:
             self._values["point_in_time_recovery"] = point_in_time_recovery
+        if resource_policy is not None:
+            self._values["resource_policy"] = resource_policy
         if table_class is not None:
             self._values["table_class"] = table_class
         if tags is not None:
@@ -12379,6 +12571,17 @@ class TablePropsV2(TableOptionsV2):
         result = self._values.get("point_in_time_recovery")
         return typing.cast(typing.Optional[builtins.bool], result)
 
+    @builtins.property
+    def resource_policy(self) -> typing.Optional[_PolicyDocument_3ac34393]:
+        '''Resource policy to assign to DynamoDB Table.
+
+        :default: - No resource policy statements are added to the created table.
+
+        :see: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-dynamodb-globaltable-replicaspecification.html#cfn-dynamodb-globaltable-replicaspecification-resourcepolicy
+        '''
+        result = self._values.get("resource_policy")
+        return typing.cast(typing.Optional[_PolicyDocument_3ac34393], result)
+
     @builtins.property
     def table_class(self) -> typing.Optional[TableClass]:
         '''The table class.
@@ -12568,6 +12771,7 @@ class TableV2(
         deletion_protection: typing.Optional[builtins.bool] = None,
         kinesis_stream: typing.Optional[_IStream_4e2457d2] = None,
         point_in_time_recovery: typing.Optional[builtins.bool] = None,
+        resource_policy: typing.Optional[_PolicyDocument_3ac34393] = None,
         table_class: typing.Optional[TableClass] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
@@ -12589,6 +12793,7 @@ class TableV2(
         :param deletion_protection: Whether deletion protection is enabled. Default: false
         :param kinesis_stream: Kinesis Data Stream to capture item level changes. Default: - no Kinesis Data Stream
         :param point_in_time_recovery: Whether point-in-time recovery is enabled. Default: false
+        :param resource_policy: Resource policy to assign to DynamoDB Table. Default: - No resource policy statements are added to the created table.
         :param table_class: The table class. Default: TableClass.STANDARD
         :param tags: Tags to be applied to the table or replica table. Default: - no tags
         '''
@@ -12612,6 +12817,7 @@ class TableV2(
             deletion_protection=deletion_protection,
             kinesis_stream=kinesis_stream,
             point_in_time_recovery=point_in_time_recovery,
+            resource_policy=resource_policy,
             table_class=table_class,
             tags=tags,
         )
@@ -12780,6 +12986,7 @@ class TableV2(
         deletion_protection: typing.Optional[builtins.bool] = None,
         kinesis_stream: typing.Optional[_IStream_4e2457d2] = None,
         point_in_time_recovery: typing.Optional[builtins.bool] = None,
+        resource_policy: typing.Optional[_PolicyDocument_3ac34393] = None,
         table_class: typing.Optional[TableClass] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
@@ -12794,6 +13001,7 @@ class TableV2(
         :param deletion_protection: Whether deletion protection is enabled. Default: false
         :param kinesis_stream: Kinesis Data Stream to capture item level changes. Default: - no Kinesis Data Stream
         :param point_in_time_recovery: Whether point-in-time recovery is enabled. Default: false
+        :param resource_policy: Resource policy to assign to DynamoDB Table. Default: - No resource policy statements are added to the created table.
         :param table_class: The table class. Default: TableClass.STANDARD
         :param tags: Tags to be applied to the table or replica table. Default: - no tags
         '''
@@ -12805,6 +13013,7 @@ class TableV2(
             deletion_protection=deletion_protection,
             kinesis_stream=kinesis_stream,
             point_in_time_recovery=point_in_time_recovery,
+            resource_policy=resource_policy,
             table_class=table_class,
             tags=tags,
         )
@@ -12876,6 +13085,22 @@ class TableV2(
         '''
         return typing.cast(typing.Optional[builtins.str], jsii.get(self, "tableStreamArn"))
 
+    @builtins.property
+    @jsii.member(jsii_name="resourcePolicy")
+    def resource_policy(self) -> typing.Optional[_PolicyDocument_3ac34393]:
+        '''The resource policy for the table.
+
+        :attribute: true
+        '''
+        return typing.cast(typing.Optional[_PolicyDocument_3ac34393], jsii.get(self, "resourcePolicy"))
+
+    @resource_policy.setter
+    def resource_policy(self, value: typing.Optional[_PolicyDocument_3ac34393]) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__7c681fc6a08524e2909b1c97c77ad38edec11b1f8bd3f666a073a61c09638e19)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "resourcePolicy", value)
+
 
 @jsii.data_type(
     jsii_type="aws-cdk-lib.aws_dynamodb.ThroughputProps",
@@ -13747,6 +13972,7 @@ class OperationsMetricOptions(SystemErrorsForOperationsMetricOptions):
         "deletion_protection": "deletionProtection",
         "kinesis_stream": "kinesisStream",
         "point_in_time_recovery": "pointInTimeRecovery",
+        "resource_policy": "resourcePolicy",
         "table_class": "tableClass",
         "tags": "tags",
         "region": "region",
@@ -13762,6 +13988,7 @@ class ReplicaTableProps(TableOptionsV2):
         deletion_protection: typing.Optional[builtins.bool] = None,
         kinesis_stream: typing.Optional[_IStream_4e2457d2] = None,
         point_in_time_recovery: typing.Optional[builtins.bool] = None,
+        resource_policy: typing.Optional[_PolicyDocument_3ac34393] = None,
         table_class: typing.Optional[TableClass] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
         region: builtins.str,
@@ -13774,6 +14001,7 @@ class ReplicaTableProps(TableOptionsV2):
         :param deletion_protection: Whether deletion protection is enabled. Default: false
         :param kinesis_stream: Kinesis Data Stream to capture item level changes. Default: - no Kinesis Data Stream
         :param point_in_time_recovery: Whether point-in-time recovery is enabled. Default: false
+        :param resource_policy: Resource policy to assign to DynamoDB Table. Default: - No resource policy statements are added to the created table.
         :param table_class: The table class. Default: TableClass.STANDARD
         :param tags: Tags to be applied to the table or replica table. Default: - no tags
         :param region: The region that the replica table will be created in.
@@ -13803,6 +14031,7 @@ class ReplicaTableProps(TableOptionsV2):
             check_type(argname="argument deletion_protection", value=deletion_protection, expected_type=type_hints["deletion_protection"])
             check_type(argname="argument kinesis_stream", value=kinesis_stream, expected_type=type_hints["kinesis_stream"])
             check_type(argname="argument point_in_time_recovery", value=point_in_time_recovery, expected_type=type_hints["point_in_time_recovery"])
+            check_type(argname="argument resource_policy", value=resource_policy, expected_type=type_hints["resource_policy"])
             check_type(argname="argument table_class", value=table_class, expected_type=type_hints["table_class"])
             check_type(argname="argument tags", value=tags, expected_type=type_hints["tags"])
             check_type(argname="argument region", value=region, expected_type=type_hints["region"])
@@ -13819,6 +14048,8 @@ class ReplicaTableProps(TableOptionsV2):
             self._values["kinesis_stream"] = kinesis_stream
         if point_in_time_recovery is not None:
             self._values["point_in_time_recovery"] = point_in_time_recovery
+        if resource_policy is not None:
+            self._values["resource_policy"] = resource_policy
         if table_class is not None:
             self._values["table_class"] = table_class
         if tags is not None:
@@ -13864,6 +14095,17 @@ class ReplicaTableProps(TableOptionsV2):
         result = self._values.get("point_in_time_recovery")
         return typing.cast(typing.Optional[builtins.bool], result)
 
+    @builtins.property
+    def resource_policy(self) -> typing.Optional[_PolicyDocument_3ac34393]:
+        '''Resource policy to assign to DynamoDB Table.
+
+        :default: - No resource policy statements are added to the created table.
+
+        :see: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-dynamodb-globaltable-replicaspecification.html#cfn-dynamodb-globaltable-replicaspecification-resourcepolicy
+        '''
+        result = self._values.get("resource_policy")
+        return typing.cast(typing.Optional[_PolicyDocument_3ac34393], result)
+
     @builtins.property
     def table_class(self) -> typing.Optional[TableClass]:
         '''The table class.
@@ -13978,6 +14220,7 @@ class Table(
         removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
         replication_regions: typing.Optional[typing.Sequence[builtins.str]] = None,
         replication_timeout: typing.Optional[_Duration_4839e8c3] = None,
+        resource_policy: typing.Optional[_PolicyDocument_3ac34393] = None,
         stream: typing.Optional[StreamViewType] = None,
         table_class: typing.Optional[TableClass] = None,
         time_to_live_attribute: typing.Optional[builtins.str] = None,
@@ -14002,6 +14245,7 @@ class Table(
         :param removal_policy: The removal policy to apply to the DynamoDB Table. Default: RemovalPolicy.RETAIN
         :param replication_regions: Regions where replica tables will be created. Default: - no replica tables are created
         :param replication_timeout: The timeout for a table replication operation in a single region. Default: Duration.minutes(30)
+        :param resource_policy: Resource policy to assign to table. Default: - No resource policy statement
         :param stream: When an item in the table is modified, StreamViewType determines what information is written to the stream for this table. Default: - streams are disabled unless ``replicationRegions`` is specified
         :param table_class: Specify the table class. Default: STANDARD
         :param time_to_live_attribute: The name of TTL attribute. Default: - TTL is disabled
@@ -14028,6 +14272,7 @@ class Table(
             removal_policy=removal_policy,
             replication_regions=replication_regions,
             replication_timeout=replication_timeout,
+            resource_policy=resource_policy,
             stream=stream,
             table_class=table_class,
             time_to_live_attribute=time_to_live_attribute,
@@ -14325,6 +14570,24 @@ class Table(
         '''
         return typing.cast(typing.Optional[builtins.str], jsii.get(self, "tableStreamArn"))
 
+    @builtins.property
+    @jsii.member(jsii_name="resourcePolicy")
+    def resource_policy(self) -> typing.Optional[_PolicyDocument_3ac34393]:
+        '''Resource policy to assign to DynamoDB Table.
+
+        :default: - No resource policy statements are added to the created table.
+
+        :see: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-dynamodb-table-resourcepolicy.html
+        '''
+        return typing.cast(typing.Optional[_PolicyDocument_3ac34393], jsii.get(self, "resourcePolicy"))
+
+    @resource_policy.setter
+    def resource_policy(self, value: typing.Optional[_PolicyDocument_3ac34393]) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__b85333b9f4a3ca55431a35f4006c1aeb1fcd34f68dee45d5355498d8a1b77806)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "resourcePolicy", value)
+
 
 __all__ = [
     "Attribute",
@@ -15222,6 +15485,12 @@ def _typecheckingstub__2ef78b473dc672e1f0a8737346a30df5180e8a2493195d29264f12c0e
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__9998fbfc8fdb03f3fe5356d84b9b9390d26bd73efb0eab172a4c638aeae5fc01(
+    statement: _PolicyStatement_0fe33853,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__ad55d8fd00d859ce3132dc1316888fe9f09c2a3381b167ac699e89edb96ec936(
     grantee: _IGrantable_71c4f5de,
     *actions: builtins.str,
@@ -15302,6 +15571,12 @@ def _typecheckingstub__95d33a70a83403322cdc035963638859f588f5d47bae922a6083d3acd
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__385df27fafa61fd6d1e8ebb872e4af26b3119795ee6bb9684e56f891cd86ba94(
+    value: typing.Optional[_PolicyDocument_3ac34393],
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__12cb4b2677f8954ffc9804c993081f8508388207f5fbd561ee30b05d627d346d(
     scope: _constructs_77d1e7e8.Construct,
     id: builtins.str,
@@ -15314,6 +15589,12 @@ def _typecheckingstub__12cb4b2677f8954ffc9804c993081f8508388207f5fbd561ee30b05d6
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__8ddb2818dbfcaf1b52fed7edb8ce145b274541d665df431c417e676bd4f69dec(
+    statement: _PolicyStatement_0fe33853,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__8c13e6b8a6a1b9f8e195999afa23db9ba994042dcd37d7e98faab10cbfd364e6(
     grantee: _IGrantable_71c4f5de,
     *actions: builtins.str,
@@ -15395,6 +15676,12 @@ def _typecheckingstub__77d4ef5bc85980ee36c06595f45b530b92a1b51437a40ca9dc19d75ed
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__cb944fe3dd5a924cda3570a3226b526ff95d46099b3de4b4ab2a005c34091870(
+    value: typing.Optional[_PolicyDocument_3ac34393],
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__1cd9eda3b1990473e69185ec48d3b90ce15de00745ae210b41792833c6ec214a(
     table_key: _IKey_5f11635f,
     replica_key_arns: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
@@ -15417,6 +15704,7 @@ def _typecheckingstub__dadf5733fac70178ab246582a0b777b8c203659229753a8396594d751
     removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
     replication_regions: typing.Optional[typing.Sequence[builtins.str]] = None,
     replication_timeout: typing.Optional[_Duration_4839e8c3] = None,
+    resource_policy: typing.Optional[_PolicyDocument_3ac34393] = None,
     stream: typing.Optional[StreamViewType] = None,
     table_class: typing.Optional[TableClass] = None,
     time_to_live_attribute: typing.Optional[builtins.str] = None,
@@ -15432,6 +15720,7 @@ def _typecheckingstub__1b65ee3c8ef5c3b632f4d1fad233252caadaa5f607c0fd92f49b64933
     deletion_protection: typing.Optional[builtins.bool] = None,
     kinesis_stream: typing.Optional[_IStream_4e2457d2] = None,
     point_in_time_recovery: typing.Optional[builtins.bool] = None,
+    resource_policy: typing.Optional[_PolicyDocument_3ac34393] = None,
     table_class: typing.Optional[TableClass] = None,
     tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
 ) -> None:
@@ -15453,6 +15742,7 @@ def _typecheckingstub__00475a5e14af8c4c7049089f69b3d29ad81bc91e7e1f0a5a5b7b794a5
     removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
     replication_regions: typing.Optional[typing.Sequence[builtins.str]] = None,
     replication_timeout: typing.Optional[_Duration_4839e8c3] = None,
+    resource_policy: typing.Optional[_PolicyDocument_3ac34393] = None,
     stream: typing.Optional[StreamViewType] = None,
     table_class: typing.Optional[TableClass] = None,
     time_to_live_attribute: typing.Optional[builtins.str] = None,
@@ -15470,6 +15760,7 @@ def _typecheckingstub__205e5df85e01c6c2d91d5922a57e3ed5903027748a8b3222622bebd10
     deletion_protection: typing.Optional[builtins.bool] = None,
     kinesis_stream: typing.Optional[_IStream_4e2457d2] = None,
     point_in_time_recovery: typing.Optional[builtins.bool] = None,
+    resource_policy: typing.Optional[_PolicyDocument_3ac34393] = None,
     table_class: typing.Optional[TableClass] = None,
     tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     partition_key: typing.Union[Attribute, typing.Dict[builtins.str, typing.Any]],
@@ -15506,6 +15797,7 @@ def _typecheckingstub__9ea47b003cdb497ff620f1410260696f97dbb2b00fa8558235f23771f
     deletion_protection: typing.Optional[builtins.bool] = None,
     kinesis_stream: typing.Optional[_IStream_4e2457d2] = None,
     point_in_time_recovery: typing.Optional[builtins.bool] = None,
+    resource_policy: typing.Optional[_PolicyDocument_3ac34393] = None,
     table_class: typing.Optional[TableClass] = None,
     tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
 ) -> None:
@@ -15550,6 +15842,12 @@ def _typecheckingstub__7cb08c3fe1f7c7db5d9459ba46cc1e0bd7ab496a45ecca2bb34f27686
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__7c681fc6a08524e2909b1c97c77ad38edec11b1f8bd3f666a073a61c09638e19(
+    value: typing.Optional[_PolicyDocument_3ac34393],
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__097767ff78845d4b738433212bfcf5a1c0221ad14d190faa8e3494ba577c4431(
     *,
     read_capacity: Capacity,
@@ -15626,6 +15924,7 @@ def _typecheckingstub__7500a741eaeb840f48aaefcd8fc5fbbb8b1082165601116ca363e5ddb
     deletion_protection: typing.Optional[builtins.bool] = None,
     kinesis_stream: typing.Optional[_IStream_4e2457d2] = None,
     point_in_time_recovery: typing.Optional[builtins.bool] = None,
+    resource_policy: typing.Optional[_PolicyDocument_3ac34393] = None,
     table_class: typing.Optional[TableClass] = None,
     tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     region: builtins.str,
@@ -15652,6 +15951,7 @@ def _typecheckingstub__b92f0ed514f00b57a2a41d754e55fe495d22b05b0ad4711b80ce00457
     removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
     replication_regions: typing.Optional[typing.Sequence[builtins.str]] = None,
     replication_timeout: typing.Optional[_Duration_4839e8c3] = None,
+    resource_policy: typing.Optional[_PolicyDocument_3ac34393] = None,
     stream: typing.Optional[StreamViewType] = None,
     table_class: typing.Optional[TableClass] = None,
     time_to_live_attribute: typing.Optional[builtins.str] = None,
@@ -15717,3 +16017,9 @@ def _typecheckingstub__9bf5dafcde17b7b65610795b8d251399ace67acb6de4e8ea9af3afe7b
 ) -> None:
     """Type checking stubs"""
     pass
+
+def _typecheckingstub__b85333b9f4a3ca55431a35f4006c1aeb1fcd34f68dee45d5355498d8a1b77806(
+    value: typing.Optional[_PolicyDocument_3ac34393],
+) -> None:
+    """Type checking stubs"""
+    pass