Repository navigation
DescribeStream and GetShardIterator accept a StreamArn with another partition, region or service spelling #451
Description
What ExtendDB does
DescribeStream and GetShardIterator serve the stream for a StreamArn whose partition is aws-cn, whose region is another region or upper-cased, or whose service is DYNAMODB. ListTagsOfResource on the same ARNs returns ValidationException "Invalid TableArn: Invalid ResourceArn provided as input ". DescribeStream's not-found message ends with a period that the service's message does not have.
What DynamoDB does
Measured on 2026-10-22: DescribeStream and ListTagsOfResource return ValidationException "Invalid StreamArn" for each of the four spellings.
Effect
Requests that name a stream ARN the service rejects as invalid are served, and the tag operations report a different message for the same ARN.
Suggested fix
Validate a stream ARN's partition (aws), service (dynamodb) and region (the server's) before authorization and return ValidationException "Invalid StreamArn" on the stream and tag operations. With #419, arn_is_kind in crates/server/src/authz_resource.rs is where a stream ARN is checked before authorization. Drop the trailing period from the DescribeStream not-found message.
Activity
fix(server): refuse stream ARNs outside this account, partition and r…
docs(server): say which cross-account shape answers do not match yet
LeeroyHannigan commentedon Nov 3, 2026
In an account the deployment's catalog holds, #509 answers a
StreamArnwith another partition or region with the resource-based-policy denial. The service answersValidationException"Invalid StreamArn" for an admin and for a caller with no policy (measured 2026-11-03,DescribeStreamwithaws-cnandus-west-2). The shape check belongs before that refusal for an account that exists.