DescribeStream and GetShardIterator serve the caller's stream for a StreamArn in another account #450

What ExtendDB does

For a StreamArn whose account is not the caller's, DescribeStream and GetShardIterator look the stream up by table name and label in the caller's account and serve it. Authorization evaluates the ARN with the caller's account in place of the one supplied, so an Allow on * permits the call. TagResource on the same ARN is refused with AccessDeniedException by the account check in validate_resource_arn (crates/engine/src/tagging.rs). The stream handlers have no such check.

What DynamoDB does

Measured on 2026-10-22: DescribeStream and GetShardIterator with a stream ARN that names another account return AccessDeniedException to a caller allowed dynamodb:* on *.

Effect

A request that names another account's stream returns the caller's own stream with the same table name and label. No data from the other account is returned. A client that expects a denial for a wrong account gets a stream description instead. With #419, a Deny on the caller's own stream ARN also applies to the foreign spelling; an Allow still reaches it.

Suggested fix

In DescribeStream and GetShardIterator, refuse a stream ARN whose account differs from the caller's with AccessDeniedException before resolving the stream, as validate_resource_arn does for tag operations.