agent-claw: automated task changes

cdk/node_modules/aws-cdk-lib/aws-dynamodb/.jsiirc.json

@@ -0,0 +1,13 @@
+{
+  "targets": {
+    "java": {
+      "package": "software.amazon.awscdk.services.dynamodb"
+    },
+    "dotnet": {
+      "namespace": "Amazon.CDK.AWS.DynamoDB"
+    },
+    "python": {
+      "module": "aws_cdk.aws_dynamodb"
+    }
+  }
+}

cdk/node_modules/aws-cdk-lib/aws-dynamodb/TABLE_V1_API.md

@@ -0,0 +1,359 @@
+# Amazon DynamoDB Construct Library
+
+Here is a minimal deployable DynamoDB table definition:
+
+```ts
+const table = new dynamodb.Table(this, 'Table', {
+  partitionKey: { name: 'id', type: dynamodb.AttributeType.STRING },
+});
+```
+
+## Referencing existing tables
+
+To reference an existing table in your CDK application, use the `Table.fromTableName`, `Table.fromTableArn` or `Table.fromTableAttributes`
+factory method. This method accepts table name or table ARN which describes the properties of an already
+existing table:
+
+```ts
+declare const user: iam.User;
+const table = dynamodb.Table.fromTableArn(this, 'ImportedTable', 'arn:aws:dynamodb:us-east-1:111111111:table/my-table');
+// now you can just call methods on the table
+table.grantReadWriteData(user);
+```
+
+If you intend to use the `tableStreamArn` (including indirectly, for example by creating an
+`aws-cdk-lib/aws-lambda-event-sources.DynamoEventSource` on the referenced table), you *must* use the
+`Table.fromTableAttributes` method and the `tableStreamArn` property *must* be populated.
+
+To grant permissions to indexes on a referenced table you can either set `grantIndexPermissions` to `true`, or you can provide the indexes via the `globalIndexes` or `localIndexes` properties. This will enable `grant*` methods to also grant permissions to *all* table indexes.
+
+## Keys
+
+When a table is defined, you must define it's schema using the `partitionKey`
+(required) and `sortKey` (optional) properties.
+
+## Billing Mode
+
+DynamoDB supports two billing modes:
+
+* PROVISIONED - the default mode where the table and global secondary indexes have configured read and write capacity.
+* PAY_PER_REQUEST - on-demand pricing and scaling. You only pay for what you use and there is no read and write capacity for the table or its global secondary indexes.
+
+```ts
+const table = new dynamodb.Table(this, 'Table', {
+  partitionKey: { name: 'id', type: dynamodb.AttributeType.STRING },
+  billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
+});
+```
+
+You can specify a maximum read or write request units when using PAY_PER_REQUEST billing mode:
+
+```ts
+const table = new dynamodb.Table(this, 'Table', {
+  partitionKey: { name: 'id', type: dynamodb.AttributeType.STRING },
+  billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
+  maxReadRequestUnits: 100,
+  maxWriteRequestUnits: 200,
+});
+```
+
+Further reading:
+https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/HowItWorks.ReadWriteCapacityMode.
+
+## Warm Throughput
+Warm throughput refers to the number of read and write operations your DynamoDB table can instantaneously support.
+
+This optional configuration allows you to pre-warm your table or index to handle anticipated throughput, ensuring optimal performance under expected load.
+
+Note: The Warm Throughput feature is not available for Global Table replicas using `Table` construct; use the `TableV2` construct instead to enable this functionality.
+
+```ts
+const table = new dynamodb.Table(this, 'Table', {
+  partitionKey: { name: 'id', type: dynamodb.AttributeType.STRING },
+  warmThroughput: {
+      readUnitsPerSecond: 15000,
+      writeUnitsPerSecond: 20000,
+    },
+});
+```
+Further reading:
+https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/warm-throughput.html
+
+## Table Class
+
+DynamoDB supports two table classes:
+
+* STANDARD - the default mode, and is recommended for the vast majority of workloads.
+* STANDARD_INFREQUENT_ACCESS - optimized for tables where storage is the dominant cost.
+
+```ts
+const table = new dynamodb.Table(this, 'Table', {
+  partitionKey: { name: 'id', type: dynamodb.AttributeType.STRING },
+  tableClass: dynamodb.TableClass.STANDARD_INFREQUENT_ACCESS,
+});
+```
+
+Further reading:
+https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/HowItWorks.TableClasses.html
+
+## Configure AutoScaling for your table
+
+You can have DynamoDB automatically raise and lower the read and write capacities
+of your table by setting up autoscaling. You can use this to either keep your
+tables at a desired utilization level, or by scaling up and down at pre-configured
+times of the day:
+
+Auto-scaling is only relevant for tables with the billing mode, PROVISIONED.
+
+[Example of configuring autoscaling](test/integ.autoscaling.lit.ts)
+
+Further reading:
+https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/AutoScaling.html
+https://aws.amazon.com/blogs/database/how-to-use-aws-cloudformation-to-configure-auto-scaling-for-amazon-dynamodb-tables-and-indexes/
+
+## Amazon DynamoDB Global Tables
+
+You can create DynamoDB Global Tables by setting the `replicationRegions` property on a `Table`:
+
+```ts
+const globalTable = new dynamodb.Table(this, 'Table', {
+  partitionKey: { name: 'id', type: dynamodb.AttributeType.STRING },
+  replicationRegions: ['us-east-1', 'us-east-2', 'us-west-2'],
+});
+```
+
+When doing so, a CloudFormation Custom Resource will be added to the stack in order to create the replica tables in the
+selected regions.
+
+The default billing mode for Global Tables is `PAY_PER_REQUEST`.
+If you want to use `PROVISIONED`,
+you have to make sure write auto-scaling is enabled for that Table:
+
+```ts
+const globalTable = new dynamodb.Table(this, 'Table', {
+  partitionKey: { name: 'id', type: dynamodb.AttributeType.STRING },
+  replicationRegions: ['us-east-1', 'us-east-2', 'us-west-2'],
+  billingMode: dynamodb.BillingMode.PROVISIONED,
+});
+
+globalTable.autoScaleWriteCapacity({
+  minCapacity: 1,
+  maxCapacity: 10,
+}).scaleOnUtilization({ targetUtilizationPercent: 75 });
+```
+
+When adding a replica region for a large table, you might want to increase the
+timeout for the replication operation:
+
+```ts
+const globalTable = new dynamodb.Table(this, 'Table', {
+  partitionKey: { name: 'id', type: dynamodb.AttributeType.STRING },
+  replicationRegions: ['us-east-1', 'us-east-2', 'us-west-2'],
+  replicationTimeout: Duration.hours(2), // defaults to Duration.minutes(30)
+});
+```
+
+A maximum of 10 tables with replication can be added to a stack without a limit increase for
+[managed policies attached to an IAM role](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html#reference_iam-quotas-entities).
+This is because more than 10 managed policies will be attached to the DynamoDB service replication role - one policy per replication table.
+Consider splitting your tables across multiple stacks if your reach this limit.
+
+## Encryption
+
+All user data stored in Amazon DynamoDB is fully encrypted at rest. When creating a new table, you can choose to encrypt using the following customer master keys (CMK) to encrypt your table:
+
+* AWS owned CMK - By default, all tables are encrypted under an AWS owned customer master key (CMK) in the DynamoDB service account (no additional charges apply).
+* AWS managed CMK - AWS KMS keys (one per region) are created in your account, managed, and used on your behalf by AWS DynamoDB (AWS KMS charges apply).
+* Customer managed CMK - You have full control over the KMS key used to encrypt the DynamoDB Table (AWS KMS charges apply).
+
+Creating a Table encrypted with a customer managed CMK:
+
+```ts
+const table = new dynamodb.Table(this, 'MyTable', {
+  partitionKey: { name: 'id', type: dynamodb.AttributeType.STRING },
+  encryption: dynamodb.TableEncryption.CUSTOMER_MANAGED,
+});
+
+// You can access the CMK that was added to the stack on your behalf by the Table construct via:
+const tableEncryptionKey = table.encryptionKey;
+```
+
+You can also supply your own key:
+
+```ts
+import * as kms from 'aws-cdk-lib/aws-kms';
+
+const encryptionKey = new kms.Key(this, 'Key', {
+  enableKeyRotation: true,
+});
+const table = new dynamodb.Table(this, 'MyTable', {
+  partitionKey: { name: 'id', type: dynamodb.AttributeType.STRING },
+  encryption: dynamodb.TableEncryption.CUSTOMER_MANAGED,
+  encryptionKey, // This will be exposed as table.encryptionKey
+});
+```
+
+In order to use the AWS managed CMK instead, change the code to:
+
+```ts
+const table = new dynamodb.Table(this, 'MyTable', {
+  partitionKey: { name: 'id', type: dynamodb.AttributeType.STRING },
+  encryption: dynamodb.TableEncryption.AWS_MANAGED,
+});
+
+// In this case, the CMK _cannot_ be accessed through table.encryptionKey.
+```
+
+## Get schema of table or secondary indexes
+
+To get the partition key and sort key of the table or indexes you have configured:
+
+```ts
+declare const table: dynamodb.Table;
+
+// For single keys, use schema() (deprecated for multi-attribute keys)
+const schema = table.schema();
+const partitionKey = schema.partitionKey;
+const sortKey = schema.sortKey;
+
+// For multi-attribute keys, use schemaV2() which returns normalized arrays
+const schemaV2 = table.schemaV2();
+const partitionKeys = schemaV2.partitionKeys; // Attribute[]
+const sortKeys = schemaV2.sortKeys; // Attribute[]
+
+// Get schema for a specific index
+const indexSchema = table.schemaV2('INDEX_NAME');
+```
+
+Note: `schema()` is deprecated for indexes with multi-attribute keys and will throw an error. Use `schemaV2()` instead, which always returns normalized arrays.
+
+## Global Secondary Indexes with multi-attribute Keys
+
+Global secondary indexes support multi-attribute keys, allowing you to specify multiple partition keys and/or multiple sort keys. This enables more flexible query patterns for complex data models.
+
+**Key Constraints:**
+- You can specify up to **4 partition keys** per global secondary index
+- You can specify up to **4 sort keys** per global secondary index
+- Use **either** `partitionKey` (singular) **or** `partitionKeys` (plural), but not both
+- Use **either** `sortKey` (singular) **or** `sortKeys` (plural), but not both
+- At least one partition key must be specified (either `partitionKey` or `partitionKeys`)
+- For multiple keys, you **must** use the plural parameters (`partitionKeys` and/or `sortKeys`)
+- **Keys cannot be added or modified after index creation** - attempting to add additional keys to an existing index will result in an error
+
+**Example:**
+
+```ts
+const table = new dynamodb.Table(this, 'Table', {
+  partitionKey: { name: 'pk', type: dynamodb.AttributeType.STRING },
+  sortKey: { name: 'sk', type: dynamodb.AttributeType.STRING },
+});
+
+table.addGlobalSecondaryIndex({
+  indexName: 'multi-attribute-gsi',
+  partitionKeys: [
+    { name: 'gsi_pk1', type: dynamodb.AttributeType.STRING },
+    { name: 'gsi_pk2', type: dynamodb.AttributeType.NUMBER },
+  ],
+  sortKeys: [
+    { name: 'gsi_sk1', type: dynamodb.AttributeType.STRING },
+    { name: 'gsi_sk2', type: dynamodb.AttributeType.BINARY },
+  ],
+});
+```
+
+## Kinesis Stream
+
+A Kinesis Data Stream can be configured on the DynamoDB table to capture item-level changes.
+
+You can optionally configure the `kinesisPrecisionTimestamp` parameter to specify the precision level of the approximate creation date and time. The allowed values are `MICROSECOND` and `MILLISECOND`. If this parameter is not specified, the default precision is set to `MICROSECOND`.
+
+```ts
+import * as kinesis from 'aws-cdk-lib/aws-kinesis';
+
+const stream = new kinesis.Stream(this, 'Stream');
+
+const table = new dynamodb.Table(this, 'Table', {
+  partitionKey: { name: 'id', type: dynamodb.AttributeType.STRING },
+  kinesisStream: stream,
+});
+```
+
+## Alarm metrics
+
+Alarms can be configured on the DynamoDB table to captured metric data
+
+```ts
+import * as cloudwatch from 'aws-cdk-lib/aws-cloudwatch';
+
+const table = new dynamodb.Table(this, 'Table', {
+  partitionKey: { name: 'id', type: dynamodb.AttributeType.STRING },
+});
+
+const metric = table.metricThrottledRequestsForOperations({
+  operations: [dynamodb.Operation.PUT_ITEM],
+  period: Duration.minutes(1),
+});
+
+new cloudwatch.Alarm(this, 'Alarm', {
+  metric: metric,
+  evaluationPeriods: 1,
+  threshold: 1,
+});
+```
+
+## Deletion Protection for Tables
+
+You can enable deletion protection for a table by setting the `deletionProtection` property to `true`.
+When deletion protection is enabled for a table, it cannot be deleted by anyone. By default, deletion protection is disabled.
+
+```ts
+const table = new dynamodb.Table(this, 'Table', {
+  partitionKey: { name: 'id', type: dynamodb.AttributeType.STRING },
+  deletionProtection: true,
+});
+```
+## Resource Policy
+
+Using `resourcePolicy` you can add a [resource policy](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/access-control-resource-based.html) to a table in the form of a `PolicyDocument`:
+
+```ts
+const policy = new iam.PolicyDocument({
+  statements: [
+    new iam.PolicyStatement({
+      actions: ['dynamodb:GetItem'],
+      principals: [new iam.AccountRootPrincipal()],
+      resources: ['*'],
+    }),
+  ],
+});
+
+new dynamodb.Table(this, 'MyTable', {
+  partitionKey: {
+    name: 'id',
+    type: dynamodb.AttributeType.STRING,
+  },
+  removalPolicy: RemovalPolicy.DESTROY,
+  resourcePolicy: policy,
+});
+```
+
+If you have a global table replica, note that it does not support the addition of a resource-based policy.
+
+## Point-in-Time Recovery
+
+`pointInTimeRecoverySpecifcation` provides automatic backups of your DynamoDB table data which helps protect your tables from accidental write or delete operations.
+
+You can also choose to set `recoveryPeriodInDays` to a value between `1` and `35` which dictates how many days of recoverable data is stored. If no value is provided, the recovery period defaults to `35` days.
+
+```ts
+const table = new dynamodb.Table(this, 'Table', {
+  partitionKey: {
+    name: 'id',
+    type: dynamodb.AttributeType.STRING,
+  },
+  pointInTimeRecoverySpecification: {
+    pointInTimeRecoveryEnabled: true,
+    recoveryPeriodInDays: 4,
+  },
+});
+```

cdk/node_modules/aws-cdk-lib/aws-dynamodb/adr/index.md

@@ -0,0 +1,28 @@
+# Architecture Design Record for TableV2
+
+## Title: Implementing grants for TableV2
+
+### Status
+
+Accepted.
+
+### Context
+
+By default, TableV2 will create a table in the region that its parent stack is deployed to. This table can be referred to as the primary table. The API design for the TableV2 construct allows a user to add and configure additional replica tables. As a result, grants for TableV2 could be implemented in two ways:<br>
+1. Grants for TableV2 will propagate and be applied to the primary table and all replica tables.
+2. Grants for TableV2 will only apply to the primary table.
+
+### Decision
+
+After considering the two choices for implementing grants for TableV2, it was decided that a grant should only apply to the primary table.
+
+### Considerations
+
+We have decided to implement grants for TableV2 such that they only apply to the primary table for the following reasons:<br>
+1. Implementing grants to apply to all replica tables would contradict the implementation of metrics which only apply to the primary table. This would result in a confusing user experience due to behavioral differences between metrics and grants which are both defined on the ITable interface.
+2. Applying grants to all replica tables and all associated customer-managed KMS keys is counter to the principal of least privilege. Permissions may be given for keys and replica tables that a user is not intending permissions to be given for.
+3. The TableV2 API offers users a replica method that can be used to work with an individual instance of a replica table. This can be used to apply grants on a per-replica basis if needed, but this decision should be made by the user.
+
+### Consequences
+
+Some users may expect grants to apply to all replica tables (see: https://github.com/aws/aws-cdk/issues/7362). However, unlike the Table L2 that is replaced by the TableV2 L2, the TableV2 API offers users the replica method as a way to work with individual replica tables. Additionally, the TableV2 API design can support the future implementation of a method allowing a user to retrieve a list of all replica tables. A user could then iterate over each replica table and apply grants each one individually. This design decision supports both use cases while upholding the principle of least privilege.

cdk/node_modules/aws-cdk-lib/aws-dynamodb/index.d.ts

@@ -0,0 +1 @@
+export * from './lib';

cdk/node_modules/aws-cdk-lib/aws-dynamodb/lib/billing.d.ts

@@ -0,0 +1,62 @@
+import type { Capacity } from './capacity';
+import { BillingMode } from './shared';
+/**
+ * Properties used to configure provisioned throughput for a DynamoDB table.
+ */
+export interface ThroughputProps {
+    /**
+     * The read capacity.
+     */
+    readonly readCapacity: Capacity;
+    /**
+     * The write capacity.
+     */
+    readonly writeCapacity: Capacity;
+}
+/**
+ * Properties used to configure maximum throughput for an on-demand table.
+ */
+export interface MaxThroughputProps {
+    /**
+     * The max read request units.
+     * @default - if table mode is on-demand and this property is undefined,
+     * no maximum throughput limit will be put in place for read requests.
+     * This property is only applicable for tables using on-demand mode.
+     */
+    readonly maxReadRequestUnits?: number;
+    /**
+     * The max write request units.
+     * @default - if table mode is on-demand and this property is undefined,
+     * no maximum throughput limit will be put in place for write requests.
+     * This property is only applicable for tables using on-demand mode.
+     */
+    readonly maxWriteRequestUnits?: number;
+}
+/**
+ * Represents how capacity is managed and how you are charged for read and write throughput
+ * for a DynamoDB table.
+ */
+export declare abstract class Billing {
+    readonly mode: BillingMode;
+    /**
+     * Flexible billing option capable of serving requests without capacity planning.
+     *
+     * Note: Billing mode will be PAY_PER_REQUEST.
+     */
+    static onDemand(props?: MaxThroughputProps): Billing;
+    /**
+     * Specify the number of reads and writes per second that you need for your application.
+     *
+     * @param props specify read and write capacity configurations.
+     */
+    static provisioned(props: ThroughputProps): Billing;
+    private constructor();
+    /**
+     * @internal
+     */
+    abstract _renderReadCapacity(): any;
+    /**
+     * @internal
+     */
+    abstract _renderWriteCapacity(): any;
+}

cdk/node_modules/aws-cdk-lib/aws-dynamodb/lib/billing.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.Billing=void 0;var jsiiDeprecationWarnings=()=>{var tmp=require("../../.warnings.jsii.js");return jsiiDeprecationWarnings=()=>tmp,tmp};const JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti");var shared_1=()=>{var tmp=require("./shared");return shared_1=()=>tmp,tmp};class Billing{mode;static[JSII_RTTI_SYMBOL_1]={fqn:"aws-cdk-lib.aws_dynamodb.Billing",version:"2.252.0"};static onDemand(props){try{jsiiDeprecationWarnings().aws_cdk_lib_aws_dynamodb_MaxThroughputProps(props)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.onDemand),error}return new class extends Billing{_renderReadCapacity(){return props?.maxReadRequestUnits}_renderWriteCapacity(){return props?.maxWriteRequestUnits}}(shared_1().BillingMode.PAY_PER_REQUEST)}static provisioned(props){try{jsiiDeprecationWarnings().aws_cdk_lib_aws_dynamodb_ThroughputProps(props)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.provisioned),error}return new class extends Billing{_renderReadCapacity(){return props.readCapacity._renderReadCapacity()}_renderWriteCapacity(){return props.writeCapacity._renderWriteCapacity()}}(shared_1().BillingMode.PROVISIONED)}constructor(mode){this.mode=mode}}exports.Billing=Billing;

cdk/node_modules/aws-cdk-lib/aws-dynamodb/lib/capacity.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Capacity modes
+ */
+export declare enum CapacityMode {
+    /**
+     * Fixed
+     */
+    FIXED = "FIXED",
+    /**
+     * Autoscaled
+     */
+    AUTOSCALED = "AUTOSCALED"
+}
+/**
+ * Options used to configure autoscaled capacity.
+ */
+export interface AutoscaledCapacityOptions {
+    /**
+     * The maximum allowable capacity.
+     */
+    readonly maxCapacity: number;
+    /**
+     * The minimum allowable capacity.
+     *
+     * @default 1
+     */
+    readonly minCapacity?: number;
+    /**
+     * The ratio of consumed capacity units to provisioned capacity units.
+     *
+     * Note: Target utilization percent cannot be less than 20 and cannot be greater
+     * than 90.
+     *
+     * @default 70
+     */
+    readonly targetUtilizationPercent?: number;
+    /**
+     * If you want to switch a table's billing mode from on-demand to provisioned or
+     * from provisioned to on-demand, you must specify a value for this property for
+     * each autoscaled resource.
+     *
+     * @default no seed capacity
+     */
+    readonly seedCapacity?: number;
+}
+/**
+ * Represents the amount of read and write operations supported by a DynamoDB table.
+ */
+export declare abstract class Capacity {
+    readonly mode: CapacityMode;
+    /**
+     * Provisioned throughput capacity is configured with fixed capacity units.
+     *
+     * Note: You cannot configure write capacity using fixed capacity mode.
+     *
+     * @param iops the number of I/O operations per second.
+     */
+    static fixed(iops: number): Capacity;
+    /**
+     * Dynamically adjusts provisioned throughput capacity on your behalf in response to actual
+     * traffic patterns.
+     *
+     * @param options options used to configure autoscaled capacity mode.
+     */
+    static autoscaled(options: AutoscaledCapacityOptions): Capacity;
+    private constructor();
+    /**
+     * @internal
+     */
+    abstract _renderReadCapacity(): any;
+    /**
+     * @internal
+     */
+    abstract _renderWriteCapacity(): any;
+}

cdk/node_modules/aws-cdk-lib/aws-dynamodb/lib/capacity.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.Capacity=exports.CapacityMode=void 0;var jsiiDeprecationWarnings=()=>{var tmp=require("../../.warnings.jsii.js");return jsiiDeprecationWarnings=()=>tmp,tmp};const JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti");var core_1=()=>{var tmp=require("../../core");return core_1=()=>tmp,tmp},literal_string_1=()=>{var tmp=require("../../core/lib/private/literal-string");return literal_string_1=()=>tmp,tmp},CapacityMode;(function(CapacityMode2){CapacityMode2.FIXED="FIXED",CapacityMode2.AUTOSCALED="AUTOSCALED"})(CapacityMode||(exports.CapacityMode=CapacityMode={}));class Capacity{mode;static[JSII_RTTI_SYMBOL_1]={fqn:"aws-cdk-lib.aws_dynamodb.Capacity",version:"2.252.0"};static fixed(iops){return new class extends Capacity{_renderReadCapacity(){return{readCapacityUnits:iops}}_renderWriteCapacity(){throw new(core_1()).UnscopedValidationError((0,literal_string_1().lit)`CannotConfigureWritecapacityCapacity`,`You cannot configure 'writeCapacity' with ${CapacityMode.FIXED} capacity mode`)}}(CapacityMode.FIXED)}static autoscaled(options){try{jsiiDeprecationWarnings().aws_cdk_lib_aws_dynamodb_AutoscaledCapacityOptions(options)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.autoscaled),error}return new class extends Capacity{constructor(mode){if(super(mode),(options.minCapacity??1)>options.maxCapacity)throw new(core_1()).UnscopedValidationError((0,literal_string_1().lit)`MustBeLessThanEqual`,"`minCapacity` must be less than or equal to `maxCapacity`");if(options.targetUtilizationPercent!==void 0&&(options.targetUtilizationPercent<20||options.targetUtilizationPercent>90))throw new(core_1()).UnscopedValidationError((0,literal_string_1().lit)`TargetUtilizationPercentCannotLess`,"`targetUtilizationPercent` cannot be less than 20 or greater than 90");if(options.seedCapacity!==void 0&&options.seedCapacity<1)throw new(core_1()).UnscopedValidationError((0,literal_string_1().lit)`SeedcapacityCannotLessThan`,`'seedCapacity' cannot be less than 1 - received ${options.seedCapacity}`)}_renderReadCapacity(){return{readCapacityAutoScalingSettings:this.renderAutoscaledCapacity()}}_renderWriteCapacity(){return{writeCapacityAutoScalingSettings:this.renderAutoscaledCapacity()}}renderAutoscaledCapacity(){return{minCapacity:options.minCapacity??1,maxCapacity:options.maxCapacity,seedCapacity:options.seedCapacity,targetTrackingScalingPolicyConfiguration:{targetValue:options.targetUtilizationPercent??70}}}}(CapacityMode.AUTOSCALED)}constructor(mode){this.mode=mode}}exports.Capacity=Capacity;

cdk/node_modules/aws-cdk-lib/aws-dynamodb/lib/dynamodb-canned-metrics.generated.d.ts

@@ -0,0 +1,563 @@
+export interface MetricWithDims<D> {
+    readonly namespace: string;
+    readonly metricName: string;
+    readonly statistic: string;
+    readonly dimensionsMap: D;
+}
+export declare class DynamoDBMetrics {
+    static conditionalCheckFailedRequestsSum(this: void, dimensions: {
+        TableName: string;
+    }): MetricWithDims<{
+        TableName: string;
+    }>;
+    static consumedReadCapacityUnitsSum(this: void, dimensions: {
+        TableName: string;
+    }): MetricWithDims<{
+        TableName: string;
+    }>;
+    static consumedReadCapacityUnitsSum(this: void, dimensions: {
+        TableName: string;
+        GlobalSecondaryIndexName: string;
+    }): MetricWithDims<{
+        TableName: string;
+        GlobalSecondaryIndexName: string;
+    }>;
+    static consumedWriteCapacityUnitsSum(this: void, dimensions: {
+        TableName: string;
+    }): MetricWithDims<{
+        TableName: string;
+    }>;
+    static consumedWriteCapacityUnitsSum(this: void, dimensions: {
+        TableName: string;
+        GlobalSecondaryIndexName: string;
+    }): MetricWithDims<{
+        TableName: string;
+        GlobalSecondaryIndexName: string;
+    }>;
+    static provisionedReadCapacityUnitsAverage(this: void, dimensions: {
+        TableName: string;
+    }): MetricWithDims<{
+        TableName: string;
+    }>;
+    static provisionedReadCapacityUnitsAverage(this: void, dimensions: {
+        TableName: string;
+        GlobalSecondaryIndexName: string;
+    }): MetricWithDims<{
+        TableName: string;
+        GlobalSecondaryIndexName: string;
+    }>;
+    static provisionedWriteCapacityUnitsAverage(this: void, dimensions: {
+        TableName: string;
+    }): MetricWithDims<{
+        TableName: string;
+    }>;
+    static provisionedWriteCapacityUnitsAverage(this: void, dimensions: {
+        TableName: string;
+        GlobalSecondaryIndexName: string;
+    }): MetricWithDims<{
+        TableName: string;
+        GlobalSecondaryIndexName: string;
+    }>;
+    static readThrottleEventsSum(this: void, dimensions: {
+        TableName: string;
+    }): MetricWithDims<{
+        TableName: string;
+    }>;
+    static readThrottleEventsSum(this: void, dimensions: {
+        TableName: string;
+        GlobalSecondaryIndexName: string;
+    }): MetricWithDims<{
+        TableName: string;
+        GlobalSecondaryIndexName: string;
+    }>;
+    static timeToLiveDeletedItemCountSum(this: void, dimensions: {
+        TableName: string;
+    }): MetricWithDims<{
+        TableName: string;
+    }>;
+    static transactionConflictAverage(this: void, dimensions: {
+        TableName: string;
+    }): MetricWithDims<{
+        TableName: string;
+    }>;
+    static writeThrottleEventsSum(this: void, dimensions: {
+        TableName: string;
+    }): MetricWithDims<{
+        TableName: string;
+    }>;
+    static writeThrottleEventsSum(this: void, dimensions: {
+        TableName: string;
+        GlobalSecondaryIndexName: string;
+    }): MetricWithDims<{
+        TableName: string;
+        GlobalSecondaryIndexName: string;
+    }>;
+    static returnedItemCountSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static returnedItemCountSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static returnedItemCountSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static returnedItemCountSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static returnedItemCountSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static returnedItemCountSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static returnedItemCountSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static returnedItemCountSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static returnedItemCountSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static returnedItemCountSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static returnedItemCountSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static returnedItemCountSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static returnedItemCountSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static successfulRequestLatencyAverage(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static successfulRequestLatencyAverage(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static successfulRequestLatencyAverage(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static successfulRequestLatencyAverage(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static successfulRequestLatencyAverage(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static successfulRequestLatencyAverage(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static successfulRequestLatencyAverage(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static successfulRequestLatencyAverage(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static successfulRequestLatencyAverage(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static successfulRequestLatencyAverage(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static successfulRequestLatencyAverage(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static successfulRequestLatencyAverage(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static successfulRequestLatencyAverage(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static successfulRequestLatencyAverage(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static systemErrorsSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static systemErrorsSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static systemErrorsSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static systemErrorsSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static systemErrorsSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static systemErrorsSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static systemErrorsSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static systemErrorsSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static systemErrorsSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static systemErrorsSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static systemErrorsSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static systemErrorsSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static systemErrorsSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static systemErrorsSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static throttledRequestsSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static throttledRequestsSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static throttledRequestsSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static throttledRequestsSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static throttledRequestsSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static throttledRequestsSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static throttledRequestsSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static throttledRequestsSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static throttledRequestsSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static throttledRequestsSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static throttledRequestsSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static throttledRequestsSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static throttledRequestsSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static throttledRequestsSum(this: void, dimensions: {
+        TableName: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        Operation: string;
+    }>;
+    static onlineIndexConsumedWriteCapacitySum(this: void, dimensions: {
+        TableName: string;
+        GlobalSecondaryIndexName: string;
+    }): MetricWithDims<{
+        TableName: string;
+        GlobalSecondaryIndexName: string;
+    }>;
+    static onlineIndexPercentageProgressAverage(this: void, dimensions: {
+        TableName: string;
+        GlobalSecondaryIndexName: string;
+    }): MetricWithDims<{
+        TableName: string;
+        GlobalSecondaryIndexName: string;
+    }>;
+    static onlineIndexThrottleEventsSum(this: void, dimensions: {
+        TableName: string;
+        GlobalSecondaryIndexName: string;
+    }): MetricWithDims<{
+        TableName: string;
+        GlobalSecondaryIndexName: string;
+    }>;
+    static ageOfOldestUnreplicatedRecordAverage(this: void, dimensions: {
+        TableName: string;
+        DelegatedOperation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        DelegatedOperation: string;
+    }>;
+    static consumedChangeDataCaptureUnitsAverage(this: void, dimensions: {
+        TableName: string;
+        DelegatedOperation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        DelegatedOperation: string;
+    }>;
+    static throttledPutRecordCountAverage(this: void, dimensions: {
+        TableName: string;
+        DelegatedOperation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        DelegatedOperation: string;
+    }>;
+    static pendingReplicationCountAverage(this: void, dimensions: {
+        TableName: string;
+        ReceivingRegion: string;
+    }): MetricWithDims<{
+        TableName: string;
+        ReceivingRegion: string;
+    }>;
+    static replicationLatencyAverage(this: void, dimensions: {
+        TableName: string;
+        ReceivingRegion: string;
+    }): MetricWithDims<{
+        TableName: string;
+        ReceivingRegion: string;
+    }>;
+    static returnedBytesAverage(this: void, dimensions: {
+        TableName: string;
+        StreamLabel: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        StreamLabel: string;
+        Operation: string;
+    }>;
+    static returnedRecordsCountAverage(this: void, dimensions: {
+        TableName: string;
+        StreamLabel: string;
+        Operation: string;
+    }): MetricWithDims<{
+        TableName: string;
+        StreamLabel: string;
+        Operation: string;
+    }>;
+    static accountMaxReadsMaximum(this: void, dimensions: {}): MetricWithDims<{}>;
+    static accountMaxTableLevelReadsMaximum(this: void, dimensions: {}): MetricWithDims<{}>;
+    static accountMaxTableLevelWritesMaximum(this: void, dimensions: {}): MetricWithDims<{}>;
+    static accountMaxWritesMaximum(this: void, dimensions: {}): MetricWithDims<{}>;
+    static accountProvisionedReadCapacityUtilizationAverage(this: void, dimensions: {}): MetricWithDims<{}>;
+    static accountProvisionedWriteCapacityUtilizationAverage(this: void, dimensions: {}): MetricWithDims<{}>;
+    static maxProvisionedTableReadCapacityUtilizationAverage(this: void, dimensions: {}): MetricWithDims<{}>;
+    static maxProvisionedTableWriteCapacityUtilizationAverage(this: void, dimensions: {}): MetricWithDims<{}>;
+    static userErrorsSum(this: void, dimensions: {}): MetricWithDims<{}>;
+}

cdk/node_modules/aws-cdk-lib/aws-dynamodb/lib/encryption.d.ts

@@ -0,0 +1,39 @@
+import type { Construct } from 'constructs';
+import { TableEncryption } from './shared';
+import type { IKey } from '../../aws-kms';
+/**
+ * Represents server-side encryption for a DynamoDB table.
+ */
+export declare abstract class TableEncryptionV2 {
+    readonly type: TableEncryption;
+    readonly tableKey?: IKey | undefined;
+    readonly replicaKeyArns?: {
+        [region: string]: string;
+    } | undefined;
+    /**
+     * Configure server-side encryption using a DynamoDB owned key.
+     */
+    static dynamoOwnedKey(): TableEncryptionV2;
+    /**
+     * Configure server-side encryption using an AWS managed key.
+     */
+    static awsManagedKey(): TableEncryptionV2;
+    /**
+     * Configure server-side encryption using customer managed keys.
+     *
+     * @param tableKey the KMS key for the primary table.
+     * @param replicaKeyArns an object containing the ARN of the KMS key to use for each replica table.
+     */
+    static customerManagedKey(tableKey: IKey, replicaKeyArns?: {
+        [region: string]: string;
+    }): TableEncryptionV2;
+    private constructor();
+    /**
+     * @internal
+     */
+    abstract _renderSseSpecification(): any;
+    /**
+     * @internal
+     */
+    abstract _renderReplicaSseSpecification(scope: Construct, region: string): any;
+}

cdk/node_modules/aws-cdk-lib/aws-dynamodb/lib/encryption.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.TableEncryptionV2=void 0;var jsiiDeprecationWarnings=()=>{var tmp=require("../../.warnings.jsii.js");return jsiiDeprecationWarnings=()=>tmp,tmp};const JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti");var shared_1=()=>{var tmp=require("./shared");return shared_1=()=>tmp,tmp},core_1=()=>{var tmp=require("../../core");return core_1=()=>tmp,tmp},literal_string_1=()=>{var tmp=require("../../core/lib/private/literal-string");return literal_string_1=()=>tmp,tmp};class TableEncryptionV2{type;tableKey;replicaKeyArns;static[JSII_RTTI_SYMBOL_1]={fqn:"aws-cdk-lib.aws_dynamodb.TableEncryptionV2",version:"2.252.0"};static dynamoOwnedKey(){return new class extends TableEncryptionV2{_renderSseSpecification(){return{sseEnabled:!1}}_renderReplicaSseSpecification(_scope,_region){}}(shared_1().TableEncryption.DEFAULT)}static awsManagedKey(){return new class extends TableEncryptionV2{_renderSseSpecification(){return{sseEnabled:!0,sseType:"KMS"}}_renderReplicaSseSpecification(_scope,_region){}}(shared_1().TableEncryption.AWS_MANAGED)}static customerManagedKey(tableKey,replicaKeyArns={}){try{jsiiDeprecationWarnings().aws_cdk_lib_aws_kms_IKey(tableKey)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.customerManagedKey),error}return new class extends TableEncryptionV2{_renderSseSpecification(){return{sseEnabled:!0,sseType:"KMS"}}_renderReplicaSseSpecification(scope,replicaRegion){const stackRegion=core_1().Stack.of(scope).region;if(core_1().Token.isUnresolved(stackRegion))throw new(core_1()).ValidationError((0,literal_string_1().lit)`ReplicaSpecificationCannotRenderedRegion`,"Replica SSE specification cannot be rendered in a region agnostic stack",scope);if(replicaKeyArns.hasOwnProperty(stackRegion))throw new(core_1()).ValidationError((0,literal_string_1().lit)`DeploymentRegionCannotDefined`,`KMS key for deployment region ${stackRegion} cannot be defined in 'replicaKeyArns'`,scope);if(replicaRegion===stackRegion)return{kmsMasterKeyId:tableKey.keyArn};if(!replicaKeyArns.hasOwnProperty(replicaRegion))throw new(core_1()).ValidationError((0,literal_string_1().lit)`FoundReplicakeyarns`,`KMS key for ${replicaRegion} was not found in 'replicaKeyArns'`,scope);return{kmsMasterKeyId:replicaKeyArns[replicaRegion]}}}(shared_1().TableEncryption.CUSTOMER_MANAGED,tableKey,replicaKeyArns)}constructor(type,tableKey,replicaKeyArns){this.type=type,this.tableKey=tableKey,this.replicaKeyArns=replicaKeyArns}}exports.TableEncryptionV2=TableEncryptionV2;

cdk/node_modules/aws-cdk-lib/aws-dynamodb/lib/index.d.ts

@@ -0,0 +1,12 @@
+import './private/default-traits';
+export * from './dynamodb.generated';
+export * from './table';
+export * from './scalable-attribute-api';
+export * from './table-v2';
+export * from './table-v2-base';
+export * from './shared';
+export * from './capacity';
+export * from './billing';
+export * from './encryption';
+export * from './table-grants';
+export * from './stream-grants';

cdk/node_modules/aws-cdk-lib/aws-dynamodb/lib/perms.d.ts

@@ -0,0 +1,9 @@
+export declare const RESOURCE_READ_DATA_ACTIONS: string[];
+export declare const PRINCIPAL_ONLY_READ_DATA_ACTIONS: string[];
+export declare const READ_DATA_ACTIONS: string[];
+export declare const KEY_READ_ACTIONS: string[];
+export declare const WRITE_DATA_ACTIONS: string[];
+export declare const KEY_WRITE_ACTIONS: string[];
+export declare const READ_STREAM_DATA_ACTIONS: string[];
+export declare const MULTI_ACCOUNT_REPLICATION_ACTIONS: string[];
+export declare const DESCRIBE_TABLE = "dynamodb:DescribeTable";

cdk/node_modules/aws-cdk-lib/aws-dynamodb/lib/perms.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.DESCRIBE_TABLE=exports.MULTI_ACCOUNT_REPLICATION_ACTIONS=exports.READ_STREAM_DATA_ACTIONS=exports.KEY_WRITE_ACTIONS=exports.WRITE_DATA_ACTIONS=exports.KEY_READ_ACTIONS=exports.READ_DATA_ACTIONS=exports.PRINCIPAL_ONLY_READ_DATA_ACTIONS=exports.RESOURCE_READ_DATA_ACTIONS=void 0,exports.RESOURCE_READ_DATA_ACTIONS=["dynamodb:BatchGetItem","dynamodb:Query","dynamodb:GetItem","dynamodb:Scan","dynamodb:ConditionCheckItem"],exports.PRINCIPAL_ONLY_READ_DATA_ACTIONS=["dynamodb:GetRecords","dynamodb:GetShardIterator"],exports.READ_DATA_ACTIONS=[...exports.RESOURCE_READ_DATA_ACTIONS,...exports.PRINCIPAL_ONLY_READ_DATA_ACTIONS],exports.KEY_READ_ACTIONS=["kms:Decrypt","kms:DescribeKey"],exports.WRITE_DATA_ACTIONS=["dynamodb:BatchWriteItem","dynamodb:PutItem","dynamodb:UpdateItem","dynamodb:DeleteItem"],exports.KEY_WRITE_ACTIONS=["kms:Encrypt","kms:ReEncrypt*","kms:GenerateDataKey*"],exports.READ_STREAM_DATA_ACTIONS=["dynamodb:DescribeStream","dynamodb:GetRecords","dynamodb:GetShardIterator"],exports.MULTI_ACCOUNT_REPLICATION_ACTIONS=["dynamodb:ReadDataForReplication","dynamodb:WriteDataForReplication","dynamodb:ReplicateSettings"],exports.DESCRIBE_TABLE="dynamodb:DescribeTable";

cdk/node_modules/aws-cdk-lib/aws-dynamodb/lib/private/default-traits.d.ts

@@ -0,0 +1 @@
+export {};

cdk/node_modules/aws-cdk-lib/aws-dynamodb/lib/private/default-traits.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var aws_iam_1=()=>{var tmp=require("../../../aws-iam");return aws_iam_1=()=>tmp,tmp},aws_kms_1=()=>{var tmp=require("../../../aws-kms");return aws_kms_1=()=>tmp,tmp},cfn_key_matcher_1=()=>{var tmp=require("../../../aws-kms/lib/private/cfn-key-matcher");return cfn_key_matcher_1=()=>tmp,tmp},core_1=()=>{var tmp=require("../../../core");return core_1=()=>tmp,tmp},helpers_internal_1=()=>{var tmp=require("../../../core/lib/helpers-internal");return helpers_internal_1=()=>tmp,tmp},literal_string_1=()=>{var tmp=require("../../../core/lib/private/literal-string");return literal_string_1=()=>tmp,tmp},dynamodb_generated_1=()=>{var tmp=require("../dynamodb.generated");return dynamodb_generated_1=()=>tmp,tmp};class TablePolicyFactory{forResource(resource){if(!dynamodb_generated_1().CfnTable.isCfnTable(resource))throw new(core_1()).ValidationError((0,literal_string_1().lit)`Construct`,`Construct ${resource.node.path} is not of type CfnTable`,resource);return new CfnTableWithPolicy(resource)}}class CfnTableWithPolicy{table;env;policyDocument;constructor(table){this.table=table,this.env=table.env}addToResourcePolicy(statement){if(!this.policyDocument)if(core_1().Token.isResolved(this.table.resourcePolicy))this.policyDocument=aws_iam_1().PolicyDocument.fromJson(this.table.resourcePolicy?.policyDocument??{Statement:[]});else return{statementAdded:!1};return this.policyDocument.addStatements(statement),this.table.resourcePolicy={policyDocument:this.policyDocument.toJSON()},{statementAdded:!0,policyDependable:this.table}}}class EncryptedTableFactory{forResource(resource){if(!dynamodb_generated_1().CfnTable.isCfnTable(resource))throw new(core_1()).ValidationError((0,literal_string_1().lit)`Construct`,`Construct ${resource.node.path} is not of type CfnTable`,resource);return new EncryptedCfnTable(resource)}}class EncryptedCfnTable{table;env;constructor(table){this.table=table,this.env=table.env}grantOnKey(grantee,...actions){const key=tryFindKmsKeyForTable(this.table);return{grant:key?aws_kms_1().KeyGrants.fromKey(key).actions(grantee,...actions):void 0}}}function tryFindKmsKeyForTable(table){const cfnTable=tryFindTableConstruct(table),kmsMasterKeyId=cfnTable?.sseSpecification&&cfnTable.sseSpecification.kmsMasterKeyId;if(kmsMasterKeyId)return helpers_internal_1().ConstructReflection.of(table).findRelatedCfnResource(new(cfn_key_matcher_1()).CfnKeyMatcher(kmsMasterKeyId))}function tryFindTableConstruct(table){return helpers_internal_1().ConstructReflection.of(table).findCfnResource({cfnResourceType:"AWS::DynamoDB::Table",matches:cfn=>table.tableRef==cfn.tableRef})}aws_iam_1().DefaultPolicyFactories.set("AWS::DynamoDB::Table",new TablePolicyFactory),aws_iam_1().DefaultEncryptedResourceFactories.set("AWS::DynamoDB::Table",new EncryptedTableFactory);

cdk/node_modules/aws-cdk-lib/aws-dynamodb/lib/private/principal-utils.d.ts

@@ -0,0 +1,12 @@
+import type { IPrincipal } from '../../../aws-iam';
+/**
+ * Returns true if the principal resolves to a Service principal in the policy document.
+ * Checks the policyFragment output to handle wrapped principals
+ * (e.g. PrincipalWithConditions, SessionTagsPrincipal).
+ */
+export declare function isServicePrincipal(principal: IPrincipal): boolean;
+/**
+ * Returns true if the principal is a service principal whose service name
+ * is NOT in the known-valid allowlist for DynamoDB resource policies.
+ */
+export declare function isUnsupportedServicePrincipal(principal: IPrincipal): boolean;

cdk/node_modules/aws-cdk-lib/aws-dynamodb/lib/private/principal-utils.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.isServicePrincipal=isServicePrincipal,exports.isUnsupportedServicePrincipal=isUnsupportedServicePrincipal;var aws_iam_1=()=>{var tmp=require("../../../aws-iam");return aws_iam_1=()=>tmp,tmp};const KNOWN_DYNAMODB_SERVICE_PRINCIPALS=new Set(["redshift.amazonaws.com","replication.dynamodb.amazonaws.com","glue.amazonaws.com"]);function isServicePrincipal(principal){return"Service"in principal.policyFragment.principalJson}function isUnsupportedServicePrincipal(principal){if(!isServicePrincipal(principal))return!1;const serviceName=extractServiceName(principal);return serviceName===void 0||!KNOWN_DYNAMODB_SERVICE_PRINCIPALS.has(serviceName)}function extractServiceName(principal){if(principal instanceof aws_iam_1().ServicePrincipal)return principal.service;const inner=principal.wrapped;if(inner!=null)return extractServiceName(inner)}

cdk/node_modules/aws-cdk-lib/aws-dynamodb/lib/replica-provider.d.ts

@@ -0,0 +1,50 @@
+import type { Construct } from 'constructs';
+import * as lambda from '../../aws-lambda';
+import { Duration, NestedStack } from '../../core';
+import * as cr from '../../custom-resources';
+/**
+ * Properties for a ReplicaProvider
+ */
+export interface ReplicaProviderProps {
+    /**
+     * The table name
+     *
+     */
+    readonly tableName: string;
+    /**
+     * Regions where replica tables will be created
+     *
+     */
+    readonly regions: string[];
+    /**
+     * The timeout for the replication operation.
+     *
+     * @default Duration.minutes(30)
+     */
+    readonly timeout?: Duration;
+    /**
+     * Disable logging for provider
+     *
+     * @default true
+     */
+    readonly disableLogging?: boolean;
+}
+export declare class ReplicaProvider extends NestedStack {
+    /**
+     * Creates a stack-singleton resource provider nested stack.
+     */
+    static getOrCreate(scope: Construct, props: ReplicaProviderProps): ReplicaProvider;
+    /**
+     * The custom resource provider.
+     */
+    readonly provider: cr.Provider;
+    /**
+     * The onEvent handler
+     */
+    readonly onEventHandler: lambda.Function;
+    /**
+     * The isComplete handler
+     */
+    readonly isCompleteHandler: lambda.Function;
+    private constructor();
+}

cdk/node_modules/aws-cdk-lib/aws-dynamodb/lib/replica-provider.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.ReplicaProvider=void 0;var iam=()=>{var tmp=require("../../aws-iam");return iam=()=>tmp,tmp},lambda=()=>{var tmp=require("../../aws-lambda");return lambda=()=>tmp,tmp},core_1=()=>{var tmp=require("../../core");return core_1=()=>tmp,tmp},replica_provider_generated_1=()=>{var tmp=require("../../custom-resource-handlers/dist/aws-dynamodb/replica-provider.generated");return replica_provider_generated_1=()=>tmp,tmp},cr=()=>{var tmp=require("../../custom-resources");return cr=()=>tmp,tmp};class ReplicaProvider extends core_1().NestedStack{static getOrCreate(scope,props){const stack=core_1().Stack.of(scope),uid="@aws-cdk/aws-dynamodb.ReplicaProvider";return stack.node.tryFindChild(uid)??new ReplicaProvider(stack,uid,props)}provider;onEventHandler;isCompleteHandler;constructor(scope,id,props){super(scope,id),this.onEventHandler=new(replica_provider_generated_1()).ReplicaOnEventFunction(this,"OnEventHandler",{timeout:core_1().Duration.minutes(5)}),this.isCompleteHandler=new(replica_provider_generated_1()).ReplicaIsCompleteFunction(this,"IsCompleteHandler",{timeout:core_1().Duration.seconds(30)}),this.onEventHandler.addToRolePolicy(new(iam()).PolicyStatement({actions:["iam:CreateServiceLinkedRole"],resources:[core_1().Stack.of(this).formatArn({service:"iam",region:"",resource:"role",resourceName:"aws-service-role/replication.dynamodb.amazonaws.com/AWSServiceRoleForDynamoDBReplication"})]})),this.onEventHandler.addToRolePolicy(new(iam()).PolicyStatement({actions:["dynamodb:DescribeLimits"],resources:["*"]}));let resources=[];props.regions.forEach(region=>{resources.push(`arn:${core_1().Aws.PARTITION}:dynamodb:${region}:${this.account}:table/${props.tableName}`)}),this.onEventHandler.addToRolePolicy(new(iam()).PolicyStatement({actions:["dynamodb:DeleteTable","dynamodb:DeleteTableReplica"],resources}));const disableLogging=props.disableLogging??!0;this.provider=new(cr()).Provider(this,"Provider",{onEventHandler:this.onEventHandler,isCompleteHandler:this.isCompleteHandler,queryInterval:core_1().Duration.seconds(10),totalTimeout:props.timeout,disableWaiterStateMachineLogging:disableLogging,...disableLogging?{}:{frameworkLambdaLoggingLevel:lambda().ApplicationLogLevel.INFO}})}}exports.ReplicaProvider=ReplicaProvider;

cdk/node_modules/aws-cdk-lib/aws-dynamodb/lib/scalable-attribute-api.d.ts

@@ -0,0 +1,36 @@
+import type * as appscaling from '../../aws-applicationautoscaling';
+/**
+ * Interface for scalable attributes
+ */
+export interface IScalableTableAttribute extends appscaling.IScalableTargetRef {
+    /**
+     * Add scheduled scaling for this scaling attribute
+     */
+    scaleOnSchedule(id: string, actions: appscaling.ScalingSchedule): void;
+    /**
+     * Scale out or in to keep utilization at a given level
+     */
+    scaleOnUtilization(props: UtilizationScalingProps): void;
+}
+/**
+ * Properties for enabling DynamoDB capacity scaling
+ */
+export interface EnableScalingProps {
+    /**
+     * Minimum capacity to scale to
+     */
+    readonly minCapacity: number;
+    /**
+     * Maximum capacity to scale to
+     */
+    readonly maxCapacity: number;
+}
+/**
+ * Properties for enabling DynamoDB utilization tracking
+ */
+export interface UtilizationScalingProps extends appscaling.BaseTargetTrackingProps {
+    /**
+     * Target utilization percentage for the attribute
+     */
+    readonly targetUtilizationPercent: number;
+}

cdk/node_modules/aws-cdk-lib/aws-dynamodb/lib/scalable-attribute-api.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0});

cdk/node_modules/aws-cdk-lib/aws-dynamodb/lib/scalable-table-attribute.d.ts

@@ -0,0 +1,31 @@
+import type { UtilizationScalingProps } from './scalable-attribute-api';
+import * as appscaling from '../../aws-applicationautoscaling';
+/**
+ * A scalable table attribute
+ */
+export declare class ScalableTableAttribute extends appscaling.BaseScalableAttribute {
+    private scalingPolicyCreated;
+    /**
+     * Scale out or in based on time
+     */
+    scaleOnSchedule(id: string, action: appscaling.ScalingSchedule): void;
+    /**
+     * Scale out or in to keep utilization at a given level
+     */
+    scaleOnUtilization(props: UtilizationScalingProps): void;
+    /** @internal */
+    get _scalingPolicyCreated(): boolean;
+}
+/**
+ * Properties for enabling DynamoDB capacity scaling
+ */
+export interface EnableScalingProps {
+    /**
+     * Minimum capacity to scale to
+     */
+    minCapacity: number;
+    /**
+     * Maximum capacity to scale to
+     */
+    maxCapacity: number;
+}

cdk/node_modules/aws-cdk-lib/aws-dynamodb/lib/scalable-table-attribute.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.ScalableTableAttribute=void 0;var appscaling=()=>{var tmp=require("../../aws-applicationautoscaling");return appscaling=()=>tmp,tmp};class ScalableTableAttribute extends appscaling().BaseScalableAttribute{scalingPolicyCreated=!1;scaleOnSchedule(id,action){this.scalingPolicyCreated=!0,super.doScaleOnSchedule(id,action)}scaleOnUtilization(props){if(props.targetUtilizationPercent<10||props.targetUtilizationPercent>90)throw new RangeError(`targetUtilizationPercent for DynamoDB scaling must be between 10 and 90 percent, got: ${props.targetUtilizationPercent}`);this.scalingPolicyCreated=!0;const predefinedMetric=this.props.dimension.indexOf("ReadCapacity")===-1?appscaling().PredefinedMetric.DYNAMODB_WRITE_CAPACITY_UTILIZATION:appscaling().PredefinedMetric.DYNAMODB_READ_CAPACITY_UTILIZATION;super.doScaleToTrackMetric("Tracking",{policyName:props.policyName,disableScaleIn:props.disableScaleIn,scaleInCooldown:props.scaleInCooldown,scaleOutCooldown:props.scaleOutCooldown,targetValue:props.targetUtilizationPercent,predefinedMetric})}get _scalingPolicyCreated(){return this.scalingPolicyCreated}}exports.ScalableTableAttribute=ScalableTableAttribute;

cdk/node_modules/aws-cdk-lib/aws-dynamodb/lib/shared.d.ts

@@ -0,0 +1,505 @@
+import type { Construct, IConstruct } from 'constructs';
+import type { GlobalSecondaryIndexProps } from './table';
+import type * as cloudwatch from '../../aws-cloudwatch';
+import type * as iam from '../../aws-iam';
+import type * as kms from '../../aws-kms';
+import { type IResource } from '../../core';
+import type { ITableRef } from '../../interfaces/generated/aws-dynamodb-interfaces.generated';
+/**
+ * Supported DynamoDB table operations.
+ */
+export declare enum Operation {
+    /** GetItem */
+    GET_ITEM = "GetItem",
+    /** BatchGetItem */
+    BATCH_GET_ITEM = "BatchGetItem",
+    /** Scan */
+    SCAN = "Scan",
+    /** Query */
+    QUERY = "Query",
+    /** GetRecords */
+    GET_RECORDS = "GetRecords",
+    /** PutItem */
+    PUT_ITEM = "PutItem",
+    /** DeleteItem */
+    DELETE_ITEM = "DeleteItem",
+    /** UpdateItem */
+    UPDATE_ITEM = "UpdateItem",
+    /** BatchWriteItem */
+    BATCH_WRITE_ITEM = "BatchWriteItem",
+    /** TransactWriteItems */
+    TRANSACT_WRITE_ITEMS = "TransactWriteItems",
+    /** TransactGetItems */
+    TRANSACT_GET_ITEMS = "TransactGetItems",
+    /** ExecuteTransaction */
+    EXECUTE_TRANSACTION = "ExecuteTransaction",
+    /** BatchExecuteStatement */
+    BATCH_EXECUTE_STATEMENT = "BatchExecuteStatement",
+    /** ExecuteStatement */
+    EXECUTE_STATEMENT = "ExecuteStatement"
+}
+/**
+ * Options for configuring a system errors metric that considers multiple operations.
+ */
+export interface SystemErrorsForOperationsMetricOptions extends cloudwatch.MetricOptions {
+    /**
+     * The operations to apply the metric to.
+     *
+     * @default - All operations available by DynamoDB tables will be considered.
+     */
+    readonly operations?: Operation[];
+}
+/**
+ * Options for configuring metrics that considers multiple operations.
+ */
+export interface OperationsMetricOptions extends SystemErrorsForOperationsMetricOptions {
+}
+/**
+ * Represents an attribute for describing the key schema for the table
+ * and indexes.
+ */
+export interface Attribute {
+    /**
+     * The name of an attribute.
+     */
+    readonly name: string;
+    /**
+     * The data type of an attribute.
+     */
+    readonly type: AttributeType;
+}
+/**
+ * Reference to WarmThroughput for a DynamoDB table
+ */
+export interface WarmThroughput {
+    /**
+     * Configures the number of read units per second a table will be able to handle instantly
+     * @default - no readUnitsPerSecond configured
+     */
+    readonly readUnitsPerSecond?: number;
+    /**
+     * Configures the number of write units per second a table will be able to handle instantly
+     * @default - no writeUnitsPerSecond configured
+     */
+    readonly writeUnitsPerSecond?: number;
+}
+/**
+ * Reference to PointInTimeRecovey Specification
+ * for continuous backups
+ */
+export interface PointInTimeRecoverySpecification {
+    /**
+     * Indicates whether point in time recovery is enabled (true) or disabled (false) on the table.
+     * @default false
+     */
+    readonly pointInTimeRecoveryEnabled: boolean;
+    /**
+     * The number of preceding days for which continuous backups are taken and maintained.
+     * Your table data is only recoverable to any point-in-time from within the configured recovery period.
+     * If no value is provided, the value will default to 35.
+     * @default 35
+     */
+    readonly recoveryPeriodInDays?: number;
+}
+/**
+ * Data types for attributes within a table
+ *
+ * @see https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/HowItWorks.NamingRulesDataTypes.html#HowItWorks.DataTypes
+ */
+export declare enum AttributeType {
+    /**
+     * Up to 400KiB of binary data (which must be encoded as base64 before sending to DynamoDB)
+     */
+    BINARY = "B",
+    /**
+     * Numeric values made of up to 38 digits (positive, negative or zero)
+     */
+    NUMBER = "N",
+    /**
+     * Up to 400KiB of UTF-8 encoded text
+     */
+    STRING = "S"
+}
+/**
+ * DynamoDB's Read/Write capacity modes.
+ */
+export declare enum BillingMode {
+    /**
+     * Pay only for what you use. You don't configure Read/Write capacity units.
+     */
+    PAY_PER_REQUEST = "PAY_PER_REQUEST",
+    /**
+     * Explicitly specified Read/Write capacity units.
+     */
+    PROVISIONED = "PROVISIONED"
+}
+/**
+ * DynamoDB's Contributor Insights Mode
+ * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-dynamodb-table-contributorinsightsspecification.html
+ */
+export declare enum ContributorInsightsMode {
+    /**
+     * Emits metrics for all read and write requests, whether successful or throttled.
+     */
+    ACCESSED_AND_THROTTLED_KEYS = "ACCESSED_AND_THROTTLED_KEYS",
+    /**
+     * Emits metrics for read and write requests that were throttled.
+     */
+    THROTTLED_KEYS = "THROTTLED_KEYS"
+}
+/**
+ * The replication mode for global table settings across multiple accounts.
+ *
+ * Note: In a multi-account global table, you cannot make changes to a synchronized setting using CDK.
+ * @see https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/V2globaltables_MA_HowItWorks.html
+ */
+export declare enum GlobalTableSettingsReplicationMode {
+    /**
+     * All synchronizable settings are replicated across all replicas.
+     *
+     * Synchronizable settings include: billing mode, provisioned throughput, auto-scaling,
+     * on-demand throughput, warm throughput, TTL, streams view type, and GSIs.
+     *
+     * Note: Some settings are always synchronized (key schema, LSIs) and some are never
+     * synchronized (table class, SSE, deletion protection, PITR, tags, resource policy, CCI).
+     */
+    ALL = "ENABLED"
+}
+/**
+ * Reference to ContributorInsightsSpecification
+ */
+export interface ContributorInsightsSpecification {
+    /**
+     * Indicates whether contributor insights is enabled.
+     * @default false
+     */
+    readonly enabled: boolean;
+    /**
+     * Indicates the type of metrics captured by contributor insights.
+     * @default ACCESSED_AND_THROTTLED_KEYS
+     */
+    readonly mode?: ContributorInsightsMode;
+}
+/**
+ * The set of attributes that are projected into the index
+ *
+ * @see https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_Projection.html
+ */
+export declare enum ProjectionType {
+    /**
+     * Only the index and primary keys are projected into the index.
+     */
+    KEYS_ONLY = "KEYS_ONLY",
+    /**
+     * Only the specified table attributes are projected into the index. The list
+     * of projected attributes is in `nonKeyAttributes`.
+     */
+    INCLUDE = "INCLUDE",
+    /**
+     * All of the table attributes are projected into the index.
+     */
+    ALL = "ALL"
+}
+/**
+ * DynamoDB's table class.
+ *
+ * @see https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/HowItWorks.TableClasses.html
+ */
+export declare enum TableClass {
+    /**
+     * Default table class for DynamoDB.
+     */
+    STANDARD = "STANDARD",
+    /**
+     * Table class for DynamoDB that reduces storage costs compared to existing DynamoDB
+     * standard tables.
+     */
+    STANDARD_INFREQUENT_ACCESS = "STANDARD_INFREQUENT_ACCESS"
+}
+/**
+ * Global table multi-region consistency mode.
+ *
+ * @see https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/V2globaltables_HowItWorks.html#V2globaltables_HowItWorks.consistency-modes-mrsc
+ */
+export declare enum MultiRegionConsistency {
+    /**
+     * Default consistency mode for Global Tables.
+     * Multi-region eventual consistency.
+     */
+    EVENTUAL = "EVENTUAL",
+    /**
+     * Multi-region strong consistency.
+     */
+    STRONG = "STRONG"
+}
+/**
+ * What kind of server-side encryption to apply to this table.
+ */
+export declare enum TableEncryption {
+    /**
+     * Server-side KMS encryption with a master key owned by AWS.
+     */
+    DEFAULT = "AWS_OWNED",
+    /**
+     * Server-side KMS encryption with a customer master key managed by customer.
+     * If `encryptionKey` is specified, this key will be used, otherwise, one will be defined.
+     *
+     * > **NOTE**: if `encryptionKey` is not specified and the `Table` construct creates
+     * > a KMS key for you, the key will be created with default permissions. If you are using
+     * > CDKv2, these permissions will be sufficient to enable the key for use with DynamoDB tables.
+     * > If you are using CDKv1, make sure the feature flag `@aws-cdk/aws-kms:defaultKeyPolicies`
+     * > is set to `true` in your `cdk.json`.
+     */
+    CUSTOMER_MANAGED = "CUSTOMER_MANAGED",
+    /**
+     * Server-side KMS encryption with a master key managed by AWS.
+     */
+    AWS_MANAGED = "AWS_MANAGED"
+}
+/**
+ * When an item in the table is modified, StreamViewType determines what information
+ * is written to the stream for this table.
+ *
+ * @see https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_StreamSpecification.html
+ */
+export declare enum StreamViewType {
+    /**
+     * The entire item, as it appears after it was modified, is written to the stream.
+     */
+    NEW_IMAGE = "NEW_IMAGE",
+    /**
+     * The entire item, as it appeared before it was modified, is written to the stream.
+     */
+    OLD_IMAGE = "OLD_IMAGE",
+    /**
+     * Both the new and the old item images of the item are written to the stream.
+     */
+    NEW_AND_OLD_IMAGES = "NEW_AND_OLD_IMAGES",
+    /**
+     * Only the key attributes of the modified item are written to the stream.
+     */
+    KEYS_ONLY = "KEYS_ONLY"
+}
+/**
+ * Properties for a secondary index
+ */
+export interface SecondaryIndexProps {
+    /**
+     * The name of the secondary index.
+     */
+    readonly indexName: string;
+    /**
+     * The set of attributes that are projected into the secondary index.
+     * @default ALL
+     */
+    readonly projectionType?: ProjectionType;
+    /**
+     * The non-key attributes that are projected into the secondary index.
+     * @default - No additional attributes
+     */
+    readonly nonKeyAttributes?: string[];
+}
+/**
+ * Properties for a local secondary index
+ */
+export interface LocalSecondaryIndexProps extends SecondaryIndexProps {
+    /**
+     * The attribute of a sort key for the local secondary index.
+     */
+    readonly sortKey: Attribute;
+}
+/**
+ * An interface that represents a DynamoDB Table - either created with the CDK, or an existing one.
+ */
+export interface ITable extends IResource, ITableRef {
+    /**
+     * Arn of the dynamodb table.
+     *
+     * @attribute
+     */
+    readonly tableArn: string;
+    /**
+     * Table name of the dynamodb table.
+     *
+     * @attribute
+     */
+    readonly tableName: string;
+    /**
+     * ARN of the table's stream, if there is one.
+     *
+     * @attribute
+     */
+    readonly tableStreamArn?: string;
+    /**
+     *
+     * Optional KMS encryption key associated with this table.
+     */
+    readonly encryptionKey?: kms.IKey;
+    /**
+     * Adds an IAM policy statement associated with this table to an IAM
+     * principal's policy.
+     *
+     * If `encryptionKey` is present, appropriate grants to the key needs to be added
+     * separately using the `table.encryptionKey.grant*` methods.
+     *
+     * @param grantee The principal (no-op if undefined)
+     * @param actions The set of actions to allow (i.e. "dynamodb:PutItem", "dynamodb:GetItem", ...)
+     */
+    grant(grantee: iam.IGrantable, ...actions: string[]): iam.Grant;
+    /**
+     * Adds an IAM policy statement associated with this table's stream to an
+     * IAM principal's policy.
+     *
+     * If `encryptionKey` is present, appropriate grants to the key needs to be added
+     * separately using the `table.encryptionKey.grant*` methods.
+     *
+     * @param grantee The principal (no-op if undefined)
+     * @param actions The set of actions to allow (i.e. "dynamodb:DescribeStream", "dynamodb:GetRecords", ...)
+     */
+    grantStream(grantee: iam.IGrantable, ...actions: string[]): iam.Grant;
+    /**
+     * Permits an IAM principal all data read operations from this table:
+     * BatchGetItem, GetRecords, GetShardIterator, Query, GetItem, Scan.
+     *
+     * Appropriate grants will also be added to the customer-managed KMS key
+     * if one was configured.
+     *
+     * @param grantee The principal to grant access to
+     */
+    grantReadData(grantee: iam.IGrantable): iam.Grant;
+    /**
+     * Permits an IAM Principal to list streams attached to current dynamodb table.
+     *
+     * @param grantee The principal (no-op if undefined)
+     */
+    grantTableListStreams(grantee: iam.IGrantable): iam.Grant;
+    /**
+     * Permits an IAM principal all stream data read operations for this
+     * table's stream:
+     * DescribeStream, GetRecords, GetShardIterator, ListStreams.
+     *
+     * Appropriate grants will also be added to the customer-managed KMS key
+     * if one was configured.
+     *
+     * @param grantee The principal to grant access to
+     */
+    grantStreamRead(grantee: iam.IGrantable): iam.Grant;
+    /**
+     * Permits an IAM principal all data write operations to this table:
+     * BatchWriteItem, PutItem, UpdateItem, DeleteItem.
+     *
+     * Appropriate grants will also be added to the customer-managed KMS key
+     * if one was configured.
+     *
+     * @param grantee The principal to grant access to
+     */
+    grantWriteData(grantee: iam.IGrantable): iam.Grant;
+    /**
+     * Permits an IAM principal to all data read/write operations to this table.
+     * BatchGetItem, GetRecords, GetShardIterator, Query, GetItem, Scan,
+     * BatchWriteItem, PutItem, UpdateItem, DeleteItem
+     *
+     * Appropriate grants will also be added to the customer-managed KMS key
+     * if one was configured.
+     *
+     * @param grantee The principal to grant access to
+     */
+    grantReadWriteData(grantee: iam.IGrantable): iam.Grant;
+    /**
+     * Permits all DynamoDB operations ("dynamodb:*") to an IAM principal.
+     *
+     * Appropriate grants will also be added to the customer-managed KMS key
+     * if one was configured.
+     *
+     * @param grantee The principal to grant access to
+     */
+    grantFullAccess(grantee: iam.IGrantable): iam.Grant;
+    /**
+     * Metric for the number of Errors executing all Lambdas
+     */
+    metric(metricName: string, props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * Metric for the consumed read capacity units
+     *
+     * @param props properties of a metric
+     */
+    metricConsumedReadCapacityUnits(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * Metric for the consumed write capacity units
+     *
+     * @param props properties of a metric
+     */
+    metricConsumedWriteCapacityUnits(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * Metric for the system errors this table
+     *
+     * @param props properties of a metric
+     *
+     */
+    metricSystemErrorsForOperations(props?: SystemErrorsForOperationsMetricOptions): cloudwatch.IMetric;
+    /**
+     * Metric for the user errors
+     *
+     * @param props properties of a metric
+     */
+    metricUserErrors(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * Metric for the conditional check failed requests
+     *
+     * @param props properties of a metric
+     */
+    metricConditionalCheckFailedRequests(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * Metric for throttled requests
+     *
+     * @param props properties of a metric
+     *
+     * @deprecated use `metricThrottledRequestsForOperations`
+     */
+    metricThrottledRequests(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * Metric for throttled requests
+     *
+     * @param props properties of a metric
+     *
+     */
+    metricThrottledRequestsForOperations(props?: OperationsMetricOptions): cloudwatch.IMetric;
+    /**
+     * Metric for the successful request latency
+     *
+     * @param props properties of a metric
+     *
+     */
+    metricSuccessfulRequestLatency(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+}
+export declare function validateContributorInsights(contributorInsights: boolean | undefined, contributorInsightsSpecification: ContributorInsightsSpecification | undefined, deprecatedPropertyName: string, construct: Construct): ContributorInsightsSpecification | undefined;
+/**
+ * A description of a key schema of an LSI, GSI or Table
+ */
+export interface KeySchema {
+    /**
+     * Partition key definition
+     *
+     * This array has at least one, but potentially multiple entries.  Together,
+     * they form the partition key.
+     */
+    readonly partitionKeys: Attribute[];
+    /**
+     * Sort key definition
+     *
+     * This array has zero or more entries. Together, they form the sort key.
+     */
+    readonly sortKeys: Attribute[];
+}
+/**
+ * A key schema that combines the legacy properties (singular keys) with the modern properties (multi-attribute keys)
+ *
+ * Picking from an existing type is an easy way to get these without having to copy/paste them all, but we could
+ * have also done the copy/pasting. This type is never exported.
+ */
+type CompatibleKeySchema = Pick<GlobalSecondaryIndexProps, 'partitionKey' | 'partitionKeys' | 'sortKey' | 'sortKeys'>;
+/**
+ * Parse a backwards compatible key schema to a strictly multi-attribute key schema, and validate the contents
+ */
+export declare function parseKeySchema(schema: CompatibleKeySchema, scope: IConstruct): KeySchema;
+export {};

cdk/node_modules/aws-cdk-lib/aws-dynamodb/lib/shared.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.StreamViewType=exports.TableEncryption=exports.MultiRegionConsistency=exports.TableClass=exports.ProjectionType=exports.GlobalTableSettingsReplicationMode=exports.ContributorInsightsMode=exports.BillingMode=exports.AttributeType=exports.Operation=void 0,exports.validateContributorInsights=validateContributorInsights,exports.parseKeySchema=parseKeySchema;var core_1=()=>{var tmp=require("../../core");return core_1=()=>tmp,tmp},literal_string_1=()=>{var tmp=require("../../core/lib/private/literal-string");return literal_string_1=()=>tmp,tmp},Operation;(function(Operation2){Operation2.GET_ITEM="GetItem",Operation2.BATCH_GET_ITEM="BatchGetItem",Operation2.SCAN="Scan",Operation2.QUERY="Query",Operation2.GET_RECORDS="GetRecords",Operation2.PUT_ITEM="PutItem",Operation2.DELETE_ITEM="DeleteItem",Operation2.UPDATE_ITEM="UpdateItem",Operation2.BATCH_WRITE_ITEM="BatchWriteItem",Operation2.TRANSACT_WRITE_ITEMS="TransactWriteItems",Operation2.TRANSACT_GET_ITEMS="TransactGetItems",Operation2.EXECUTE_TRANSACTION="ExecuteTransaction",Operation2.BATCH_EXECUTE_STATEMENT="BatchExecuteStatement",Operation2.EXECUTE_STATEMENT="ExecuteStatement"})(Operation||(exports.Operation=Operation={}));var AttributeType;(function(AttributeType2){AttributeType2.BINARY="B",AttributeType2.NUMBER="N",AttributeType2.STRING="S"})(AttributeType||(exports.AttributeType=AttributeType={}));var BillingMode;(function(BillingMode2){BillingMode2.PAY_PER_REQUEST="PAY_PER_REQUEST",BillingMode2.PROVISIONED="PROVISIONED"})(BillingMode||(exports.BillingMode=BillingMode={}));var ContributorInsightsMode;(function(ContributorInsightsMode2){ContributorInsightsMode2.ACCESSED_AND_THROTTLED_KEYS="ACCESSED_AND_THROTTLED_KEYS",ContributorInsightsMode2.THROTTLED_KEYS="THROTTLED_KEYS"})(ContributorInsightsMode||(exports.ContributorInsightsMode=ContributorInsightsMode={}));var GlobalTableSettingsReplicationMode;(function(GlobalTableSettingsReplicationMode2){GlobalTableSettingsReplicationMode2.ALL="ENABLED"})(GlobalTableSettingsReplicationMode||(exports.GlobalTableSettingsReplicationMode=GlobalTableSettingsReplicationMode={}));var ProjectionType;(function(ProjectionType2){ProjectionType2.KEYS_ONLY="KEYS_ONLY",ProjectionType2.INCLUDE="INCLUDE",ProjectionType2.ALL="ALL"})(ProjectionType||(exports.ProjectionType=ProjectionType={}));var TableClass;(function(TableClass2){TableClass2.STANDARD="STANDARD",TableClass2.STANDARD_INFREQUENT_ACCESS="STANDARD_INFREQUENT_ACCESS"})(TableClass||(exports.TableClass=TableClass={}));var MultiRegionConsistency;(function(MultiRegionConsistency2){MultiRegionConsistency2.EVENTUAL="EVENTUAL",MultiRegionConsistency2.STRONG="STRONG"})(MultiRegionConsistency||(exports.MultiRegionConsistency=MultiRegionConsistency={}));var TableEncryption;(function(TableEncryption2){TableEncryption2.DEFAULT="AWS_OWNED",TableEncryption2.CUSTOMER_MANAGED="CUSTOMER_MANAGED",TableEncryption2.AWS_MANAGED="AWS_MANAGED"})(TableEncryption||(exports.TableEncryption=TableEncryption={}));var StreamViewType;(function(StreamViewType2){StreamViewType2.NEW_IMAGE="NEW_IMAGE",StreamViewType2.OLD_IMAGE="OLD_IMAGE",StreamViewType2.NEW_AND_OLD_IMAGES="NEW_AND_OLD_IMAGES",StreamViewType2.KEYS_ONLY="KEYS_ONLY"})(StreamViewType||(exports.StreamViewType=StreamViewType={}));function validateContributorInsights(contributorInsights,contributorInsightsSpecification,deprecatedPropertyName,construct){if(contributorInsightsSpecification!==void 0&&contributorInsights!==void 0)throw new(core_1()).ValidationError((0,literal_string_1().lit)`ContributorInsightsConflict`,`\`contributorInsightsSpecification\` and \`${deprecatedPropertyName}\` are set. Use \`contributorInsightsSpecification\` only.`,construct);return contributorInsightsSpecification??(contributorInsights!==void 0?{enabled:contributorInsights}:void 0)}function parseKeySchema(schema,scope){if(schema.partitionKey===void 0==(schema.partitionKeys===void 0))throw new(core_1()).ValidationError((0,literal_string_1().lit)`ExactlyOnePartitionKey`,"Exactly one of 'partitionKey', 'partitionKeys' must be specified",scope);if(schema.sortKey!==void 0&&schema.sortKeys!==void 0)throw new(core_1()).ValidationError((0,literal_string_1().lit)`AtMostOneSortKey`,"At most one of 'sortKey', 'sortKeys' may be specified",scope);const partitionKeys=schema.partitionKeys??(schema.partitionKey?[schema.partitionKey]:[]),sortKeys=schema.sortKeys??(schema.sortKey?[schema.sortKey]:[]);if(partitionKeys.length===0)throw new(core_1()).ValidationError((0,literal_string_1().lit)`PartitionKeysRequired`,"'partitionKeys' must contain at least one element",scope);if(partitionKeys.length>4)throw new(core_1()).ValidationError((0,literal_string_1().lit)`MaxPartitionKeysExceeded`,"Maximum of 4 partition keys allowed",scope);if(sortKeys.length>4)throw new(core_1()).ValidationError((0,literal_string_1().lit)`MaxSortKeysExceeded`,"Maximum of 4 sort keys allowed",scope);return{partitionKeys,sortKeys}}

cdk/node_modules/aws-cdk-lib/aws-dynamodb/lib/stream-grants.d.ts

@@ -0,0 +1,61 @@
+import type { ITableRef } from './dynamodb.generated';
+import * as iam from '../../aws-iam';
+import type * as kms from '../../aws-kms';
+/**
+ * Construction properties for StreamGrants
+ */
+export interface StreamGrantsProps {
+    /**
+     * The table this stream is for
+     */
+    readonly table: ITableRef;
+    /**
+     * The ARN of the Stream
+     */
+    readonly tableStreamArn: string;
+    /**
+     * The encryption key of the table
+     *
+     * Required permissions will be added to the key as well.
+     *
+     * @default - No key
+     */
+    readonly encryptionKey?: kms.IKey;
+}
+/**
+ * A set of permissions to grant on a Table Stream
+ */
+export declare class StreamGrants {
+    private readonly table;
+    private readonly tableStreamArn;
+    private readonly encryptionKey?;
+    constructor(props: StreamGrantsProps);
+    /**
+     * Adds an IAM policy statement associated with this table's stream to an
+     * IAM principal's policy.
+     *
+     * If `encryptionKey` is present, appropriate grants to the key needs to be added
+     * separately using the `table.encryptionKey.grant*` methods.
+     *
+     * @param grantee The principal (no-op if undefined)
+     * @param actions The set of actions to allow (i.e. "dynamodb:DescribeStream", "dynamodb:GetRecords", ...)
+     */
+    actions(grantee: iam.IGrantable, ...actions: string[]): iam.Grant;
+    /**
+     * Permits an IAM Principal to list streams attached to current dynamodb table.
+     *
+     * @param grantee The principal (no-op if undefined)
+     */
+    list(grantee: iam.IGrantable): iam.Grant;
+    /**
+     * Permits an IAM principal all stream data read operations for this
+     * table's stream:
+     * DescribeStream, GetRecords, GetShardIterator, ListStreams.
+     *
+     * Appropriate grants will also be added to the customer-managed KMS key
+     * if one was configured.
+     *
+     * @param grantee The principal to grant access to
+     */
+    read(grantee: iam.IGrantable): iam.Grant;
+}

cdk/node_modules/aws-cdk-lib/aws-dynamodb/lib/stream-grants.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.StreamGrants=void 0;var jsiiDeprecationWarnings=()=>{var tmp=require("../../.warnings.jsii.js");return jsiiDeprecationWarnings=()=>tmp,tmp};const JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti");var perms=()=>{var tmp=require("./perms");return perms=()=>tmp,tmp},iam=()=>{var tmp=require("../../aws-iam");return iam=()=>tmp,tmp};class StreamGrants{static[JSII_RTTI_SYMBOL_1]={fqn:"aws-cdk-lib.aws_dynamodb.StreamGrants",version:"2.252.0"};table;tableStreamArn;encryptionKey;constructor(props){try{jsiiDeprecationWarnings().aws_cdk_lib_aws_dynamodb_StreamGrantsProps(props)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,StreamGrants),error}this.table=props.table,this.tableStreamArn=props.tableStreamArn,this.encryptionKey=props?.encryptionKey}actions(grantee,...actions){try{jsiiDeprecationWarnings().aws_cdk_lib_aws_iam_IGrantable(grantee)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.actions),error}return iam().Grant.addToPrincipal({grantee,actions,resourceArns:[this.tableStreamArn],scope:this.table})}list(grantee){try{jsiiDeprecationWarnings().aws_cdk_lib_aws_iam_IGrantable(grantee)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.list),error}return iam().Grant.addToPrincipal({grantee,actions:["dynamodb:ListStreams"],resourceArns:["*"]})}read(grantee){try{jsiiDeprecationWarnings().aws_cdk_lib_aws_iam_IGrantable(grantee)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.read),error}return this.list(grantee),this.encryptionKey?.grant(grantee,...perms().KEY_READ_ACTIONS),iam().Grant.addToPrincipal({grantee,actions:perms().READ_STREAM_DATA_ACTIONS,resourceArns:[this.tableStreamArn],scope:this.table})}}exports.StreamGrants=StreamGrants;

cdk/node_modules/aws-cdk-lib/aws-dynamodb/lib/table-grants.d.ts

@@ -0,0 +1,120 @@
+import type { ITableRef } from './dynamodb.generated';
+import * as iam from '../../aws-iam';
+/**
+ * Construction properties for TableGrants
+ */
+export interface TableGrantsProps {
+    /**
+     * The table to grant permissions on
+     */
+    readonly table: ITableRef;
+    /**
+     * Additional regions other than the main one that this table is replicated to
+     *
+     * @default - No regions
+     */
+    readonly regions?: string[];
+    /**
+     * Whether this table has indexes
+     *
+     * If so, permissions are granted on all table indexes as well.
+     *
+     * @default false
+     */
+    readonly hasIndex?: boolean;
+    /**
+     * The encrypted resource on which actions will be allowed
+     *
+     * @deprecated - Leave this field undefined. If the table is encrypted with a customer-managed KMS key, appropriate
+     * grants to the key will be automatically added.
+     *
+     * @default - A best-effort attempt will be made to discover an associated KMS key and grant permissions to it.
+     */
+    readonly encryptedResource?: iam.IEncryptedResource;
+    /**
+     * The resource with policy on which actions will be allowed
+     *
+     * @deprecated - Leave this field undefined. A best-effort attempt will be made to discover a resource policy and add
+     * permissions to it.
+     *
+     * @default - A best-effort attempt will be made to discover a resource policy and add permissions to it.
+     */
+    readonly policyResource?: iam.IResourceWithPolicyV2;
+}
+/**
+ * A set of permissions to grant on a Table
+ */
+export declare class TableGrants {
+    /**
+     * Creates a TableGrants object for a given table.
+     */
+    static fromTable(table: ITableRef, regions?: string[], hasIndex?: boolean): TableGrants;
+    private readonly table;
+    private readonly arns;
+    private readonly encryptedResource?;
+    private readonly policyResource?;
+    constructor(props: TableGrantsProps);
+    /**
+     * Adds an IAM policy statement associated with this table to an IAM
+     * principal's policy.
+     *
+     * If `encryptionKey` is present, appropriate grants to the key needs to be added
+     * separately using the `table.encryptionKey.grant*` methods.
+     *
+     * @param grantee The principal (no-op if undefined)
+     * @param actions The set of actions to allow (i.e. "dynamodb:PutItem", "dynamodb:GetItem", ...)
+     */
+    actions(grantee: iam.IGrantable, ...actions: string[]): iam.Grant;
+    /**
+     * Permits an IAM principal all data read operations from this table:
+     * BatchGetItem, GetRecords, GetShardIterator, Query, GetItem, Scan, DescribeTable.
+     *
+     * Appropriate grants will also be added to the customer-managed KMS key
+     * if one was configured.
+     *
+     * @param grantee The principal to grant access to
+     */
+    readData(grantee: iam.IGrantable): iam.Grant;
+    /**
+     * Permits an IAM principal all data write operations to this table:
+     * BatchWriteItem, PutItem, UpdateItem, DeleteItem, DescribeTable.
+     *
+     * Appropriate grants will also be added to the customer-managed KMS key
+     * if one was configured.
+     *
+     * @param grantee The principal to grant access to
+     */
+    writeData(grantee: iam.IGrantable): iam.Grant;
+    /**
+     * Permits an IAM principal to all data read/write operations to this table.
+     * BatchGetItem, GetRecords, GetShardIterator, Query, GetItem, Scan,
+     * BatchWriteItem, PutItem, UpdateItem, DeleteItem, DescribeTable
+     *
+     * Appropriate grants will also be added to the customer-managed KMS key
+     * if one was configured.
+     *
+     * @param grantee The principal to grant access to
+     */
+    readWriteData(grantee: iam.IGrantable): iam.Grant;
+    /**
+     * Permits all DynamoDB operations ("dynamodb:*") to an IAM principal.
+     *
+     * Appropriate grants will also be added to the customer-managed KMS key
+     * if one was configured.
+     *
+     * @param grantee The principal to grant access to
+     */
+    fullAccess(grantee: iam.IGrantable): iam.Grant;
+    /**
+     * Grants permissions for this table to act as a source for multi-account global table replication.
+     *
+     * @param destinationReplicaArn The ARN of the destination replica table in the other account
+     */
+    multiAccountReplicationTo(destinationReplicaArn: string): void;
+    /**
+     * Grants permissions for this table to act as a destination for multi-account global table replication.
+     *
+     * @param sourceReplicaArn The ARN of the source replica table in the other account
+     */
+    multiAccountReplicationFrom(sourceReplicaArn: string): void;
+}

cdk/node_modules/aws-cdk-lib/aws-dynamodb/lib/table-v2-base.d.ts

@@ -0,0 +1,283 @@
+import type { SystemErrorsForOperationsMetricOptions, OperationsMetricOptions, ITable } from './shared';
+import type { TableGrants } from './table-grants';
+import type { IMetric, MetricOptions } from '../../aws-cloudwatch';
+import { Metric } from '../../aws-cloudwatch';
+import type { AddToResourcePolicyResult, GrantOnKeyResult, IGrantable, IResourceWithPolicy, PolicyDocument, PolicyStatement } from '../../aws-iam';
+import { Grant } from '../../aws-iam';
+import type { IKey } from '../../aws-kms';
+import { Resource } from '../../core';
+import type { TableReference } from '../../interfaces/generated/aws-dynamodb-interfaces.generated';
+/**
+ * Represents an instance of a DynamoDB table.
+ */
+export interface ITableV2 extends ITable {
+    /**
+     * The ID of the table.
+     *
+     * @attribute
+     */
+    readonly tableId?: string;
+    /**
+     * Grants for this table
+     */
+    readonly grants: TableGrants;
+}
+/**
+ * Base class for a DynamoDB table.
+ */
+export declare abstract class TableBaseV2 extends Resource implements ITableV2, IResourceWithPolicy {
+    /**
+     * The ARN of the table.
+     *
+     * @attribute
+     */
+    abstract readonly tableArn: string;
+    /**
+     * The name of the table.
+     *
+     * @attribute
+     */
+    abstract readonly tableName: string;
+    /**
+     * The stream ARN of the table.
+     *
+     * @attribute
+     */
+    abstract readonly tableStreamArn?: string;
+    /**
+     * The ID of the table.
+     *
+     * @attribute
+     */
+    abstract readonly tableId?: string;
+    /**
+     * Grants for this table.
+     */
+    abstract readonly grants: TableGrants;
+    /**
+     * The KMS encryption key for the table.
+     */
+    abstract readonly encryptionKey?: IKey;
+    /**
+     * The resource policy for the table
+     */
+    abstract resourcePolicy?: PolicyDocument;
+    protected abstract readonly region: string;
+    protected abstract get hasIndex(): boolean;
+    /**
+     * A reference to this table.
+     */
+    get tableRef(): TableReference;
+    /**
+     * Adds an IAM policy statement associated with this table to an IAM principal's policy.
+     *
+     * Note: If `encryptionKey` is present, appropriate grants to the key needs to be added
+     * separately using the `table.encryptionKey.grant*` methods.
+     *
+     * [disable-awslint:no-grants]
+     *
+     * @param grantee the principal (no-op if undefined)
+     * @param actions the set of actions to allow (i.e., 'dynamodb:PutItem', 'dynamodb:GetItem', etc.)
+     */
+    grant(grantee: IGrantable, ...actions: string[]): Grant;
+    /**
+     * Adds an IAM policy statement associated with this table to an IAM principal's policy.
+     *
+     * Note: If `encryptionKey` is present, appropriate grants to the key needs to be added
+     * separately using the `table.encryptionKey.grant*` methods.
+     *
+     * [disable-awslint:no-grants]
+     *
+     * @param grantee the principal (no-op if undefined)
+     * @param actions the set of actions to allow (i.e., 'dynamodb:DescribeStream', 'dynamodb:GetRecords', etc.)
+     */
+    grantStream(grantee: IGrantable, ...actions: string[]): Grant;
+    /**
+     * Adds an IAM policy statement associated with this table to an IAM principal's policy.
+     *
+     * Actions: DescribeStream, GetRecords, GetShardIterator, ListStreams.
+     *
+     * Note: Appropriate grants will also be added to the customer-managed KMS keys associated with this
+     * table if one was configured.
+     *
+     * [disable-awslint:no-grants]
+     *
+     * @param grantee the principal to grant access to
+     */
+    grantStreamRead(grantee: IGrantable): Grant;
+    /**
+     * Permits an IAM principal to list streams attached to this table.
+     *
+     * [disable-awslint:no-grants]
+     *
+     * @param grantee the principal to grant access to
+     */
+    grantTableListStreams(grantee: IGrantable): Grant;
+    /**
+     * Permits an IAM principal all data read operations on this table.
+     *
+     * Actions: BatchGetItem, GetRecords, GetShardIterator, Query, GetItem, Scan, DescribeTable.
+     *
+     * Note: Appropriate grants will also be added to the customer-managed KMS keys associated with this
+     * table if one was configured.
+     *
+     * [disable-awslint:no-grants]
+     *
+     * @param grantee the principal to grant access to
+     */
+    grantReadData(grantee: IGrantable): Grant;
+    /**
+     * Permits an IAM principal all data write operations on this table.
+     *
+     * Actions: BatchWriteItem, PutItem, UpdateItem, DeleteItem, DescribeTable.
+     *
+     * Note: Appropriate grants will also be added to the customer-managed KMS keys associated with this
+     * table if one was configured.
+     *
+     * [disable-awslint:no-grants]
+     *
+     * @param grantee the principal to grant access to
+     */
+    grantWriteData(grantee: IGrantable): Grant;
+    /**
+     * Permits an IAM principal to all data read/write operations on this table.
+     *
+     * Actions: BatchGetItem, GetRecords, GetShardIterator, Query, GetItem, Scan, BatchWriteItem, PutItem, UpdateItem,
+     * DeleteItem, DescribeTable.
+     *
+     * Note: Appropriate grants will also be added to the customer-managed KMS keys associated with this
+     * table if one was configured.
+     *
+     * [disable-awslint:no-grants]
+     *
+     * @param grantee the principal to grant access to
+     */
+    grantReadWriteData(grantee: IGrantable): Grant;
+    /**
+     * Permits an IAM principal to all DynamoDB operations ('dynamodb:*') on this table.
+     *
+     * Note: Appropriate grants will also be added to the customer-managed KMS keys associated with this
+     * table if one was configured.
+     *
+     * [disable-awslint:no-grants]
+     *
+     * @param grantee the principal to grant access to
+     */
+    grantFullAccess(grantee: IGrantable): Grant;
+    /**
+     * Grants permissions on the table's encryption key.
+     *
+     * @param grantee the principal to grant access to
+     * @param actions the KMS actions to grant
+     */
+    grantOnKey(grantee: IGrantable, ...actions: string[]): GrantOnKeyResult;
+    /**
+     * Return the given named metric for this table.
+     *
+     * By default, the metric will be calculated as a sum over a period of 5 minutes.
+     * You can customize this by using the `statistic` and `period` properties.
+     */
+    metric(metricName: string, props?: MetricOptions): Metric;
+    /**
+     * Metric for the consumed read capacity units for this table.
+     *
+     * By default, the metric will be calculated as a sum over a period of 5 minutes.
+     * You can customize this by using the `statistic` and `period` properties.
+     */
+    metricConsumedReadCapacityUnits(props?: MetricOptions): Metric;
+    /**
+     * Metric for the consumed write capacity units for this table.
+     *
+     * By default, the metric will be calculated as a sum over a period of 5 minutes.
+     * You can customize this by using the `statistic` and `period` properties.
+     */
+    metricConsumedWriteCapacityUnits(props?: MetricOptions): Metric;
+    /**
+     * Metric for the user errors for this table.
+     *
+     * Note: This metric reports user errors across all the tables in the account and region the table
+     * resides in.
+     *
+     * By default, the metric will be calculated as a sum over a period of 5 minutes.
+     * You can customize this by using the `statistic` and `period` properties.
+     */
+    metricUserErrors(props?: MetricOptions): Metric;
+    /**
+     * Metric for the conditional check failed requests for this table.
+     *
+     * By default, the metric will be calculated as a sum over a period of 5 minutes.
+     * You can customize this by using the `statistic` and `period` properties.
+     */
+    metricConditionalCheckFailedRequests(props?: MetricOptions): Metric;
+    /**
+     * Metric for the successful request latency for this table.
+     *
+     * By default, the metric will be calculated as an average over a period of 5 minutes.
+     * You can customize this by using the `statistic` and `period` properties.
+     */
+    metricSuccessfulRequestLatency(props?: MetricOptions): Metric;
+    /**
+     * How many requests are throttled on this table for the given operation
+     *
+     * By default, the metric will be calculated as an average over a period of 5 minutes.
+     * You can customize this by using the `statistic` and `period` properties.
+     */
+    metricThrottledRequestsForOperation(operation: string, props?: OperationsMetricOptions): IMetric;
+    /**
+     * How many requests are throttled on this table. This will sum errors across all possible operations.
+     *
+     * By default, each individual metric will be calculated as a sum over a period of 5 minutes.
+     * You can customize this by using the `statistic` and `period` properties.
+     */
+    metricThrottledRequestsForOperations(props?: OperationsMetricOptions): IMetric;
+    /**
+     * Metric for the system errors for this table. This will sum errors across all possible operations.
+     *
+     * By default, each individual metric will be calculated as a sum over a period of 5 minutes.
+     * You can customize this by using the `statistic` and `period` properties.
+     */
+    metricSystemErrorsForOperations(props?: SystemErrorsForOperationsMetricOptions): IMetric;
+    /**
+     * How many requests are throttled on this table.
+     *
+     * By default, each individual metric will be calculated as a sum over a period of 5 minutes.
+     * You can customize this by using the `statistic` and `period` properties.
+     *
+     * @deprecated Do not use this function. It returns an invalid metric. Use `metricThrottledRequestsForOperation` instead.
+     */
+    metricThrottledRequests(props?: MetricOptions): Metric;
+    /**
+     * Metric for the system errors this table
+     *
+     * @deprecated use `metricSystemErrorsForOperations`.
+     */
+    metricSystemErrors(props?: MetricOptions): Metric;
+    /**
+     * Create a math expression for operations.
+     */
+    private sumMetricsForOperations;
+    /**
+     * Create a map of metrics that can be used in a math expression.
+     *
+     * Using the return value of this function as the `usingMetrics` property in `cloudwatch.MathExpression` allows you to
+     * use the keys of this map as metric names inside you expression.
+     */
+    private createMetricForOperations;
+    /**
+     * Adds an IAM policy statement associated with this table to an IAM principal's policy.
+     *
+     * @param grantee the principal (no-op if undefined)
+     * @param options options for keyActions, tableActions, and streamActions
+     */
+    private combinedGrant;
+    private configureMetric;
+    /**
+     * Adds a statement to the resource policy associated with this table.
+     * A resource policy will be automatically created upon the first call to `addToResourcePolicy`.
+     *
+     * Note that this does not work with imported tables.
+     *
+     * @param statement The policy statement to add
+     */
+    abstract addToResourcePolicy(statement: PolicyStatement): AddToResourcePolicyResult;
+}

cdk/node_modules/aws-cdk-lib/aws-dynamodb/lib/table-v2.d.ts

@@ -0,0 +1,674 @@
+import type { Construct } from 'constructs';
+import type { Billing } from './billing';
+import type { Capacity } from './capacity';
+import type { TableEncryptionV2 } from './encryption';
+import type { Attribute, ContributorInsightsSpecification, GlobalTableSettingsReplicationMode, LocalSecondaryIndexProps, PointInTimeRecoverySpecification, SecondaryIndexProps, TableClass, WarmThroughput } from './shared';
+import { MultiRegionConsistency, StreamViewType } from './shared';
+import { TableGrants } from './table-grants';
+import type { ITableV2 } from './table-v2-base';
+import { TableBaseV2 } from './table-v2-base';
+import type { AddToResourcePolicyResult, PolicyStatement } from '../../aws-iam';
+import { PolicyDocument } from '../../aws-iam';
+import type { IStream } from '../../aws-kinesis';
+import type { IKey } from '../../aws-kms';
+import type { CfnTag, RemovalPolicy } from '../../core';
+import { TagManager } from '../../core';
+/**
+ * Options used to configure global secondary indexes on a replica table.
+ */
+export interface ReplicaGlobalSecondaryIndexOptions extends IContributorInsightsConfigurable {
+    /**
+     * Whether CloudWatch contributor insights is enabled for a specific global secondary
+     * index on a replica table.
+     * @deprecated use `contributorInsightsSpecification` instead
+     * @default - inherited from the primary table
+     */
+    readonly contributorInsights?: boolean;
+    /**
+     * Whether CloudWatch contributor insights is enabled and what mode is selected
+     * for a specific global secondary index on a replica table.
+     * @default - contributor insights is not enabled
+     */
+    readonly contributorInsightsSpecification?: ContributorInsightsSpecification;
+    /**
+     * The read capacity for a specific global secondary index on a replica table.
+     *
+     * Note: This can only be configured if primary table billing is provisioned.
+     *
+     * @default - inherited from the primary table
+     */
+    readonly readCapacity?: Capacity;
+    /**
+     * The maximum read request units for a specific global secondary index on a replica table.
+     *
+     * Note: This can only be configured if primary table billing is PAY_PER_REQUEST.
+     *
+     * @default - inherited from the primary table
+     */
+    readonly maxReadRequestUnits?: number;
+}
+/**
+ * Properties used to configure a global secondary index.
+ */
+export interface GlobalSecondaryIndexPropsV2 extends SecondaryIndexProps {
+    /**
+     * Partition key attribute definition.
+     *
+     * If a single field forms the partition key, you can use this field.  Use the
+     * `partitionKeys` field if the partition key is a multi-attribute key (consists of
+     * multiple fields).
+     *
+     * @default - exactly one of `partitionKey` and `partitionKeys` must be specified.
+     */
+    readonly partitionKey?: Attribute;
+    /**
+     * Sort key attribute definition.
+     *
+     * If a single field forms the sort key, you can use this field.  Use the
+     * `sortKeys` field if the sort key is a multi-attribute key (consists of multiple
+     * fields).
+     *
+     * @default - no sort key
+     */
+    readonly sortKey?: Attribute;
+    /**
+     * Multi-attribute partition key
+     *
+     * If a single field forms the partition key, you can use either
+     * `partitionKey` or `partitionKeys` to specify the partition key. Exactly
+     * one of these must be specified.
+     *
+     * You must use `partitionKeys` field if the partition key is a multi-attribute key
+     * (consists of multiple fields).
+     *
+     * NOTE: although the name of this field makes it sound like it creates
+     * multiple keys, it does not. It defines a single key that consists of
+     * of multiple fields.
+     *
+     * The order of fields is not important.
+     *
+     * @default - exactly one of `partitionKey` and `partitionKeys` must be specified.
+     */
+    readonly partitionKeys?: Attribute[];
+    /**
+     * Multi-attribute sort key
+     *
+     * If a single field forms the sort key, you can use either
+     * `sortKey` or `sortKeys` to specify the sort key. At most one of these
+     * may be specified.
+     *
+     * You must use `sortKeys` field if the sort key is a multi-attribute key
+     * (consists of multiple fields).
+     *
+     * NOTE: although the name of this field makes it sound like it creates
+     * multiple keys, it does not. It defines a single key that consists of
+     * of multiple fields at the same time.
+     *
+     * NOTE: The order of fields is important!
+     *
+     * @default - no sort key
+     */
+    readonly sortKeys?: Attribute[];
+    /**
+     * The read capacity.
+     *
+     * Note: This can only be configured if the primary table billing is provisioned.
+     *
+     * @default - inherited from the primary table.
+     */
+    readonly readCapacity?: Capacity;
+    /**
+     * The write capacity.
+     *
+     * Note: This can only be configured if the primary table billing is provisioned.
+     *
+     * @default - inherited from the primary table.
+     */
+    readonly writeCapacity?: Capacity;
+    /**
+     * The maximum read request units.
+     *
+     * Note: This can only be configured if the primary table billing is PAY_PER_REQUEST.
+     *
+     * @default - inherited from the primary table.
+     */
+    readonly maxReadRequestUnits?: number;
+    /**
+     * The maximum write request units.
+     *
+     * Note: This can only be configured if the primary table billing is PAY_PER_REQUEST.
+     *
+     * @default - inherited from the primary table.
+     */
+    readonly maxWriteRequestUnits?: number;
+    /**
+     * The warm throughput configuration for the global secondary index.
+     *
+     * @default - no warm throughput is configured
+     */
+    readonly warmThroughput?: WarmThroughput;
+}
+/**
+ * Common interface for types that can configure contributor insights
+ * @internal
+ */
+interface IContributorInsightsConfigurable {
+    /**
+     * Whether CloudWatch contributor insights is enabled.
+     * @deprecated use `contributorInsightsSpecification` instead
+     */
+    readonly contributorInsights?: boolean;
+    /**
+     * Whether CloudWatch contributor insights is enabled and what mode is selected
+     */
+    readonly contributorInsightsSpecification?: ContributorInsightsSpecification;
+}
+/**
+ * Options used to configure a DynamoDB table.
+ */
+export interface TableOptionsV2 extends IContributorInsightsConfigurable {
+    /**
+     * Whether CloudWatch contributor insights is enabled.
+     * @deprecated use `contributorInsightsSpecification` instead
+     * @default false
+     */
+    readonly contributorInsights?: boolean;
+    /**
+     * Whether CloudWatch contributor insights is enabled and what mode is selected
+     * @default - contributor insights is not enabled
+     */
+    readonly contributorInsightsSpecification?: ContributorInsightsSpecification;
+    /**
+     * Whether deletion protection is enabled.
+     *
+     * @default false
+     */
+    readonly deletionProtection?: boolean;
+    /**
+     * Whether point-in-time recovery is enabled.
+     * @deprecated use `pointInTimeRecoverySpecification` instead
+     * @default false - point in time recovery is not enabled.
+     */
+    readonly pointInTimeRecovery?: boolean;
+    /**
+     * Whether point-in-time recovery is enabled
+     * and recoveryPeriodInDays is set.
+     *
+     * @default - point in time recovery is not enabled.
+     */
+    readonly pointInTimeRecoverySpecification?: PointInTimeRecoverySpecification;
+    /**
+     * The table class.
+     *
+     * @default TableClass.STANDARD
+     */
+    readonly tableClass?: TableClass;
+    /**
+     * Kinesis Data Stream to capture item level changes.
+     *
+     * @default - no Kinesis Data Stream
+     */
+    readonly kinesisStream?: IStream;
+    /**
+     * Tags to be applied to the primary table (default replica table).
+     *
+     * @default - no tags
+     */
+    readonly tags?: CfnTag[];
+    /**
+     * Resource policy to assign to DynamoDB Table.
+     * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-dynamodb-globaltable-replicaspecification.html#cfn-dynamodb-globaltable-replicaspecification-resourcepolicy
+     * @default - No resource policy statements are added to the created table.
+     */
+    readonly resourcePolicy?: PolicyDocument;
+}
+/**
+ * Properties used to configure a replica table.
+ */
+export interface ReplicaTableProps extends TableOptionsV2 {
+    /**
+     * The region that the replica table will be created in.
+     */
+    readonly region: string;
+    /**
+     * The read capacity.
+     *
+     * Note: This can only be configured if the primary table billing is provisioned.
+     *
+     * @default - inherited from the primary table
+     */
+    readonly readCapacity?: Capacity;
+    /**
+     * The maximum read request units.
+     *
+     * Note: This can only be configured if the primary table billing is PAY_PER_REQUEST.
+     *
+     * @default - inherited from the primary table
+     */
+    readonly maxReadRequestUnits?: number;
+    /**
+     * Options used to configure global secondary index properties.
+     *
+     * @default - inherited from the primary table
+     */
+    readonly globalSecondaryIndexOptions?: {
+        [indexName: string]: ReplicaGlobalSecondaryIndexOptions;
+    };
+}
+/**
+ * Properties used to configure a DynamoDB table.
+ */
+export interface TablePropsV2 extends TableOptionsV2 {
+    /**
+     * Partition key attribute definition.
+     */
+    readonly partitionKey: Attribute;
+    /**
+     * Sort key attribute definition.
+     *
+     * @default - no sort key
+     */
+    readonly sortKey?: Attribute;
+    /**
+     * The name of the table.
+     *
+     * @default - generated by CloudFormation
+     */
+    readonly tableName?: string;
+    /**
+     * The name of the TTL attribute.
+     *
+     * @default - TTL is disabled
+     */
+    readonly timeToLiveAttribute?: string;
+    /**
+     * When an item in the table is modified, StreamViewType determines what information is
+     * written to the stream.
+     *
+     * @default - streams are disabled if replicas are not configured and this property is
+     * not specified. If this property is not specified when replicas are configured, then
+     * NEW_AND_OLD_IMAGES will be the StreamViewType for all replicas
+     */
+    readonly dynamoStream?: StreamViewType;
+    /**
+     * The removal policy applied to the table.
+     *
+     * @default RemovalPolicy.RETAIN
+     */
+    readonly removalPolicy?: RemovalPolicy;
+    /**
+     * The billing mode and capacity settings to apply to the table.
+     *
+     * @default Billing.onDemand()
+     */
+    readonly billing?: Billing;
+    /**
+     * Replica tables to deploy with the primary table.
+     *
+     * Note: Adding replica tables allows you to use your table as a global table. You
+     * cannot specify a replica table in the region that the primary table will be deployed
+     * to. Replica tables will only be supported if the stack deployment region is defined.
+     *
+     * @default - no replica tables
+     */
+    readonly replicas?: ReplicaTableProps[];
+    /**
+     * Controls whether table settings are synchronized across replicas.
+     *
+     * When set to ALL, synchronizable settings (billing mode, throughput, TTL, streams view type, GSIs)
+     * are automatically replicated across all replicas. When set to NONE, each replica manages its own
+     * settings independently (billing mode must be PAY_PER_REQUEST).
+     *
+     * Note: Some settings are always synchronized (key schema, LSIs) regardless of this setting,
+     * and some are never synchronized (table class, SSE, deletion protection, PITR, tags, resource policy).
+     *
+     * @default GlobalTableSettingsReplicationMode.NONE
+     */
+    readonly globalTableSettingsReplicationMode?: GlobalTableSettingsReplicationMode;
+    /**
+     * The witness Region for the MRSC global table.
+     * A MRSC global table can be configured with either three replicas, or with two replicas and one witness.
+     *
+     * Note: Witness region cannot be specified for a Multi-Region Eventual Consistency (MREC) Global Table.
+     * Witness regions are only supported for Multi-Region Strong Consistency (MRSC) Global Tables.
+     *
+     * @default - no witness region
+     */
+    readonly witnessRegion?: string;
+    /**
+     * Specifies the consistency mode for a new global table.
+     *
+     * @default MultiRegionConsistency.EVENTUAL
+     */
+    readonly multiRegionConsistency?: MultiRegionConsistency;
+    /**
+     * Global secondary indexes.
+     *
+     * Note: You can provide a maximum of 20 global secondary indexes.
+     *
+     * @default - no global secondary indexes
+     */
+    readonly globalSecondaryIndexes?: GlobalSecondaryIndexPropsV2[];
+    /**
+     * Local secondary indexes.
+     *
+     * Note: You can only provide a maximum of 5 local secondary indexes.
+     *
+     * @default - no local secondary indexes
+     */
+    readonly localSecondaryIndexes?: LocalSecondaryIndexProps[];
+    /**
+     * The server-side encryption.
+     *
+     * @default TableEncryptionV2.dynamoOwnedKey()
+     */
+    readonly encryption?: TableEncryptionV2;
+    /**
+     * The warm throughput configuration for the table.
+     *
+     * @default - no warm throughput is configured
+     */
+    readonly warmThroughput?: WarmThroughput;
+}
+/**
+ * Properties for creating a multi-account replica table.
+ *
+ * Note: partitionKey, sortKey, and localSecondaryIndexes are not options because CloudFormation
+ * automatically inherits the key schema and LSIs from the source table via globalTableSourceArn.
+ */
+export interface TableV2MultiAccountReplicaProps extends TableOptionsV2 {
+    /**
+     * The source table to replicate from.
+     *
+     * [disable-awslint:prefer-ref-interface]
+     *
+     * @default - must be provided
+     */
+    readonly replicaSourceTable?: ITableV2;
+    /**
+     * Enforces a particular physical table name.
+     *
+     * @default - generated by CloudFormation
+     */
+    readonly tableName?: string;
+    /**
+     * The server-side encryption configuration for the replica table.
+     *
+     * Note: Each replica manages its own encryption independently. This is not synchronized
+     * across replicas.
+     *
+     * @default TableEncryptionV2.dynamoOwnedKey()
+     */
+    readonly encryption?: TableEncryptionV2;
+    /**
+     * The removal policy applied to the table.
+     *
+     * @default RemovalPolicy.RETAIN
+     */
+    readonly removalPolicy?: RemovalPolicy;
+    /**
+     * Controls whether table settings are synchronized across replicas.
+     *
+     * When set to ALL, synchronizable settings (billing mode, throughput, TTL, streams view type, GSIs)
+     * are automatically replicated across all replicas. When set to NONE, each replica manages its own
+     * settings independently (billing mode must be PAY_PER_REQUEST).
+     *
+     * Note: Some settings are always synchronized (key schema, LSIs) regardless of this setting,
+     * and some are never synchronized (table class, SSE, deletion protection, PITR, tags, resource policy).
+     *
+     * @default GlobalTableSettingsReplicationMode.ALL
+     */
+    readonly globalTableSettingsReplicationMode?: GlobalTableSettingsReplicationMode;
+    /**
+     * Whether or not to grant permissions for all indexes of the table.
+     *
+     * Note: If false, permissions will only be granted to indexes when `globalIndexes` is specified.
+     *
+     * @default false
+     */
+    readonly grantIndexPermissions?: boolean;
+}
+/**
+ * Attributes of a DynamoDB table.
+ */
+export interface TableAttributesV2 {
+    /**
+     * The ARN of the table.
+     *
+     * Note: You must specify this or the `tableName`.
+     *
+     * @default - table arn generated using `tableName` and region of stack
+     */
+    readonly tableArn?: string;
+    /**
+     * The name of the table.
+     *
+     * Note: You must specify this or the `tableArn`.
+     *
+     * @default - table name retrieved from provided `tableArn`
+     */
+    readonly tableName?: string;
+    /**
+     * The ID of the table.
+     *
+     * @default - no table id
+     */
+    readonly tableId?: string;
+    /**
+     * The stream ARN of the table.
+     *
+     * @default - no table stream ARN
+     */
+    readonly tableStreamArn?: string;
+    /**
+     * KMS encryption key for the table.
+     *
+     * @default - no KMS encryption key
+     */
+    readonly encryptionKey?: IKey;
+    /**
+     * The name of the global indexes set for the table.
+     *
+     * Note: You must set either this property or `localIndexes` if you want permissions
+     * to be granted for indexes as well as the table itself.
+     *
+     * @default - no global indexes
+     */
+    readonly globalIndexes?: string[];
+    /**
+     * The name of the local indexes set for the table.
+     *
+     * Note: You must set either this property or `globalIndexes` if you want permissions
+     * to be granted for indexes as well as the table itself.
+     *
+     * @default - no local indexes
+     */
+    readonly localIndexes?: string[];
+    /**
+     * Whether or not to grant permissions for all indexes of the table.
+     *
+     * Note: If false, permissions will only be granted to indexes when `globalIndexes`
+     * or `localIndexes` is specified.
+     *
+     * @default false
+     */
+    readonly grantIndexPermissions?: boolean;
+}
+/**
+ * A DynamoDB Table.
+ */
+export declare class TableV2 extends TableBaseV2 {
+    /**
+     * Uniquely identifies this class.
+     */
+    static readonly PROPERTY_INJECTION_ID: string;
+    /**
+     * Creates a Table construct that represents an external table via table name.
+     *
+     * @param scope the parent creating construct (usually `this`)
+     * @param id the construct's name
+     * @param tableName the table's name
+     */
+    static fromTableName(scope: Construct, id: string, tableName: string): ITableV2;
+    /**
+     * Creates a Table construct that represents an external table via table ARN.
+     *
+     * @param scope the parent creating construct (usually `this`)
+     * @param id the construct's name
+     * @param tableArn the table's ARN
+     */
+    static fromTableArn(scope: Construct, id: string, tableArn: string): ITableV2;
+    /**
+     * Creates a Table construct that represents an external table.
+     *
+     * @param scope the parent creating construct (usually `this`)
+     * @param id the construct's name
+     * @param attrs attributes of the table
+     */
+    static fromTableAttributes(scope: Construct, id: string, attrs: TableAttributesV2): ITableV2;
+    readonly encryptionKey?: IKey;
+    /**
+     * @attribute
+     */
+    resourcePolicy?: PolicyDocument;
+    /**
+     * Grants for this table
+     */
+    readonly grants: TableGrants;
+    protected readonly region: string;
+    protected readonly tags: TagManager;
+    private readonly billingMode;
+    private readonly partitionKey;
+    private readonly hasSortKey;
+    private readonly tableOptions;
+    private readonly encryption?;
+    private readonly resource;
+    private readonly keySchema;
+    private readonly _attributeDefinitions;
+    private readonly nonKeyAttributes;
+    private readonly readProvisioning?;
+    private readonly writeProvisioning?;
+    private readonly maxReadRequestUnits?;
+    private readonly maxWriteRequestUnits?;
+    private readonly replicaTables;
+    private readonly replicaKeys;
+    private readonly replicaTableArns;
+    private readonly replicaStreamArns;
+    private readonly globalSecondaryIndexes;
+    private readonly localSecondaryIndexes;
+    private readonly globalSecondaryIndexReadCapacitys;
+    private readonly globalSecondaryIndexMaxReadUnits;
+    private readonly globalTableSettingsReplicationMode?;
+    get tableArn(): string;
+    get tableName(): string;
+    get tableStreamArn(): string | undefined;
+    get tableId(): string | undefined;
+    constructor(scope: Construct, id: string, props: TablePropsV2);
+    /**
+     * Adds a statement to the resource policy associated with this table.
+     * A resource policy will be automatically created upon the first call to `addToResourcePolicy`.
+     *
+     * Note that this does not work with imported tables.
+     *
+     * @param statement The policy statement to add
+     */
+    addToResourcePolicy(statement: PolicyStatement): AddToResourcePolicyResult;
+    /**
+     * Add a replica table.
+     *
+     * Note: Adding a replica table will allow you to use your table as a global table.
+     *
+     * @param props the properties of the replica table to add
+     */
+    addReplica(props: ReplicaTableProps): void;
+    /**
+     * Add a global secondary index to the table.
+     *
+     * Note: Global secondary indexes will be inherited by all replica tables.
+     *
+     * @param props the properties of the global secondary index
+     */
+    addGlobalSecondaryIndex(props: GlobalSecondaryIndexPropsV2): void;
+    /**
+     * Add a local secondary index to the table.
+     *
+     * Note: Local secondary indexes will be inherited by all replica tables.
+     *
+     * @param props the properties of the local secondary index
+     */
+    addLocalSecondaryIndex(props: LocalSecondaryIndexProps): void;
+    /**
+     * Retrieve a replica table.
+     *
+     * Note: Replica tables are not supported in a region agnostic stack.
+     *
+     * @param region the region of the replica table
+     */
+    replica(region: string): ITableV2;
+    private configureReplicaTable;
+    private configureGlobalSecondaryIndex;
+    private configureLocalSecondaryIndex;
+    private configureReplicaGlobalSecondaryIndexes;
+    private configureIndexKeySchema;
+    private configureIndexProjection;
+    private configureReplicaKeys;
+    private renderReplicaTables;
+    private renderStreamSpecification;
+    private addKey;
+    private addAttributeDefinition;
+    protected get hasIndex(): boolean;
+    private validateIndexName;
+    private validateIndexProjection;
+    private validateReplicaIndexOptions;
+    private validateReplica;
+    private validateGlobalSecondaryIndex;
+    private validateLocalSecondaryIndex;
+    private validatePitr;
+    private validateMrscConfiguration;
+    private validateCCI;
+}
+/**
+ * A multi-account replica of a DynamoDB table.
+ *
+ * This construct represents a replica table in a different AWS account from the source table.
+ * It inherits the schema (partition key, sort key, and indexes) from the source table.
+ *
+ * Permissions on the replica side are automatically configured. You must manually add
+ * permissions to the source table using `sourceTable.grants.nultiAccountReplicationTo(replica.tableArn)`.
+ *
+ * @resource AWS::DynamoDB::GlobalTable
+ */
+export declare class TableV2MultiAccountReplica extends TableBaseV2 {
+    /** Uniquely identifies this class. */
+    static readonly PROPERTY_INJECTION_ID: string;
+    /**
+     * @attribute
+     */
+    readonly tableStreamArn?: string;
+    /**
+     * @attribute
+     */
+    readonly tableId?: string;
+    readonly encryptionKey?: IKey;
+    /**
+     * @attribute
+     */
+    resourcePolicy?: PolicyDocument;
+    /**
+     * Grants for this table
+     */
+    readonly grants: TableGrants;
+    protected readonly region: string;
+    private readonly resource;
+    private readonly _hasIndex;
+    get tableArn(): string;
+    get tableName(): string;
+    constructor(scope: Construct, id: string, props?: TableV2MultiAccountReplicaProps);
+    /**
+     * Adds a statement to the resource policy associated with this table.
+     */
+    addToResourcePolicy(statement: PolicyStatement): AddToResourcePolicyResult;
+    protected get hasIndex(): boolean;
+    private validateMultiAccountReplica;
+}
+export {};

cdk/node_modules/aws-cdk-lib/aws-dynamodb/lib/table.d.ts

@@ -0,0 +1,963 @@
+import { Construct } from 'constructs';
+import type { ITableRef, TableReference } from './dynamodb.generated';
+import { CfnTable } from './dynamodb.generated';
+import type { EnableScalingProps, IScalableTableAttribute } from './scalable-attribute-api';
+import type { OperationsMetricOptions, SystemErrorsForOperationsMetricOptions, Attribute, ITable, SecondaryIndexProps, TableClass, LocalSecondaryIndexProps, WarmThroughput, PointInTimeRecoverySpecification, ContributorInsightsSpecification, KeySchema } from './shared';
+import { BillingMode, TableEncryption, StreamViewType } from './shared';
+import { StreamGrants } from './stream-grants';
+import { TableGrants } from './table-grants';
+import * as cloudwatch from '../../aws-cloudwatch';
+import * as iam from '../../aws-iam';
+import type { GrantOnKeyResult, IEncryptedResource, IGrantable } from '../../aws-iam';
+import type * as kinesis from '../../aws-kinesis';
+import * as kms from '../../aws-kms';
+import type * as s3 from '../../aws-s3';
+import type { Duration } from '../../core';
+import { Resource, RemovalPolicy } from '../../core';
+/**
+ * Represents the table schema attributes.
+ */
+export interface SchemaOptions {
+    /**
+     * Partition key attribute definition.
+     *
+     * If a single field forms the partition key, you can use this field.  Use the
+     * `partitionKeys` field if the partition key is a multi-attribute key (consists of
+     * multiple fields).
+     *
+     * @default - exactly one of `partitionKey` and `partitionKeys` must be specified.
+     */
+    readonly partitionKey?: Attribute;
+    /**
+     * Sort key attribute definition.
+     *
+     * If a single field forms the sort key, you can use this field.  Use the
+     * `sortKeys` field if the sort key is a multi-attribute key (consists of multiple
+     * fields).
+     *
+     * @default - no sort key
+     */
+    readonly sortKey?: Attribute;
+}
+/**
+ * Type of compression to use for imported data.
+ */
+export declare enum InputCompressionType {
+    /**
+     * GZIP compression.
+     */
+    GZIP = "GZIP",
+    /**
+     * ZSTD compression.
+     */
+    ZSTD = "ZSTD",
+    /**
+     * No compression.
+     */
+    NONE = "NONE"
+}
+/**
+ * The options for imported source files in CSV format.
+ */
+export interface CsvOptions {
+    /**
+     * The delimiter used for separating items in the CSV file being imported.
+     *
+     * Valid delimiters are as follows:
+     * - comma (`,`)
+     * - tab (`\t`)
+     * - colon (`:`)
+     * - semicolon (`;`)
+     * - pipe (`|`)
+     * - space (` `)
+     *
+     * @default - use comma as a delimiter.
+     */
+    readonly delimiter?: string;
+    /**
+     * List of the headers used to specify a common header for all source CSV files being imported.
+     *
+     * **NOTE**: If this field is specified then the first line of each CSV file is treated as data instead of the header.
+     * If this field is not specified the first line of each CSV file is treated as the header.
+     *
+     * @default - the first line of the CSV file is treated as the header
+     */
+    readonly headerList?: string[];
+}
+/**
+ * The format of the source data.
+ */
+export declare abstract class InputFormat {
+    /**
+     * DynamoDB JSON format.
+     */
+    static dynamoDBJson(): InputFormat;
+    /**
+     * Amazon Ion format.
+     */
+    static ion(): InputFormat;
+    /**
+     * CSV format.
+     */
+    static csv(options?: CsvOptions): InputFormat;
+    /**
+     * Valid CSV delimiters.
+     *
+     * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-dynamodb-table-csv.html#cfn-dynamodb-table-csv-delimiter
+     */
+    private static validCsvDelimiters;
+    private static readableValidCsvDelimiters;
+    /**
+     * Render the input format and options.
+     *
+     * @internal
+     */
+    abstract _render(): Pick<CfnTable.ImportSourceSpecificationProperty, 'inputFormat' | 'inputFormatOptions'>;
+}
+/**
+ *  Properties for importing data from the S3.
+ */
+export interface ImportSourceSpecification {
+    /**
+     * The compression type of the imported data.
+     *
+     * @default InputCompressionType.NONE
+     */
+    readonly compressionType?: InputCompressionType;
+    /**
+     * The format of the imported data.
+     */
+    readonly inputFormat: InputFormat;
+    /**
+     * The S3 bucket that is being imported from.
+     */
+    readonly bucket: s3.IBucket;
+    /**
+     * The account number of the S3 bucket that is being imported from.
+     *
+     * @default - no value
+     */
+    readonly bucketOwner?: string;
+    /**
+     * The key prefix shared by all S3 Objects that are being imported.
+     *
+     * @default - no value
+     */
+    readonly keyPrefix?: string;
+}
+/**
+ * The precision associated with the DynamoDB write timestamps that will be replicated to Kinesis.
+ * The default setting for record timestamp precision is microseconds. You can change this setting at any time.
+ * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-dynamodb-table-kinesisstreamspecification.html#aws-properties-dynamodb-table-kinesisstreamspecification-properties
+ */
+export declare enum ApproximateCreationDateTimePrecision {
+    /**
+     * Millisecond precision
+     */
+    MILLISECOND = "MILLISECOND",
+    /**
+     * Microsecond precision
+     */
+    MICROSECOND = "MICROSECOND"
+}
+/**
+ * Properties of a DynamoDB Table
+ *
+ * Use `TableProps` for all table properties
+ */
+export interface TableOptions extends SchemaOptions {
+    /**
+     * The read capacity for the table. Careful if you add Global Secondary Indexes, as
+     * those will share the table's provisioned throughput.
+     *
+     * Can only be provided if billingMode is Provisioned.
+     *
+     * @default 5
+     */
+    readonly readCapacity?: number;
+    /**
+     * The write capacity for the table. Careful if you add Global Secondary Indexes, as
+     * those will share the table's provisioned throughput.
+     *
+     * Can only be provided if billingMode is Provisioned.
+     *
+     * @default 5
+     */
+    readonly writeCapacity?: number;
+    /**
+     * The maximum read request units for the table. Careful if you add Global Secondary Indexes, as
+     * those will share the table's maximum on-demand throughput.
+     *
+     * Can only be provided if billingMode is PAY_PER_REQUEST.
+     *
+     * @default - on-demand throughput is disabled
+     */
+    readonly maxReadRequestUnits?: number;
+    /**
+     * The write request units for the table. Careful if you add Global Secondary Indexes, as
+     * those will share the table's maximum on-demand throughput.
+     *
+     * Can only be provided if billingMode is PAY_PER_REQUEST.
+     *
+     * @default - on-demand throughput is disabled
+     */
+    readonly maxWriteRequestUnits?: number;
+    /**
+     * Specify how you are charged for read and write throughput and how you manage capacity.
+     *
+     * @default PROVISIONED if `replicationRegions` is not specified, PAY_PER_REQUEST otherwise
+     */
+    readonly billingMode?: BillingMode;
+    /**
+     * Specify values to pre-warm you DynamoDB Table
+     * Warm Throughput feature is not available for Global Table replicas using the `Table` construct. To enable Warm Throughput, use the `TableV2` construct instead.
+     * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-dynamodb-table.html#cfn-dynamodb-table-warmthroughput
+     * @default - warm throughput is not configured
+     */
+    readonly warmThroughput?: WarmThroughput;
+    /**
+     * Whether point-in-time recovery is enabled.
+     * @deprecated use `pointInTimeRecoverySpecification` instead
+     * @default false - point in time recovery is not enabled.
+     */
+    readonly pointInTimeRecovery?: boolean;
+    /**
+     * Whether point-in-time recovery is enabled
+     * and recoveryPeriodInDays is set.
+     *
+     * @default - point in time recovery is not enabled.
+     */
+    readonly pointInTimeRecoverySpecification?: PointInTimeRecoverySpecification;
+    /**
+     * Specify the table class.
+     * @default STANDARD
+     */
+    readonly tableClass?: TableClass;
+    /**
+     * Whether server-side encryption with an AWS managed customer master key is enabled.
+     *
+     * This property cannot be set if `serverSideEncryption` is set.
+     *
+     * > **NOTE**: if you set this to `CUSTOMER_MANAGED` and `encryptionKey` is not
+     * > specified, the key that the Tablet generates for you will be created with
+     * > default permissions. If you are using CDKv2, these permissions will be
+     * > sufficient to enable the key for use with DynamoDB tables.  If you are
+     * > using CDKv1, make sure the feature flag
+     * > `@aws-cdk/aws-kms:defaultKeyPolicies` is set to `true` in your `cdk.json`.
+     *
+     * @default - The table is encrypted with an encryption key managed by DynamoDB, and you are not charged any fee for using it.
+     */
+    readonly encryption?: TableEncryption;
+    /**
+     * External KMS key to use for table encryption.
+     *
+     * This property can only be set if `encryption` is set to `TableEncryption.CUSTOMER_MANAGED`.
+     *
+     * @default - If `encryption` is set to `TableEncryption.CUSTOMER_MANAGED` and this
+     * property is undefined, a new KMS key will be created and associated with this table.
+     * If `encryption` and this property are both undefined, then the table is encrypted with
+     * an encryption key managed by DynamoDB, and you are not charged any fee for using it.
+     */
+    readonly encryptionKey?: kms.IKey;
+    /**
+     * The name of TTL attribute.
+     * @default - TTL is disabled
+     */
+    readonly timeToLiveAttribute?: string;
+    /**
+     * When an item in the table is modified, StreamViewType determines what information
+     * is written to the stream for this table.
+     *
+     * @default - streams are disabled unless `replicationRegions` is specified
+     */
+    readonly stream?: StreamViewType;
+    /**
+     * The removal policy to apply to the DynamoDB Table.
+     *
+     * @default RemovalPolicy.RETAIN
+     */
+    readonly removalPolicy?: RemovalPolicy;
+    /**
+     * The removal policy to apply to the DynamoDB replica tables.
+     *
+     * @default undefined - use DynamoDB Table's removal policy
+     */
+    readonly replicaRemovalPolicy?: RemovalPolicy;
+    /**
+     * Regions where replica tables will be created
+     *
+     * @default - no replica tables are created
+     */
+    readonly replicationRegions?: string[];
+    /**
+     * The timeout for a table replication operation in a single region.
+     *
+     * @default Duration.minutes(30)
+     */
+    readonly replicationTimeout?: Duration;
+    /**
+     * [WARNING: Use this flag with caution, misusing this flag may cause deleting existing replicas, refer to the detailed documentation for more information]
+     * Indicates whether CloudFormation stack waits for replication to finish.
+     * If set to false, the CloudFormation resource will mark the resource as
+     * created and replication will be completed asynchronously. This property is
+     * ignored if replicationRegions property is not set.
+     *
+     * WARNING:
+     * DO NOT UNSET this property if adding/removing multiple replicationRegions
+     * in one deployment, as CloudFormation only supports one region replication
+     * at a time. CDK overcomes this limitation by waiting for replication to
+     * finish before starting new replicationRegion.
+     *
+     * If the custom resource which handles replication has a physical resource
+     * ID with the format `region` instead of `tablename-region` (this would happen
+     * if the custom resource hasn't received an event since v1.91.0), DO NOT SET
+     * this property to false without making a change to the table name.
+     * This will cause the existing replicas to be deleted.
+     *
+     * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-dynamodb-globaltable.html#cfn-dynamodb-globaltable-replicas
+     * @default true
+     */
+    readonly waitForReplicationToFinish?: boolean;
+    /**
+     * Whether CloudWatch contributor insights is enabled.
+     * @deprecated use `contributorInsightsSpecification instead
+     * @default false
+     */
+    readonly contributorInsightsEnabled?: boolean;
+    /**
+     * Whether CloudWatch contributor insights is enabled and what mode is selected
+     * @default - contributor insights is not enabled
+     */
+    readonly contributorInsightsSpecification?: ContributorInsightsSpecification;
+    /**
+     * Enables deletion protection for the table.
+     *
+     * @default false
+     */
+    readonly deletionProtection?: boolean;
+    /**
+     * The properties of data being imported from the S3 bucket source to the table.
+     *
+     * @default - no data import from the S3 bucket
+     */
+    readonly importSource?: ImportSourceSpecification;
+    /**
+     * Resource policy to assign to table.
+     * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-dynamodb-table.html#cfn-dynamodb-table-resourcepolicy
+     * @default - No resource policy statement
+     */
+    readonly resourcePolicy?: iam.PolicyDocument;
+}
+/**
+ * Properties for a DynamoDB Table
+ */
+export interface TableProps extends TableOptions {
+    /**
+     * Enforces a particular physical table name.
+     * @default <generated>
+     */
+    readonly tableName?: string;
+    /**
+     * Kinesis Data Stream to capture item-level changes for the table.
+     *
+     * @default - no Kinesis Data Stream
+     */
+    readonly kinesisStream?: kinesis.IStream;
+    /**
+     * Kinesis Data Stream approximate creation timestamp precision
+     *
+     * @default ApproximateCreationDateTimePrecision.MICROSECOND
+     */
+    readonly kinesisPrecisionTimestamp?: ApproximateCreationDateTimePrecision;
+}
+/**
+ * Properties for a global secondary index
+ */
+export interface GlobalSecondaryIndexProps extends SecondaryIndexProps, SchemaOptions {
+    /**
+     * Multi-attribute partition key
+     *
+     * If a single field forms the partition key, you can use either
+     * `partitionKey` or `partitionKeys` to specify the partition key. Exactly
+     * one of these must be specified.
+     *
+     * You must use `partitionKeys` field if the partition key is a multi-attribute key
+     * (consists of multiple fields).
+     *
+     * NOTE: although the name of this field makes it sound like it creates
+     * multiple keys, it does not. It defines a single key that consists of
+     * of multiple fields.
+     *
+     * The order of fields is not important.
+     *
+     * @default - exactly one of `partitionKey` and `partitionKeys` must be specified.
+     */
+    readonly partitionKeys?: Attribute[];
+    /**
+     * Multi-attribute sort key
+     *
+     * If a single field forms the sort key, you can use either
+     * `sortKey` or `sortKeys` to specify the sort key. At most one of these
+     * may be specified.
+     *
+     * You must use `sortKeys` field if the sort key is a multi-attribute key
+     * (consists of multiple fields).
+     *
+     * NOTE: although the name of this field makes it sound like it creates
+     * multiple keys, it does not. It defines a single key that consists of
+     * of multiple fields at the same time.
+     *
+     * NOTE: The order of fields is important!
+     *
+     * @default - no sort key
+     */
+    readonly sortKeys?: Attribute[];
+    /**
+     * The read capacity for the global secondary index.
+     *
+     * Can only be provided if table billingMode is Provisioned or undefined.
+     *
+     * @default 5
+     */
+    readonly readCapacity?: number;
+    /**
+     * The write capacity for the global secondary index.
+     *
+     * Can only be provided if table billingMode is Provisioned or undefined.
+     *
+     * @default 5
+     */
+    readonly writeCapacity?: number;
+    /**
+     * The maximum read request units for the global secondary index.
+     *
+     * Can only be provided if table billingMode is PAY_PER_REQUEST.
+     *
+     * @default - on-demand throughput is disabled
+     */
+    readonly maxReadRequestUnits?: number;
+    /**
+     * The maximum write request units for the global secondary index.
+     *
+     * Can only be provided if table billingMode is PAY_PER_REQUEST.
+     *
+     * @default - on-demand throughput is disabled
+     */
+    readonly maxWriteRequestUnits?: number;
+    /**
+     * The warm throughput configuration for the global secondary index.
+     *
+     * @default - no warm throughput is configured
+     */
+    readonly warmThroughput?: WarmThroughput;
+    /**
+     * Whether CloudWatch contributor insights is enabled for the specified global secondary index.
+     * @deprecated use `contributorInsightsSpecification` instead
+     * @default false
+     */
+    readonly contributorInsightsEnabled?: boolean;
+    /**
+     * Whether CloudWatch contributor insights is enabled and what mode is selected
+     * @default - contributor insights is not enabled
+     */
+    readonly contributorInsightsSpecification?: ContributorInsightsSpecification;
+}
+/**
+ * Reference to a dynamodb table.
+ */
+export interface TableAttributes {
+    /**
+     * The ARN of the dynamodb table.
+     * One of this, or `tableName`, is required.
+     *
+     * @default - no table arn
+     */
+    readonly tableArn?: string;
+    /**
+     * The table name of the dynamodb table.
+     * One of this, or `tableArn`, is required.
+     *
+     * @default - no table name
+     */
+    readonly tableName?: string;
+    /**
+     * The ARN of the table's stream.
+     *
+     * @default - no table stream
+     */
+    readonly tableStreamArn?: string;
+    /**
+     * KMS encryption key, if this table uses a customer-managed encryption key.
+     *
+     * @default - no key
+     */
+    readonly encryptionKey?: kms.IKey;
+    /**
+     * The name of the global indexes set for this Table.
+     * Note that you need to set either this property,
+     * or `localIndexes`,
+     * if you want methods like grantReadData()
+     * to grant permissions for indexes as well as the table itself.
+     *
+     * @default - no global indexes
+     */
+    readonly globalIndexes?: string[];
+    /**
+     * The name of the local indexes set for this Table.
+     * Note that you need to set either this property,
+     * or `globalIndexes`,
+     * if you want methods like grantReadData()
+     * to grant permissions for indexes as well as the table itself.
+     *
+     * @default - no local indexes
+     */
+    readonly localIndexes?: string[];
+    /**
+     * If set to true, grant methods always grant permissions for all indexes.
+     * If false is provided, grant methods grant the permissions
+     * only when `globalIndexes` or `localIndexes` is specified.
+     *
+     * @default - false
+     */
+    readonly grantIndexPermissions?: boolean;
+}
+export declare abstract class TableBase extends Resource implements ITable, ITableRef, iam.IResourceWithPolicy, IEncryptedResource {
+    /**
+     * @attribute
+     */
+    abstract readonly tableArn: string;
+    /**
+     * @attribute
+     */
+    abstract readonly tableName: string;
+    /**
+     * @attribute
+     */
+    abstract readonly tableStreamArn?: string;
+    /**
+     * KMS encryption key, if this table uses a customer-managed encryption key.
+     */
+    abstract readonly encryptionKey?: kms.IKey;
+    /**
+     * Resource policy to assign to table.
+     * @attribute
+     */
+    abstract resourcePolicy?: iam.PolicyDocument;
+    /**
+     * Additional regions other than the main one that this table is replicated to
+     *
+     */
+    abstract readonly regions?: string[];
+    /**
+     * @deprecated This member is still filled but it is not read
+     */
+    protected readonly regionalArns: string[];
+    grantOnKey(grantee: IGrantable, ...actions: string[]): GrantOnKeyResult;
+    get tableRef(): TableReference;
+    /**
+     * Grant a predefined set of permissions on this Table.
+     */
+    get grants(): TableGrants;
+    /**
+     * Grant a predefined set of permissions on this Table's Stream, if present.
+     *
+     * Will throw if the Table has not been configured for streaming.
+     */
+    get streamGrants(): StreamGrants;
+    /**
+     * Adds a statement to the resource policy associated with this table.
+     */
+    abstract addToResourcePolicy(statement: iam.PolicyStatement): iam.AddToResourcePolicyResult;
+    /**
+     * Adds an IAM policy statement associated with this table to an IAM
+     * principal's policy.
+     *
+     * If `encryptionKey` is present, appropriate grants to the key needs to be added
+     * separately using the `table.encryptionKey.grant*` methods.
+     * [disable-awslint:no-grants]
+     *
+     * @param grantee The principal (no-op if undefined)
+     * @param actions The set of actions to allow (i.e. "dynamodb:PutItem", "dynamodb:GetItem", ...)
+     */
+    grant(grantee: iam.IGrantable, ...actions: string[]): iam.Grant;
+    /**
+     * Adds an IAM policy statement associated with this table's stream to an
+     * IAM principal's policy.
+     *
+     * If `encryptionKey` is present, appropriate grants to the key needs to be added
+     * separately using the `table.encryptionKey.grant*` methods.
+     *
+     *
+     * The use of this method is discouraged. Please use `streamGrants.stream()` instead.
+     *
+     * [disable-awslint:no-grants]
+     *
+     * @param grantee The principal (no-op if undefined)
+     * @param actions The set of actions to allow (i.e. "dynamodb:DescribeStream", "dynamodb:GetRecords", ...)
+     */
+    grantStream(grantee: iam.IGrantable, ...actions: string[]): iam.Grant;
+    /**
+     * Permits an IAM principal all data read operations from this table:
+     * BatchGetItem, GetRecords, GetShardIterator, Query, GetItem, Scan, DescribeTable.
+     *
+     * Appropriate grants will also be added to the customer-managed KMS key
+     * if one was configured.
+     *
+     *
+     * The use of this method is discouraged. Please use `grants.readData()` instead.
+     *
+     * [disable-awslint:no-grants]
+     *
+     * @param grantee The principal to grant access to
+     */
+    grantReadData(grantee: iam.IGrantable): iam.Grant;
+    /**
+     * Permits an IAM Principal to list streams attached to current dynamodb table.
+     *
+     *
+     * The use of this method is discouraged. Please use `streamGrants.tableListStreams()` instead.
+     *
+     * [disable-awslint:no-grants]
+     *
+     * @param grantee The principal (no-op if undefined)
+     */
+    grantTableListStreams(grantee: iam.IGrantable): iam.Grant;
+    /**
+     * Permits an IAM principal all stream data read operations for this
+     * table's stream:
+     * DescribeStream, GetRecords, GetShardIterator, ListStreams.
+     *
+     * Appropriate grants will also be added to the customer-managed KMS key
+     * if one was configured.
+     *
+     *
+     * The use of this method is discouraged. Please use `streamGrants.streamRead()` instead.
+     *
+     * [disable-awslint:no-grants]
+     *
+     * @param grantee The principal to grant access to
+     */
+    grantStreamRead(grantee: iam.IGrantable): iam.Grant;
+    /**
+     * Permits an IAM principal all data write operations to this table:
+     * BatchWriteItem, PutItem, UpdateItem, DeleteItem, DescribeTable.
+     *
+     * Appropriate grants will also be added to the customer-managed KMS key
+     * if one was configured.
+     *
+     *
+     * The use of this method is discouraged. Please use `grants.writeData()` instead.
+     *
+     * [disable-awslint:no-grants]
+     *
+     * @param grantee The principal to grant access to
+     */
+    grantWriteData(grantee: iam.IGrantable): iam.Grant;
+    /**
+     * Permits an IAM principal to all data read/write operations to this table.
+     * BatchGetItem, GetRecords, GetShardIterator, Query, GetItem, Scan,
+     * BatchWriteItem, PutItem, UpdateItem, DeleteItem, DescribeTable
+     *
+     * Appropriate grants will also be added to the customer-managed KMS key
+     * if one was configured.
+     *
+     *
+     * The use of this method is discouraged. Please use `grants.readWriteData()` instead.
+     *
+     * [disable-awslint:no-grants]
+     *
+     * @param grantee The principal to grant access to
+     */
+    grantReadWriteData(grantee: iam.IGrantable): iam.Grant;
+    /**
+     * Permits all DynamoDB operations ("dynamodb:*") to an IAM principal.
+     *
+     * Appropriate grants will also be added to the customer-managed KMS key
+     * if one was configured.
+     *
+     *
+     * The use of this method is discouraged. Please use `grants.fullAccess()` instead.
+     *
+     * [disable-awslint:no-grants]
+     *
+     * @param grantee The principal to grant access to
+     */
+    grantFullAccess(grantee: iam.IGrantable): iam.Grant;
+    /**
+     * Return the given named metric for this Table
+     *
+     * By default, the metric will be calculated as a sum over a period of 5 minutes.
+     * You can customize this by using the `statistic` and `period` properties.
+     */
+    metric(metricName: string, props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * Metric for the consumed read capacity units this table
+     *
+     * By default, the metric will be calculated as a sum over a period of 5 minutes.
+     * You can customize this by using the `statistic` and `period` properties.
+     */
+    metricConsumedReadCapacityUnits(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * Metric for the consumed write capacity units this table
+     *
+     * By default, the metric will be calculated as a sum over a period of 5 minutes.
+     * You can customize this by using the `statistic` and `period` properties.
+     */
+    metricConsumedWriteCapacityUnits(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * Metric for the system errors this table
+     *
+     * @deprecated use `metricSystemErrorsForOperations`.
+     */
+    metricSystemErrors(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * Metric for the user errors. Note that this metric reports user errors across all
+     * the tables in the account and region the table resides in.
+     *
+     * By default, the metric will be calculated as a sum over a period of 5 minutes.
+     * You can customize this by using the `statistic` and `period` properties.
+     */
+    metricUserErrors(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * Metric for the conditional check failed requests this table
+     *
+     * By default, the metric will be calculated as a sum over a period of 5 minutes.
+     * You can customize this by using the `statistic` and `period` properties.
+     */
+    metricConditionalCheckFailedRequests(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * How many requests are throttled on this table
+     *
+     * Default: sum over 5 minutes
+     *
+     * @deprecated Do not use this function. It returns an invalid metric. Use `metricThrottledRequestsForOperation` instead.
+     */
+    metricThrottledRequests(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * Metric for the successful request latency this table.
+     *
+     * By default, the metric will be calculated as an average over a period of 5 minutes.
+     * You can customize this by using the `statistic` and `period` properties.
+     */
+    metricSuccessfulRequestLatency(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * How many requests are throttled on this table, for the given operation
+     *
+     * Default: sum over 5 minutes
+     */
+    metricThrottledRequestsForOperation(operation: string, props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * How many requests are throttled on this table.
+     *
+     * This will sum errors across all possible operations.
+     * Note that by default, each individual metric will be calculated as a sum over a period of 5 minutes.
+     * You can customize this by using the `statistic` and `period` properties.
+     */
+    metricThrottledRequestsForOperations(props?: OperationsMetricOptions): cloudwatch.IMetric;
+    /**
+     * Metric for the system errors this table.
+     *
+     * This will sum errors across all possible operations.
+     * Note that by default, each individual metric will be calculated as a sum over a period of 5 minutes.
+     * You can customize this by using the `statistic` and `period` properties.
+     */
+    metricSystemErrorsForOperations(props?: SystemErrorsForOperationsMetricOptions): cloudwatch.IMetric;
+    /**
+     * Create a math expression for operations.
+     *
+     * @param metricName The metric name.
+     * @param expressionLabel Label for expression
+     * @param props operation list
+     */
+    private sumMetricsForOperations;
+    /**
+     * Create a map of metrics that can be used in a math expression.
+     *
+     * Using the return value of this function as the `usingMetrics` property in `cloudwatch.MathExpression` allows you to
+     * use the keys of this map as metric names inside you expression.
+     *
+     * @param metricName The metric name.
+     * @param operations The list of operations to create metrics for.
+     * @param props Properties for the individual metrics.
+     * @param metricNameMapper Mapper function to allow controlling the individual metric name per operation.
+     */
+    private createMetricsForOperations;
+    protected abstract get hasIndex(): boolean;
+    private cannedMetric;
+}
+/**
+ * Provides a DynamoDB table.
+ */
+export declare class Table extends TableBase {
+    /**
+     * Uniquely identifies this class.
+     */
+    static readonly PROPERTY_INJECTION_ID: string;
+    /**
+     * Creates a Table construct that represents an external table via table name.
+     *
+     * @param scope The parent creating construct (usually `this`).
+     * @param id The construct's name.
+     * @param tableName The table's name.
+     */
+    static fromTableName(scope: Construct, id: string, tableName: string): ITable;
+    /**
+     * Creates a Table construct that represents an external table via table arn.
+     *
+     * @param scope The parent creating construct (usually `this`).
+     * @param id The construct's name.
+     * @param tableArn The table's ARN.
+     */
+    static fromTableArn(scope: Construct, id: string, tableArn: string): ITable;
+    /**
+     * Creates a Table construct that represents an external table.
+     *
+     * @param scope The parent creating construct (usually `this`).
+     * @param id The construct's name.
+     * @param attrs A `TableAttributes` object.
+     */
+    static fromTableAttributes(scope: Construct, id: string, attrs: TableAttributes): ITable;
+    readonly encryptionKey?: kms.IKey;
+    /**
+     * Resource policy to assign to DynamoDB Table.
+     * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-dynamodb-table-resourcepolicy.html
+     * @default - No resource policy statements are added to the created table.
+     */
+    resourcePolicy?: iam.PolicyDocument;
+    private readonly table;
+    private readonly keySchema;
+    private readonly attributeDefinitions;
+    private readonly _globalSecondaryIndexes;
+    private readonly _localSecondaryIndexes;
+    /**
+     * Schemas for the table and all of the indexes
+     */
+    private readonly schemas;
+    private readonly nonKeyAttributes;
+    private readonly tablePartitionKey?;
+    private readonly tableSortKey?;
+    private readonly billingMode;
+    private readonly tableScaling;
+    private readonly indexScaling;
+    private readonly scalingRole;
+    private readonly globalReplicaCustomResources;
+    readonly regions?: string[] | undefined;
+    get tableArn(): string;
+    get tableName(): string;
+    get tableStreamArn(): string | undefined;
+    constructor(scope: Construct, id: string, props: TableProps);
+    /**
+     * Adds a statement to the resource policy associated with this table.
+     * A resource policy will be automatically created upon the first call to `addToResourcePolicy`.
+     *
+     * Note that this does not work with imported tables.
+     *
+     * @param statement The policy statement to add
+     */
+    addToResourcePolicy(statement: iam.PolicyStatement): iam.AddToResourcePolicyResult;
+    /**
+     * Add a global secondary index of table.
+     *
+     * @param props the property of global secondary index
+     */
+    addGlobalSecondaryIndex(props: GlobalSecondaryIndexProps): void;
+    /**
+     * Add a local secondary index of table.
+     *
+     * @param props the property of local secondary index
+     */
+    addLocalSecondaryIndex(props: LocalSecondaryIndexProps): void;
+    /**
+     * Enable read capacity scaling for this table
+     *
+     * @returns An object to configure additional AutoScaling settings
+     */
+    autoScaleReadCapacity(props: EnableScalingProps): IScalableTableAttribute;
+    /**
+     * Enable write capacity scaling for this table
+     *
+     * @returns An object to configure additional AutoScaling settings for this attribute
+     */
+    autoScaleWriteCapacity(props: EnableScalingProps): IScalableTableAttribute;
+    /**
+     * Enable read capacity scaling for the given GSI
+     *
+     * @returns An object to configure additional AutoScaling settings for this attribute
+     */
+    autoScaleGlobalSecondaryIndexReadCapacity(indexName: string, props: EnableScalingProps): IScalableTableAttribute;
+    /**
+     * Enable write capacity scaling for the given GSI
+     *
+     * @returns An object to configure additional AutoScaling settings for this attribute
+     */
+    autoScaleGlobalSecondaryIndexWriteCapacity(indexName: string, props: EnableScalingProps): IScalableTableAttribute;
+    /**
+     * Get schema attributes of table or index.
+     *
+     * @returns Schema of table or index.
+     * @deprecated - use `schemaV2()` instead
+     */
+    schema(indexName?: string): SchemaOptions;
+    /**
+     * Get schema attributes of table or index.
+     *
+     * @returns Schema of table or index.
+     */
+    schemaV2(indexName?: string): KeySchema;
+    /**
+     * Validate the table construct.
+     *
+     * @returns an array of validation error message
+     */
+    private validateTable;
+    /**
+     * Validate read and write capacity are not specified for on-demand tables (billing mode PAY_PER_REQUEST).
+     *
+     * @param props read and write capacity properties
+     */
+    private validateProvisioning;
+    /**
+     * Validate index name to check if a duplicate name already exists.
+     *
+     * @param indexName a name of global or local secondary index
+     */
+    private validateIndexName;
+    /**
+     * Validate non-key attributes by checking limits within secondary index, which may vary in future.
+     *
+     * @param nonKeyAttributes a list of non-key attribute names
+     */
+    private validateNonKeyAttributes;
+    private validatePitr;
+    private validateCCI;
+    private buildIndexKeySchema;
+    private buildIndexProjection;
+    private findKey;
+    private addKey;
+    /**
+     * Register the key attribute of table or secondary index to assemble attribute definitions of TableResourceProps.
+     *
+     * @param attribute the key attribute of table or secondary index
+     */
+    private registerAttribute;
+    /**
+     * Return the role that will be used for AutoScaling
+     */
+    private makeScalingRole;
+    /**
+     * Creates replica tables
+     *
+     * @param regions regions where to create tables
+     */
+    private createReplicaTables;
+    /**
+     * Whether this table has indexes
+     */
+    protected get hasIndex(): boolean;
+    /**
+     * Set up key properties and return the Table encryption property from the
+     * user's configuration.
+     */
+    private parseEncryption;
+    private renderImportSourceSpecification;
+}