diff --git a/crates/auth/src/policy/evaluator.rs b/crates/auth/src/policy/evaluator.rs
index df321dedf..cf17858e3 100644
--- a/crates/auth/src/policy/evaluator.rs
+++ b/crates/auth/src/policy/evaluator.rs
@@ -77,6 +77,35 @@ pub fn evaluate_policies_arc(
     )
 }
 
+/// Returns true if an explicit Deny statement in any identity policy,
+/// permissions boundary, or session policy matches the action, resource and
+/// context. The server uses this only to choose the AccessDenied message form;
+/// it does not change the authorization decision, which `evaluate_policies_arc`
+/// already made.
+#[must_use]
+pub fn explicit_deny_matches_arc(
+    identity_policies: &[std::sync::Arc<PolicyDocument>],
+    permissions_boundary: Option<&PolicyDocument>,
+    session_policy: Option<&PolicyDocument>,
+    action: &str,
+    resource_arn: &str,
+    context: &impl ConditionContext,
+) -> bool {
+    identity_policies
+        .iter()
+        .map(std::sync::Arc::as_ref)
+        .chain(permissions_boundary)
+        .chain(session_policy)
+        .any(|policy| {
+            policy.statements.iter().any(|stmt| {
+                stmt.effect == Effect::Deny
+                    && action_matches(stmt, action)
+                    && resource_matches(stmt, resource_arn)
+                    && deny_conditions_apply(stmt, context)
+            })
+        })
+}
+
 fn evaluate_with<'a, I>(
     identity_policies: I,
     permissions_boundary: Option<&'a PolicyDocument>,
diff --git a/crates/auth/src/policy/matcher.rs b/crates/auth/src/policy/matcher.rs
index 18e89a6e9..a63a21fda 100755
--- a/crates/auth/src/policy/matcher.rs
+++ b/crates/auth/src/policy/matcher.rs
@@ -4,8 +4,10 @@
 //! Wildcard and ARN matching for IAM policy evaluation.
 //!
 //! `wildcard_match` supports `*` (zero or more characters) and `?` (exactly one
-//! character). `arn_match` splits on `:` and matches each segment independently,
-//! with `*` in a segment matching any value for that segment.
+//! character). `arn_match` splits an ARN into its first five fields plus the
+//! resource field (everything after the fifth `:`) as one field, and matches
+//! each field with `wildcard_match`, so `*` and `?` in the resource field span
+//! `:` and `/`.
 
 /// Match a pattern against a value. Supports `*` and `?` wildcards.
 /// Comparison is case-sensitive.
@@ -87,11 +89,16 @@ fn wildcard_match_impl(p: &[u8], v: &[u8], ignore_case: bool) -> bool {
     pi == plen
 }
 
-/// Match an ARN pattern against an ARN value.
+/// Match an ARN pattern against an ARN value, the way IAM does.
 ///
-/// ARN matching is segment-aware: each colon-separated segment is matched
-/// independently using `wildcard_match`. Both pattern and value must have
-/// the same number of segments (6 for standard ARNs).
+/// The ARN is split into its first five fields (`arn`, partition, service,
+/// region, account) plus the resource field (everything after the fifth `:`)
+/// as a single field. Each field is matched with `wildcard_match`, so `*` and
+/// `?` in the resource field span `:` and `/`. This matters for stream ARNs,
+/// whose label contains `:` (for example
+/// `.../stream/2026-04-08T08:40:22.123`), and for sub-resources separated by
+/// `/` such as `.../index/<name>` and `.../stream/<label>`. Both sides must
+/// have the same number of fields.
 ///
 /// # Examples
 ///
@@ -102,8 +109,8 @@ fn wildcard_match_impl(p: &[u8], v: &[u8], ignore_case: bool) -> bool {
 ///     "arn:aws:dynamodb:us-east-1:123456789012:table/Users"
 /// ));
 /// assert!(arn_match(
-///     "arn:aws:dynamodb:*:*:table/User*",
-///     "arn:aws:dynamodb:us-east-1:123456789012:table/Users"
+///     "arn:aws:dynamodb:*:*:table/T/stream/*",
+///     "arn:aws:dynamodb:us-east-1:123456789012:table/T/stream/2026-04-08T08:40:22.123"
 /// ));
 /// ```
 #[must_use]
@@ -113,16 +120,18 @@ pub fn arn_match(pattern: &str, value: &str) -> bool {
         return true;
     }
 
-    let p_segments: Vec<&str> = pattern.split(':').collect();
-    let v_segments: Vec<&str> = value.split(':').collect();
+    // Split into at most six fields so the resource field (index 5) keeps its
+    // own `:` and `/`; wildcards in it then span those characters.
+    let p_fields: Vec<&str> = pattern.splitn(6, ':').collect();
+    let v_fields: Vec<&str> = value.splitn(6, ':').collect();
 
-    if p_segments.len() != v_segments.len() {
+    if p_fields.len() != v_fields.len() {
         return false;
     }
 
-    p_segments
+    p_fields
         .iter()
-        .zip(v_segments.iter())
+        .zip(v_fields.iter())
         .all(|(p, v)| wildcard_match(p, v))
 }
 
@@ -403,6 +412,57 @@ mod tests {
         ));
     }
 
+    #[test]
+    fn arn_wildcard_stream_label_spans_colons() {
+        // A stream label contains ':'. A trailing '*' on the label must match
+        // across those colons.
+        let value = "arn:aws:dynamodb:us-east-1:123:table/T/stream/2026-10-20T16:17:40.188";
+        assert!(arn_match(
+            "arn:aws:dynamodb:us-east-1:123:table/T/stream/*",
+            value
+        ));
+        assert!(arn_match("arn:aws:dynamodb:*:*:table/T/stream/*", value));
+    }
+
+    #[test]
+    fn arn_exact_stream_label_matches() {
+        let value = "arn:aws:dynamodb:us-east-1:123:table/T/stream/2026-10-20T16:17:40.188";
+        assert!(arn_match(value, value));
+    }
+
+    #[test]
+    fn arn_resource_wildcard_spans_slash() {
+        // 'table/T/*' matches any sub-resource of T (index or stream).
+        assert!(arn_match(
+            "arn:aws:dynamodb:*:*:table/T/*",
+            "arn:aws:dynamodb:us-east-1:123:table/T/index/gsi1"
+        ));
+        assert!(arn_match(
+            "arn:aws:dynamodb:*:*:table/T/*",
+            "arn:aws:dynamodb:us-east-1:123:table/T/stream/2026-10-20T16:17:40.188"
+        ));
+    }
+
+    #[test]
+    fn arn_stream_wildcard_does_not_match_other_table() {
+        assert!(!arn_match(
+            "arn:aws:dynamodb:*:*:table/T/stream/*",
+            "arn:aws:dynamodb:us-east-1:123:table/Other/stream/2026-10-20T16:17:40.188"
+        ));
+    }
+
+    #[test]
+    fn arn_resource_field_count_is_fixed_at_six() {
+        // A value with extra ':' only in the resource still has six fields and
+        // matches an exact pattern field for field.
+        let value = "arn:aws:dynamodb:us-east-1:123:table/T/stream/a:b:c";
+        assert!(arn_match(value, value));
+        assert!(arn_match(
+            "arn:aws:dynamodb:us-east-1:123:table/T/stream/*",
+            value
+        ));
+    }
+
     // --- ip_in_cidr ---
 
     #[test]
diff --git a/crates/core/src/arn.rs b/crates/core/src/arn.rs
new file mode 100644
index 000000000..408d368cc
--- /dev/null
+++ b/crates/core/src/arn.rs
@@ -0,0 +1,220 @@
+// Copyright 2026 ExtendDB contributors
+// SPDX-License-Identifier: Apache-2.0
+
+//! Strict parsing of `DynamoDB` resource ARNs.
+//!
+//! One parser serves request validation, authorization resource derivation, and
+//! the engine resolvers, so they never disagree about the resource an ARN names.
+//! When authorization reads a different table, stream, or backup from a field
+//! than the engine resolves from the same field, a Deny or a narrow Allow
+//! written against the real resource is bypassed. Every entry point that turns
+//! an ARN into a resource identity routes through [`parse`] (or [`fields`] for
+//! the raw five-field split), so a respelling that one layer accepts and another
+//! rejects cannot exist.
+//!
+//! [`parse`] requires the literal `arn:` prefix and five colon-separated fields.
+//! The partition, service, region, and account are captured but not constrained
+//! to any value: a caller that pins them to its deployment does so itself, and a
+//! caller that ignores them (authorization canonicalizes every supplied ARN to
+//! its own deployment) reads only the table and sub-resource.
+
+/// A table sub-resource: a secondary index, a stream, or a backup.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum SubResource {
+    Index(String),
+    Stream(String),
+    Backup(String),
+}
+
+/// The five colon-separated fields of an ARN, with the resource kept whole.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct ArnFields<'a> {
+    pub partition: &'a str,
+    pub service: &'a str,
+    pub region: &'a str,
+    pub account: &'a str,
+    /// Everything after the fifth `:`; keeps any `:` and `/` it contains.
+    pub resource: &'a str,
+}
+
+/// A parsed `DynamoDB` table resource ARN: its ARN fields, the table name, and
+/// an optional sub-resource.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct TableResource {
+    pub partition: String,
+    pub service: String,
+    pub region: String,
+    pub account: String,
+    pub table: String,
+    pub sub: Option<SubResource>,
+}
+
+/// Split a string into the five ARN fields after the `arn:` prefix.
+///
+/// The resource field keeps every `:` and `/` it contains, so a stream ARN's
+/// label (`.../stream/2026-10-20T16:17:40.188`) survives intact. Returns `None`
+/// unless the string begins with `arn:` and has five colon-separated fields.
+#[must_use]
+pub fn fields(arn: &str) -> Option<ArnFields<'_>> {
+    let rest = arn.strip_prefix("arn:")?;
+    let mut it = rest.splitn(5, ':');
+    Some(ArnFields {
+        partition: it.next()?,
+        service: it.next()?,
+        region: it.next()?,
+        account: it.next()?,
+        resource: it.next()?,
+    })
+}
+
+/// Parse an ARN that names a `DynamoDB` table resource.
+///
+/// Returns `Some` only for
+/// `arn:<partition>:<service>:<region>:<account>:table/<name>` or
+/// `arn:<partition>:<service>:<region>:<account>:table/<name>/<kind>/<id>`
+/// with a non-empty table name and, when a sub-resource is present, a known
+/// kind (`index`, `stream`, or `backup`). The resource must split into exactly
+/// one segment (bare table) or three (table, kind, id); any other shape is
+/// `None`. Returns `None` for a missing `arn:` prefix, fewer than five fields,
+/// a resource that is not `table/...`, an empty table name, an unknown
+/// sub-resource kind, a trailing slash (`table/T/`), an empty sub-resource id
+/// (`table/T/stream/`), a repeated `table/` segment
+/// (`table/a/stream/table/b`), or an id that itself contains `/`
+/// (`table/T/stream/a/b`). Real stream labels, index names, and backup ids
+/// carry no `/`, so this is the service's notion of a well-formed resource ARN.
+#[must_use]
+pub fn parse(arn: &str) -> Option<TableResource> {
+    let f = fields(arn)?;
+    let tail = f.resource.strip_prefix("table/")?;
+    // `tail` is `<table>` or `<table>/<kind>/<id>`. Table names, kinds, and ids
+    // contain no `/`, so the resource splits into exactly 1 segment (a bare
+    // table) or 3 (table, kind, id). Any other count, including a repeated
+    // `table/` segment or an id that itself contains `/`, is not a well-formed
+    // DynamoDB resource ARN and is rejected. Real stream labels are timestamps,
+    // index names and backup ids carry no `/`, so nothing legitimate is lost,
+    // and the engine stream resolver (built on this) rejects exactly what the
+    // service treats as malformed.
+    let segs: Vec<&str> = tail.split('/').collect();
+    match segs.as_slice() {
+        [table] if !table.is_empty() => Some(TableResource {
+            partition: f.partition.to_owned(),
+            service: f.service.to_owned(),
+            region: f.region.to_owned(),
+            account: f.account.to_owned(),
+            table: (*table).to_owned(),
+            sub: None,
+        }),
+        [table, kind, id] if !table.is_empty() && !id.is_empty() => {
+            let sub = match *kind {
+                "index" => SubResource::Index((*id).to_owned()),
+                "stream" => SubResource::Stream((*id).to_owned()),
+                "backup" => SubResource::Backup((*id).to_owned()),
+                // An unrecognized sub-resource kind is not a nameable resource.
+                _ => return None,
+            };
+            Some(TableResource {
+                partition: f.partition.to_owned(),
+                service: f.service.to_owned(),
+                region: f.region.to_owned(),
+                account: f.account.to_owned(),
+                table: (*table).to_owned(),
+                sub: Some(sub),
+            })
+        }
+        _ => None,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn fields_requires_arn_prefix_and_five_fields() {
+        assert_eq!(fields("banana"), None);
+        // A leading field other than `arn` has no `arn:` prefix.
+        assert_eq!(
+            fields("xrn:aws:dynamodb:us-east-1:1:table/T/stream/x"),
+            None
+        );
+        // An empty leading field (`:aws:...`) has no `arn:` prefix either.
+        assert_eq!(fields(":aws:dynamodb:us-east-1:1:table/T"), None);
+        assert_eq!(fields("arn:aws:dynamodb:us-east-1"), None);
+        let f = fields("arn:aws:dynamodb:us-east-1:1:table/T").unwrap();
+        assert_eq!(f.partition, "aws");
+        assert_eq!(f.service, "dynamodb");
+        assert_eq!(f.region, "us-east-1");
+        assert_eq!(f.account, "1");
+        assert_eq!(f.resource, "table/T");
+    }
+
+    #[test]
+    fn parses_table_index_stream_backup() {
+        assert_eq!(
+            parse("arn:aws:dynamodb:us-east-1:1:table/T").unwrap().sub,
+            None
+        );
+        assert_eq!(
+            parse("arn:aws:dynamodb:us-east-1:1:table/T/index/gsi1")
+                .unwrap()
+                .sub,
+            Some(SubResource::Index("gsi1".into()))
+        );
+        assert_eq!(
+            parse("arn:aws:dynamodb:us-east-1:1:table/T/stream/2026-10-20T16:17:40.188")
+                .unwrap()
+                .sub,
+            Some(SubResource::Stream("2026-10-20T16:17:40.188".into()))
+        );
+        assert_eq!(
+            parse("arn:aws:dynamodb:us-east-1:1:table/T/backup/01-ab")
+                .unwrap()
+                .sub,
+            Some(SubResource::Backup("01-ab".into()))
+        );
+    }
+
+    #[test]
+    fn captures_all_fields() {
+        let r = parse("arn:aws-cn:dynamodb:eu-west-1:111122223333:table/T/index/g").unwrap();
+        assert_eq!(r.partition, "aws-cn");
+        assert_eq!(r.service, "dynamodb");
+        assert_eq!(r.region, "eu-west-1");
+        assert_eq!(r.account, "111122223333");
+        assert_eq!(r.table, "T");
+        assert_eq!(r.sub, Some(SubResource::Index("g".into())));
+    }
+
+    #[test]
+    fn trailing_slash_empty_id_and_inner_slashes_are_rejected() {
+        // A trailing slash, an empty sub-resource id, a repeated table/
+        // segment, and an id containing '/' are all malformed: the resource
+        // must split into exactly one or three non-empty-table segments.
+        assert_eq!(parse("arn:aws:dynamodb:us-east-1:1:table/T/"), None);
+        assert_eq!(parse("arn:aws:dynamodb:us-east-1:1:table/T/stream/"), None);
+        assert_eq!(
+            parse("arn:aws:dynamodb:us-east-1:1:table/T/stream/a/b"),
+            None
+        );
+        assert_eq!(
+            parse("arn:aws:dynamodb:us-east-1:1:table/a/stream/table/b"),
+            None
+        );
+        assert_eq!(
+            parse("arn:aws:dynamodb:us-east-1:1:table/a/index/table/b"),
+            None
+        );
+    }
+
+    #[test]
+    fn rejects_non_table_empty_table_and_unknown_kind() {
+        assert_eq!(parse("banana"), None);
+        assert_eq!(parse("arn:aws:dynamodb:us-east-1:1:banana/x"), None);
+        assert_eq!(parse("arn:aws:dynamodb:us-east-1:1:table/"), None);
+        assert_eq!(parse("arn:aws:dynamodb:us-east-1:1:table//index/g"), None);
+        assert_eq!(parse("arn:aws:dynamodb:us-east-1:1:table/T/weird/x"), None);
+        // No `arn:` prefix: the A2 bypass input is rejected here, so every
+        // caller built on this parser rejects it.
+        assert_eq!(parse("xrn:aws:dynamodb:us-east-1:1:table/T/stream/x"), None);
+    }
+}
diff --git a/crates/core/src/lib.rs b/crates/core/src/lib.rs
index fdfd80b4d..7331c1a9b 100755
--- a/crates/core/src/lib.rs
+++ b/crates/core/src/lib.rs
@@ -7,6 +7,7 @@
 //! It defines the Virtual `DynamoDB` type system, request/response envelopes,
 //! validation logic, and error types shared across all other crates.
 
+pub mod arn;
 pub mod error;
 pub mod expression;
 pub mod limits;
diff --git a/crates/engine/src/backup.rs b/crates/engine/src/backup.rs
index 510190d1e..81e6eb641 100755
--- a/crates/engine/src/backup.rs
+++ b/crates/engine/src/backup.rs
@@ -33,11 +33,11 @@ fn backup_arn_field(body: &Value, account_id: &str) -> Result<String, DynamoDbEr
             )
         })?;
 
-    // Field 4 of a colon-delimited ARN is the account id. An ARN naming another
-    // account — or one malformed enough to have no account in that position — is
-    // denied before the backend resolves it, matching DynamoDB's authorize-first
-    // behavior.
-    let arn_account = backup_arn.split(':').nth(4);
+    // Field 4 of a colon-delimited ARN is the account id, read through the one
+    // shared ARN parser. An ARN naming another account, or one malformed enough
+    // to have no account in that position, is denied before the backend
+    // resolves it, matching DynamoDB's authorize-first behavior.
+    let arn_account = extenddb_core::arn::fields(backup_arn).map(|f| f.account);
     if arn_account != Some(account_id) {
         return Err(DynamoDbError::AccessDeniedException(
             "Access is denied".to_owned(),
diff --git a/crates/engine/src/import_export.rs b/crates/engine/src/import_export.rs
index d79940420..a6ecba4b9 100755
--- a/crates/engine/src/import_export.rs
+++ b/crates/engine/src/import_export.rs
@@ -387,15 +387,71 @@ async fn wait_for_table_active(
     )))
 }
 
+/// Resolve the table an export `TableArn` names, using the one shared resource
+/// parser so the engine reads the same table authorization checked.
+///
+/// `ExportTableToPointInTime` names its source in `TableArn`, which must be
+/// exactly a table ARN. A well-formed DynamoDB ARN of the wrong kind (a stream,
+/// index, or backup ARN) reaches here after authorization and is refused with
+/// the service's message (measured live, `live-r2/arn-kinds-live.json`). An
+/// unparseable `TableArn` is refused earlier, before authorization, by
+/// `authz_resource::validate_operation_arns`.
 fn extract_table_name_from_arn(arn: &str) -> Result<String, DynamoDbError> {
-    arn.rsplit_once("table/")
-        .map(|(_, name)| name.to_owned())
-        .ok_or_else(|| DynamoDbError::ValidationException(format!("Invalid table ARN: {arn}")))
+    match extenddb_core::arn::parse(arn) {
+        Some(extenddb_core::arn::TableResource {
+            table, sub: None, ..
+        }) => Ok(table),
+        _ => Err(DynamoDbError::ValidationException(
+            INVALID_TABLE_ARN_REQUEST_MESSAGE.to_owned(),
+        )),
+    }
 }
 
+/// The message DynamoDB returns for an export `TableArn` (or a restore source
+/// ARN) that is a well-formed ARN of the wrong resource kind (measured live).
+const INVALID_TABLE_ARN_REQUEST_MESSAGE: &str = "Invalid Request: Table ARN is invalid.";
+
 fn epoch_seconds() -> f64 {
     SystemTime::now()
         .duration_since(SystemTime::UNIX_EPOCH)
         .unwrap_or_default()
         .as_secs_f64()
 }
+
+#[cfg(test)]
+mod export_arn_tests {
+    use super::{INVALID_TABLE_ARN_REQUEST_MESSAGE, extract_table_name_from_arn};
+    use extenddb_core::error::DynamoDbError;
+
+    #[test]
+    fn exact_table_arn_resolves_to_table_name() {
+        assert_eq!(
+            extract_table_name_from_arn("arn:aws:dynamodb:us-east-1:1:table/orders").unwrap(),
+            "orders"
+        );
+    }
+
+    #[test]
+    fn non_bare_table_arn_is_refused_with_the_measured_message() {
+        // A well-formed stream, index, or backup ARN reaches the handler after
+        // authorization and is refused with the service's message. A trailing
+        // slash and the A1 bypass ARN do not parse and are refused earlier, but
+        // the handler refuses them too if reached.
+        for arn in [
+            "arn:aws:dynamodb:us-east-1:1:table/orders/stream/2026-10-20T16:17:40.188",
+            "arn:aws:dynamodb:us-east-1:1:table/orders/index/gsi1",
+            "arn:aws:dynamodb:us-east-1:1:table/orders/backup/01-ab",
+            "arn:aws:dynamodb:us-east-1:1:table/allowed/stream/table/secret",
+            "arn:aws:dynamodb:us-east-1:1:table/orders/",
+            "banana",
+            "xrn:aws:dynamodb:us-east-1:1:table/orders",
+        ] {
+            match extract_table_name_from_arn(arn) {
+                Err(DynamoDbError::ValidationException(m)) => {
+                    assert_eq!(m, INVALID_TABLE_ARN_REQUEST_MESSAGE, "for {arn}");
+                }
+                other => panic!("expected ValidationException for {arn}, got {other:?}"),
+            }
+        }
+    }
+}
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index b31461533..74083fbfa 100755
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -59,6 +59,8 @@ pub use query::handle_query;
 pub use request_limits::check_request_item_counts;
 pub use scan::handle_scan;
 pub use search_vectors::handle_search_vectors;
+pub use streams::{SHARD_ITERATOR_EXPIRED_MESSAGE, ShardIteratorClass, classify_shard_iterator};
+pub use streams::{ShardIterator, decode_shard_iterator, encode_shard_iterator};
 pub use streams::{
     handle_describe_stream, handle_get_records, handle_get_shard_iterator, handle_list_streams,
 };
diff --git a/crates/engine/src/streams.rs b/crates/engine/src/streams.rs
index 40f3b2fc1..83b297253 100755
--- a/crates/engine/src/streams.rs
+++ b/crates/engine/src/streams.rs
@@ -147,8 +147,13 @@ pub async fn handle_get_shard_iterator(
         .unwrap_or_default()
         .as_secs();
 
-    let token = format!("{}|{}|{}|{}", input.shard_id, type_str, seq, created_at);
-    let encoded = base64::Engine::encode(&base64::engine::general_purpose::STANDARD, token);
+    let encoded = encode_shard_iterator(
+        &input.shard_id,
+        type_str,
+        &seq,
+        created_at,
+        &input.stream_arn,
+    );
 
     let output = GetShardIteratorOutput {
         shard_iterator: Some(encoded),
@@ -159,6 +164,102 @@ pub async fn handle_get_shard_iterator(
 /// Shard iterator expiration: 15 minutes (900 seconds), matching real `DynamoDB`.
 const SHARD_ITERATOR_EXPIRY_SECS: u64 = 900;
 
+/// The message `DynamoDB` returns for an expired shard iterator (measured live,
+/// `live-r2/iter-live.json`: an iterator 990 seconds old returns
+/// `ExpiredIteratorException` with exactly this text). Shared so the
+/// authorization layer answers a pre-upgrade iterator with the same text the
+/// engine uses when a current iterator ages out, so both match the service.
+pub const SHARD_ITERATOR_EXPIRED_MESSAGE: &str = "Shard iterator has expired";
+
+/// A decoded shard iterator token.
+///
+/// The token is base64 of `shard_id|type|seq|created_at|stream_arn`, joined by
+/// `|` (no field contains `|`). `stream_arn` is `None` for a token issued by a
+/// build before the stream ARN was carried in the token, and `created_at` is
+/// `None` for a token issued before the expiry timestamp was added.
+pub struct ShardIterator {
+    pub shard_id: String,
+    pub iter_type: String,
+    pub sequence: String,
+    pub created_at: Option<u64>,
+    pub stream_arn: Option<String>,
+}
+
+/// Encode a shard iterator token that carries the stream ARN it reads.
+#[must_use]
+pub fn encode_shard_iterator(
+    shard_id: &str,
+    iter_type: &str,
+    sequence: &str,
+    created_at: u64,
+    stream_arn: &str,
+) -> String {
+    let token = format!("{shard_id}|{iter_type}|{sequence}|{created_at}|{stream_arn}");
+    base64::Engine::encode(&base64::engine::general_purpose::STANDARD, token)
+}
+
+/// Decode a shard iterator token. Returns `None` when the token is not valid
+/// base64 UTF-8 or carries fewer than the two required fields, so callers fail
+/// closed on a token that does not decode.
+#[must_use]
+pub fn decode_shard_iterator(encoded: &str) -> Option<ShardIterator> {
+    let bytes = base64::Engine::decode(&base64::engine::general_purpose::STANDARD, encoded).ok()?;
+    let token = String::from_utf8(bytes).ok()?;
+    let parts: Vec<&str> = token.splitn(5, '|').collect();
+    if parts.len() < 2 {
+        return None;
+    }
+    Some(ShardIterator {
+        shard_id: parts[0].to_owned(),
+        iter_type: parts[1].to_owned(),
+        sequence: parts.get(2).copied().unwrap_or("").to_owned(),
+        created_at: parts.get(3).and_then(|s| s.parse::<u64>().ok()),
+        stream_arn: parts
+            .get(4)
+            .map(|s| (*s).to_owned())
+            .filter(|s| !s.is_empty()),
+    })
+}
+
+/// How `GetRecords` must answer a shard iterator, decided before authorization.
+#[derive(Debug)]
+pub enum ShardIteratorClass {
+    /// A current-format token carrying the stream ARN it reads.
+    Stream(String),
+    /// A token issued by a build before the stream ARN was carried in the
+    /// token: it decodes to exactly the four pre-upgrade fields with a
+    /// parseable timestamp and no stream ARN. Answered with
+    /// `ExpiredIteratorException` so a stream client renews it, rather than the
+    /// non-retryable "Invalid ShardIterator" that would break every consumer
+    /// reading across the upgrade.
+    Expired,
+    /// A token that does not decode, or decodes to neither of the above.
+    Invalid,
+}
+
+/// Classify a `GetRecords` shard iterator for the authorization layer, before
+/// the resource is authorized.
+///
+/// A current token carries its stream ARN. A token with no stream ARN but the
+/// four pre-upgrade fields and a parseable timestamp is an old-format iterator
+/// ([`ShardIteratorClass::Expired`]). Anything that does not decode, or decodes
+/// to fewer fields or an unparseable timestamp, is
+/// [`ShardIteratorClass::Invalid`].
+#[must_use]
+pub fn classify_shard_iterator(token: &str) -> ShardIteratorClass {
+    match decode_shard_iterator(token) {
+        None => ShardIteratorClass::Invalid,
+        Some(it) => match it.stream_arn {
+            Some(arn) => ShardIteratorClass::Stream(arn),
+            // No stream ARN: an old-format token carries the four pre-upgrade
+            // fields with a parseable timestamp (created_at present); a shorter
+            // or unparseable token stays Invalid.
+            None if it.created_at.is_some() => ShardIteratorClass::Expired,
+            None => ShardIteratorClass::Invalid,
+        },
+    }
+}
+
 /// Handle `GetRecords`.
 ///
 /// Decodes the shard iterator, checks expiration, reads records, and returns
@@ -176,75 +277,68 @@ pub async fn handle_get_records(
     let input: GetRecordsInput = serde_json::from_value(body)
         .map_err(|e| DynamoDbError::SerializationException(e.to_string()))?;
 
-    let token = base64::Engine::decode(
-        &base64::engine::general_purpose::STANDARD,
-        &input.shard_iterator,
-    )
-    .ok()
-    .and_then(|d| String::from_utf8(d).ok())
-    .ok_or_else(|| DynamoDbError::ValidationException("Invalid ShardIterator".to_owned()))?;
-
-    let parts: Vec<&str> = token.splitn(4, '|').collect();
-    if parts.len() < 2 {
-        return Err(DynamoDbError::ValidationException(
-            "Invalid ShardIterator".to_owned(),
-        ));
-    }
-
-    let shard_id = parts[0];
-    // The type field is parsed but unused — all iterators are now normalized to
-    // AFTER_SEQUENCE_NUMBER at GetShardIterator time. We keep the field in the
-    // token format for backward compatibility with any iterators created before
-    // this normalization was introduced.
-    let _iter_type = parts[1];
-    let seq = if parts.len() >= 3 { parts[2] } else { "" };
+    let it = decode_shard_iterator(&input.shard_iterator)
+        .ok_or_else(|| DynamoDbError::ValidationException("Invalid ShardIterator".to_owned()))?;
 
     // Check iterator expiration (15 minutes).
-    if parts.len() >= 4
-        && let Ok(created_at) = parts[3].parse::<u64>()
-    {
+    if let Some(created_at) = it.created_at {
         let now = std::time::SystemTime::now()
             .duration_since(std::time::UNIX_EPOCH)
             .unwrap_or_default()
             .as_secs();
         if now.saturating_sub(created_at) > SHARD_ITERATOR_EXPIRY_SECS {
             return Err(DynamoDbError::ExpiredIteratorException(
-                "The shard iterator has expired and can no longer be \
-                     used to retrieve stream records. A new shard iterator \
-                     must be obtained by calling GetShardIterator."
-                    .to_owned(),
+                SHARD_ITERATOR_EXPIRED_MESSAGE.to_owned(),
             ));
         }
     }
 
+    // Confirm the shard belongs to the stream named in the token before
+    // reading. The request is authorized against that stream ARN, so this
+    // stops a forged token that pairs an authorized stream ARN with another
+    // stream's shard id from reading the other stream's records.
+    if let Some(ref stream_arn) = it.stream_arn {
+        ctx.storage
+            .validate_shard(&ctx.account_id, stream_arn, &it.shard_id)
+            .await
+            .map_err(storage_to_dynamo)?;
+    }
+
     let limit = input.limit.unwrap_or(1000).min(1000);
 
-    // All iterator types are now resolved to AFTER_SEQUENCE_NUMBER at
+    // All iterator types are resolved to AFTER_SEQUENCE_NUMBER at
     // GetShardIterator time. Empty seq means "read from beginning".
-    let after_sequence: Option<String> = if seq.is_empty() {
+    let after_sequence: Option<String> = if it.sequence.is_empty() {
         None
     } else {
-        Some(seq.to_owned())
+        Some(it.sequence.clone())
     };
 
     let (records, last_seq) = ctx
         .storage
-        .get_stream_records(&ctx.account_id, shard_id, after_sequence.as_deref(), limit)
+        .get_stream_records(
+            &ctx.account_id,
+            &it.shard_id,
+            after_sequence.as_deref(),
+            limit,
+        )
         .await
         .map_err(storage_to_dynamo)?;
 
-    // Build next iterator — points to after the last record read.
-    // Carries a fresh creation timestamp so the 15-minute window resets.
+    // Build next iterator, carrying the same stream ARN and a fresh timestamp
+    // so the 15-minute window resets.
     let next_iterator = {
-        let next_seq = last_seq.unwrap_or_else(|| seq.to_owned());
+        let next_seq = last_seq.unwrap_or_else(|| it.sequence.clone());
         let now = std::time::SystemTime::now()
             .duration_since(std::time::UNIX_EPOCH)
             .unwrap_or_default()
             .as_secs();
-        let next_token = format!("{shard_id}|AFTER_SEQUENCE_NUMBER|{next_seq}|{now}");
-        Some(base64::Engine::encode(
-            &base64::engine::general_purpose::STANDARD,
-            next_token,
+        Some(encode_shard_iterator(
+            &it.shard_id,
+            "AFTER_SEQUENCE_NUMBER",
+            &next_seq,
+            now,
+            it.stream_arn.as_deref().unwrap_or(""),
         ))
     };
 
@@ -293,4 +387,77 @@ mod tests {
             assert_eq!(&result, expected, "input={input} width={width}");
         }
     }
+
+    #[test]
+    fn shard_iterator_round_trip_backward_compat_and_fail_closed() {
+        let stream = "arn:aws:dynamodb:us-east-1:1:table/T/stream/2026-10-20T16:17:40.188";
+        let enc =
+            super::encode_shard_iterator("shardId-1", "AFTER_SEQUENCE_NUMBER", "42", 1000, stream);
+        let d = super::decode_shard_iterator(&enc).expect("decode");
+        assert_eq!(d.shard_id, "shardId-1");
+        assert_eq!(d.sequence, "42");
+        assert_eq!(d.created_at, Some(1000));
+        assert_eq!(d.stream_arn.as_deref(), Some(stream));
+
+        // A token from an older build (four fields, no stream ARN) still
+        // decodes, with stream_arn None, so the authorization layer can fail
+        // closed on it.
+        let old = base64::Engine::encode(
+            &base64::engine::general_purpose::STANDARD,
+            "shardId-2|AFTER_SEQUENCE_NUMBER|7|1000",
+        );
+        let d2 = super::decode_shard_iterator(&old).expect("decode old");
+        assert_eq!(d2.shard_id, "shardId-2");
+        assert_eq!(d2.created_at, Some(1000));
+        assert_eq!(d2.stream_arn, None);
+
+        // Garbage does not decode.
+        assert!(super::decode_shard_iterator("!!!not base64!!!").is_none());
+    }
+
+    fn b64(s: &str) -> String {
+        base64::Engine::encode(&base64::engine::general_purpose::STANDARD, s)
+    }
+
+    #[test]
+    fn classify_current_token_is_stream() {
+        let stream = "arn:aws:dynamodb:us-east-1:1:table/T/stream/2026-10-20T16:17:40.188";
+        let enc =
+            super::encode_shard_iterator("shardId-1", "AFTER_SEQUENCE_NUMBER", "42", 1000, stream);
+        match super::classify_shard_iterator(&enc) {
+            super::ShardIteratorClass::Stream(arn) => assert_eq!(arn, stream),
+            other => panic!("expected Stream, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn classify_old_format_four_fields_is_expired() {
+        // Four pre-upgrade fields with a parseable timestamp, no stream ARN.
+        let old = b64("shardId-2|AFTER_SEQUENCE_NUMBER|7|1000");
+        assert!(matches!(
+            super::classify_shard_iterator(&old),
+            super::ShardIteratorClass::Expired
+        ));
+    }
+
+    #[test]
+    fn classify_undecodable_or_short_or_unparseable_is_invalid() {
+        // Not base64.
+        assert!(matches!(
+            super::classify_shard_iterator("!!!not base64!!!"),
+            super::ShardIteratorClass::Invalid
+        ));
+        // Three fields: decodes but is not the old four-field shape.
+        let three = b64("shardId-3|AFTER_SEQUENCE_NUMBER|7");
+        assert!(matches!(
+            super::classify_shard_iterator(&three),
+            super::ShardIteratorClass::Invalid
+        ));
+        // Four fields but an unparseable timestamp.
+        let bad_ts = b64("shardId-4|AFTER_SEQUENCE_NUMBER|7|notanumber");
+        assert!(matches!(
+            super::classify_shard_iterator(&bad_ts),
+            super::ShardIteratorClass::Invalid
+        ));
+    }
 }
diff --git a/crates/engine/src/tagging.rs b/crates/engine/src/tagging.rs
index 1f1f91df6..432d75dd4 100755
--- a/crates/engine/src/tagging.rs
+++ b/crates/engine/src/tagging.rs
@@ -13,25 +13,36 @@ use crate::OperationContext;
 use crate::sanitize_storage_error;
 use crate::serialize_output;
 
-/// Split a `DynamoDB` resource ARN into `(region, account, resource)`.
-///
-/// Expected format: `arn:aws:dynamodb:{region}:{account}:table/{name}[/...]`
-fn split_dynamodb_arn(arn: &str) -> Option<(&str, &str, &str)> {
-    let rest = arn.strip_prefix("arn:aws:dynamodb:")?;
-    let mut parts = rest.splitn(3, ':');
-    let region = parts.next()?;
-    let account = parts.next()?;
-    let resource = parts.next()?;
-    Some((region, account, resource))
+/// True for a table ARN naming a backup, export, or import. The service reports
+/// these as not a `DynamoDB` resource ARN on a tag operation (measured live).
+fn tag_subresource_not_dynamodb_resource(resource: &str) -> bool {
+    resource
+        .strip_prefix("table/")
+        .is_some_and(|tail| matches!(tail.split('/').nth(1), Some("backup" | "export" | "import")))
+}
+
+/// True for a `table/...` resource whose sub-resource is anything other than a
+/// stream (an index or an unknown kind; a backup, export or import is refused
+/// earlier by `tag_subresource_not_dynamodb_resource`). Tags are accepted only
+/// on a table or a stream.
+fn tag_subresource_not_table_or_stream(resource: &str) -> bool {
+    let Some(tail) = resource.strip_prefix("table/") else {
+        return false;
+    };
+    let mut segs = tail.split('/');
+    let _table = segs.next();
+    !matches!(segs.next(), None | Some("") | Some("stream"))
 }
 
-/// Extract the table name from a `DynamoDB` table ARN.
+/// Extract the table name from a `DynamoDB` table ARN, using the one shared
+/// resource parser ([`extenddb_core::arn::fields`]) so this layer splits an ARN
+/// the same way authorization and the engine stream resolver do.
 ///
 /// Expected format: `arn:aws:dynamodb:{region}:{account}:table/{name}[/...]`
 fn extract_table_name_from_arn(arn: &str) -> Option<&str> {
-    let (_, _, resource) = split_dynamodb_arn(arn)?;
+    let resource = extenddb_core::arn::fields(arn)?.resource;
     let table_name = resource.strip_prefix("table/")?;
-    // Strip any sub-resource (e.g. /index/foo, /stream/label)
+    // Strip any sub-resource (e.g. /index/foo, /stream/label).
     Some(table_name.split('/').next().unwrap_or(table_name))
 }
 
@@ -43,14 +54,19 @@ fn extract_table_name_from_arn(arn: &str) -> Option<&str> {
 /// | Input | Result |
 /// |---|---|
 /// | Does not start with `arn:` | `ValidationException` (ARNs must start with `arn:`) |
-/// | Valid ARN for another service | `AccessDeniedException` |
-/// | `DynamoDB` ARN naming a non-table resource | `ValidationException` (not a `DynamoDB` resource arn) |
+/// | `DynamoDB` ARN whose resource is not a table | `ValidationException` (not a `DynamoDB` resource arn) |
+/// | Non-`DynamoDB`-service ARN whose resource is not a table | `AccessDeniedException` |
+/// | Table ARN naming a backup, export, or import | `ValidationException` (not a `DynamoDB` resource arn) |
+/// | Table ARN naming an index or other sub-resource | `ValidationException` (only table or stream is accepted) |
 /// | Account differs from the caller's | `AccessDeniedException` |
-/// | Region differs from this deployment's | `ValidationException` (invalid `TableArn`) |
+/// | Table ARN with a different partition, service, or region | `ValidationException` (invalid `TableArn`) |
 /// | Table does not exist | `ResourceNotFoundException` |
 ///
-/// Account is checked before region, matching the service: a cross-account ARN
-/// is denied without revealing whether its region is valid.
+/// Account is checked before the partition, service, and region, matching the
+/// service: a cross-account ARN is denied without revealing whether its other
+/// fields are valid. For a table ARN, a no-permissions principal is denied by
+/// authorization before this runs; the partition, service, region, and
+/// existence errors therefore surface only for an authorized principal.
 async fn validate_resource_arn(arn: &str, ctx: &OperationContext) -> Result<(), DynamoDbError> {
     if !arn.starts_with("arn:") {
         return Err(DynamoDbError::ValidationException(format!(
@@ -58,29 +74,60 @@ async fn validate_resource_arn(arn: &str, ctx: &OperationContext) -> Result<(),
         )));
     }
 
-    // An ARN for another service is denied rather than reported as malformed:
-    // authorization is evaluated against the resource before its shape is
-    // inspected further.
-    let Some((arn_region, arn_account, resource)) = split_dynamodb_arn(arn) else {
+    // A string that is not shaped like an ARN (fewer than the five
+    // colon-separated fields) is denied rather than reported as malformed.
+    let Some(extenddb_core::arn::ArnFields {
+        partition,
+        service,
+        region,
+        account,
+        resource,
+    }) = extenddb_core::arn::fields(arn)
+    else {
         return Err(DynamoDbError::AccessDeniedException(
             "Access is denied".to_owned(),
         ));
     };
 
     if !resource.starts_with("table/") {
+        // A DynamoDB ARN whose resource is not a table (a bare index, an
+        // export, and so on) is reported as not a DynamoDB resource. An ARN for
+        // another service is denied rather than reported as malformed, as the
+        // service does.
+        if service == "dynamodb" {
+            return Err(DynamoDbError::ValidationException(format!(
+                "One or more parameter values were invalid: \
+                 Provided Arn is not a DynamoDB resource arn: {arn}"
+            )));
+        }
+        return Err(DynamoDbError::AccessDeniedException(
+            "Access is denied".to_owned(),
+        ));
+    }
+
+    if tag_subresource_not_dynamodb_resource(resource) {
         return Err(DynamoDbError::ValidationException(format!(
             "One or more parameter values were invalid: \
              Provided Arn is not a DynamoDB resource arn: {arn}"
         )));
     }
 
-    if arn_account != ctx.account_id.as_ref() {
+    // Tags are accepted only on a table or a stream; an index or other
+    // sub-resource is rejected.
+    if tag_subresource_not_table_or_stream(resource) {
+        return Err(DynamoDbError::ValidationException(format!(
+            "One or more parameter values were invalid: Invalid resource arn \
+             provided, only table or stream is accepted. Provided resource arn: {arn}"
+        )));
+    }
+
+    if account != ctx.account_id.as_ref() {
         return Err(DynamoDbError::AccessDeniedException(
             "Access is denied".to_owned(),
         ));
     }
 
-    if arn_region != ctx.region.as_ref() {
+    if partition != "aws" || service != "dynamodb" || region != ctx.region.as_ref() {
         return Err(DynamoDbError::ValidationException(format!(
             "Invalid TableArn: Invalid ResourceArn provided as input {arn}"
         )));
@@ -214,3 +261,31 @@ pub async fn handle_list_tags_of_resource(
     };
     serialize_output(&output)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::{tag_subresource_not_dynamodb_resource, tag_subresource_not_table_or_stream};
+
+    #[test]
+    fn tag_subresource_classification() {
+        for r in [
+            "table/t/backup/01-ab",
+            "table/t/export/01-ab",
+            "table/t/import/01-ab",
+        ] {
+            assert!(tag_subresource_not_dynamodb_resource(r), "{r}");
+        }
+        for r in [
+            "table/t",
+            "table/t/stream/2026-10-20T16:17:40.188",
+            "table/t/index/g",
+        ] {
+            assert!(!tag_subresource_not_dynamodb_resource(r), "{r}");
+        }
+        assert!(tag_subresource_not_table_or_stream("table/t/index/g"));
+        assert!(!tag_subresource_not_table_or_stream("table/t"));
+        assert!(!tag_subresource_not_table_or_stream(
+            "table/t/stream/2026-10-20T16:17:40.188"
+        ));
+    }
+}
diff --git a/crates/server/src/authorization.rs b/crates/server/src/authorization.rs
index 22b83137a..6244b62a6 100755
--- a/crates/server/src/authorization.rs
+++ b/crates/server/src/authorization.rs
@@ -18,7 +18,9 @@ use std::collections::HashMap;
 
 use extenddb_auth::AuthIdentity;
 use extenddb_auth::policy::context::{RequestContext, RequestParams};
-use extenddb_auth::policy::evaluator::{AuthzDecision, evaluate_policies_arc};
+use extenddb_auth::policy::evaluator::{
+    AuthzDecision, evaluate_policies_arc, explicit_deny_matches_arc,
+};
 use extenddb_core::error::DynamoDbError;
 use extenddb_storage::management_store::OpError;
 
@@ -85,6 +87,12 @@ async fn check_user_authorization(
 ) -> Result<(), DynamoDbError> {
     let action = format!("dynamodb:{operation}");
 
+    // Resource tags apply only to a table, and to an index through its base
+    // table (indexes inherit the table's tags). A stream, backup or any other
+    // resource has none, so `aws:ResourceTag/*` is absent there, as on the
+    // service (see `resource_tag_lookup_arn`).
+    let tag_arn = crate::authz_resource::resource_tag_lookup_arn(resource_arn);
+
     // Fetch all authz inputs concurrently; they are independent cache
     // lookups (or DB queries, on cold start). All come back pre-parsed.
     let (user_policies, group_policies, boundary, principal_tags, resource_tags, created_at) = tokio::try_join!(
@@ -92,7 +100,7 @@ async fn check_user_authorization(
         wrap_policies(cache.fetch_user_group_policies(account_id, user_name)),
         wrap_boundary(cache.fetch_user_boundary(account_id, user_name)),
         wrap_tags(cache.fetch_user_tags(account_id, user_name)),
-        wrap_tags(cache.fetch_resource_tags(resource_arn)),
+        wrap_tags(fetch_authz_resource_tags(cache, tag_arn.as_deref())),
         wrap_created_at(cache.fetch_user_created_at(account_id, user_name)),
     )?;
 
@@ -150,9 +158,20 @@ async fn check_user_authorization(
             resource = resource_arn,
             "Authorization denied"
         );
-        Err(DynamoDbError::AccessDeniedException(format!(
-            "User: arn:aws:iam::{account_id}:user/{user_name} is not authorized \
-             to perform: {action} on resource: {resource_arn}"
+        let principal = format!("arn:aws:iam::{account_id}:user/{user_name}");
+        let explicit = explicit_deny_matches_arc(
+            &identity_policies,
+            boundary.as_deref(),
+            None,
+            &action,
+            resource_arn,
+            &context,
+        );
+        Err(DynamoDbError::AccessDeniedException(deny_message(
+            &principal,
+            &action,
+            resource_arn,
+            explicit,
         )))
     }
 }
@@ -170,6 +189,9 @@ async fn check_role_authorization(
 ) -> Result<(), DynamoDbError> {
     let action = format!("dynamodb:{operation}");
 
+    // Resource tags for a table or index only (see the user path).
+    let tag_arn = crate::authz_resource::resource_tag_lookup_arn(resource_arn);
+
     let (
         identity_policies,
         boundary,
@@ -180,7 +202,7 @@ async fn check_role_authorization(
         wrap_policies(cache.fetch_role_policies(account_id, role_name)),
         wrap_boundary(cache.fetch_role_boundary(account_id, role_name)),
         fetch_session_data_and_tags(cache, account_id, role_name, session_name),
-        wrap_tags(cache.fetch_resource_tags(resource_arn)),
+        wrap_tags(fetch_authz_resource_tags(cache, tag_arn.as_deref())),
         wrap_created_at(cache.fetch_role_created_at(account_id, role_name)),
     )?;
 
@@ -233,9 +255,21 @@ async fn check_role_authorization(
             resource = resource_arn,
             "Authorization denied"
         );
-        Err(DynamoDbError::AccessDeniedException(format!(
-            "User: arn:aws:iam::{account_id}:assumed-role/{role_name}/{session_name} \
-             is not authorized to perform: {action} on resource: {resource_arn}"
+        let principal =
+            format!("arn:aws:iam::{account_id}:assumed-role/{role_name}/{session_name}");
+        let explicit = explicit_deny_matches_arc(
+            &identity_slice,
+            boundary.as_deref(),
+            session_policy.as_deref(),
+            &action,
+            resource_arn,
+            &context,
+        );
+        Err(DynamoDbError::AccessDeniedException(deny_message(
+            &principal,
+            &action,
+            resource_arn,
+            explicit,
         )))
     }
 }
@@ -244,6 +278,28 @@ async fn check_role_authorization(
 // Helpers — translate cache results to authorization-layer types
 // ---------------------------------------------------------------------------
 
+/// Build the AccessDeniedException message in the form the service uses, which
+/// depends on why the request was denied. `action` already carries the
+/// `dynamodb:` prefix. An explicit Deny statement yields "with an explicit deny
+/// in an identity-based policy"; any other denial yields "because no
+/// identity-based policy allows the <action> action", measured against live
+/// DynamoDB.
+pub(crate) fn deny_message(
+    principal: &str,
+    action: &str,
+    resource_arn: &str,
+    explicit: bool,
+) -> String {
+    let head = format!(
+        "User: {principal} is not authorized to perform: {action} on resource: {resource_arn}"
+    );
+    if explicit {
+        format!("{head} with an explicit deny in an identity-based policy")
+    } else {
+        format!("{head} because no identity-based policy allows the {action} action")
+    }
+}
+
 /// Translate an `OpResult` from the cache into a `DynamoDbError`.
 ///
 /// Parse failures are reported by the cache as `OpError::Internal("policy
@@ -281,6 +337,18 @@ async fn wrap_boundary(
     fut.await.map_err(op_err_to_dynamo)
 }
 
+/// The resource tags for authorization: those stored under `tag_arn`, or an
+/// empty set when the resource carries none (`tag_arn` is `None`).
+async fn fetch_authz_resource_tags(
+    cache: &CachedAuthzStore,
+    tag_arn: Option<&str>,
+) -> extenddb_storage::management_store::OpResult<TagMap> {
+    match tag_arn {
+        Some(arn) => cache.fetch_resource_tags(arn).await,
+        None => Ok(TagMap::default()),
+    }
+}
+
 async fn wrap_tags(
     fut: impl std::future::Future<Output = extenddb_storage::management_store::OpResult<TagMap>>,
 ) -> Result<TagMap, DynamoDbError> {
@@ -371,3 +439,156 @@ mod source_ip_tests {
         assert_eq!(condition_source_ip(&loopback6), "::1");
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::deny_message;
+
+    const P: &str = "arn:aws:iam::964157134968:user/alice";
+    const R: &str = "arn:aws:dynamodb:us-east-1:964157134968:table/bb";
+
+    #[test]
+    fn explicit_deny_message_matches_service() {
+        assert_eq!(
+            deny_message(P, "dynamodb:TagResource", R, true),
+            "User: arn:aws:iam::964157134968:user/alice is not authorized to perform: \
+             dynamodb:TagResource on resource: arn:aws:dynamodb:us-east-1:964157134968:table/bb \
+             with an explicit deny in an identity-based policy"
+        );
+    }
+
+    #[test]
+    fn implicit_deny_message_matches_service() {
+        assert_eq!(
+            deny_message(P, "dynamodb:GetItem", R, false),
+            "User: arn:aws:iam::964157134968:user/alice is not authorized to perform: \
+             dynamodb:GetItem on resource: arn:aws:dynamodb:us-east-1:964157134968:table/bb \
+             because no identity-based policy allows the dynamodb:GetItem action"
+        );
+    }
+}
+
+#[cfg(test)]
+mod resource_tag_tests {
+    use super::{check_role_authorization, check_user_authorization, fetch_authz_resource_tags};
+    use crate::authz_cache::CachedAuthzStore;
+    use crate::authz_cache::tests::{CountingAuthzStore, fast_authz_cfg};
+    use extenddb_auth::policy::context::RequestParams;
+    use extenddb_core::error::DynamoDbError;
+    use std::sync::Arc;
+    use std::sync::atomic::Ordering;
+
+    const ACCOUNT: &str = "123456789012";
+    const TABLE: &str = "arn:aws:dynamodb:us-east-1:123456789012:table/t";
+    const STREAM: &str =
+        "arn:aws:dynamodb:us-east-1:123456789012:table/t/stream/2026-10-20T16:17:40.188";
+    const BACKUP: &str =
+        "arn:aws:dynamodb:us-east-1:123456789012:table/t/backup/01792513080555-82c5bd04";
+
+    const POLICY: &str = r#"{"Version":"2012-10-17","Statement":[{"Effect":"Allow",
+        "Action":["dynamodb:DescribeTable","dynamodb:DescribeStream","dynamodb:DescribeBackup"],
+        "Resource":"*","Condition":{"StringEquals":{"aws:ResourceTag/k":"v"}}}]}"#;
+
+    /// User `u` and role `r` are allowed DescribeTable, DescribeStream and
+    /// DescribeBackup only when `aws:ResourceTag/k` is `v`, with the table, the
+    /// stream and the backup ARN all carrying `k=v` in the store.
+    fn store() -> Arc<CountingAuthzStore> {
+        let s = CountingAuthzStore::default();
+        s.user_policies.lock().unwrap().insert(
+            (ACCOUNT.to_owned(), "u".to_owned()),
+            vec![POLICY.to_owned()],
+        );
+        s.role_policies.lock().unwrap().insert(
+            (ACCOUNT.to_owned(), "r".to_owned()),
+            vec![POLICY.to_owned()],
+        );
+        for arn in [TABLE, STREAM, BACKUP] {
+            s.resource_tags
+                .lock()
+                .unwrap()
+                .insert(arn.to_owned(), vec![("k".to_owned(), "v".to_owned())]);
+        }
+        Arc::new(s)
+    }
+
+    async fn check(cache: &CachedAuthzStore, op: &str, arn: &str) -> Result<(), DynamoDbError> {
+        check_user_authorization(
+            cache,
+            ACCOUNT,
+            "u",
+            op,
+            arn,
+            false,
+            RequestParams::default(),
+        )
+        .await
+    }
+
+    #[tokio::test]
+    async fn stream_and_backup_operations_read_no_resource_tags() {
+        let inner = store();
+        let cache = CachedAuthzStore::new(inner.clone(), fast_authz_cfg());
+        // The table's tag satisfies the condition.
+        assert!(check(&cache, "DescribeTable", TABLE).await.is_ok());
+        let fetched = inner.resource_tags_calls.load(Ordering::SeqCst);
+        // Tags stored under the stream and backup ARNs are never read, so the
+        // same condition does not match there.
+        for (op, arn) in [("DescribeStream", STREAM), ("DescribeBackup", BACKUP)] {
+            assert!(
+                matches!(
+                    check(&cache, op, arn).await,
+                    Err(DynamoDbError::AccessDeniedException(_))
+                ),
+                "{op} on {arn}"
+            );
+        }
+        assert_eq!(inner.resource_tags_calls.load(Ordering::SeqCst), fetched);
+    }
+
+    #[tokio::test]
+    async fn role_session_stream_and_backup_operations_read_no_resource_tags() {
+        let inner = store();
+        let cache = CachedAuthzStore::new(inner.clone(), fast_authz_cfg());
+        let role = |op: &'static str, arn: &'static str| {
+            check_role_authorization(
+                &cache,
+                ACCOUNT,
+                "r",
+                "s",
+                op,
+                arn,
+                false,
+                RequestParams::default(),
+            )
+        };
+        assert!(role("DescribeTable", TABLE).await.is_ok());
+        let fetched = inner.resource_tags_calls.load(Ordering::SeqCst);
+        for (op, arn) in [("DescribeStream", STREAM), ("DescribeBackup", BACKUP)] {
+            assert!(
+                matches!(
+                    role(op, arn).await,
+                    Err(DynamoDbError::AccessDeniedException(_))
+                ),
+                "{op} on {arn}"
+            );
+        }
+        assert_eq!(inner.resource_tags_calls.load(Ordering::SeqCst), fetched);
+    }
+
+    #[tokio::test]
+    async fn absent_tag_arn_yields_empty_tags_without_a_lookup() {
+        let inner = store();
+        let cache = CachedAuthzStore::new(inner.clone(), fast_authz_cfg());
+        assert!(
+            fetch_authz_resource_tags(&cache, None)
+                .await
+                .unwrap()
+                .is_empty()
+        );
+        assert_eq!(inner.resource_tags_calls.load(Ordering::SeqCst), 0);
+        let tags = fetch_authz_resource_tags(&cache, Some(TABLE))
+            .await
+            .unwrap();
+        assert_eq!(tags.get("k").map(String::as_str), Some("v"));
+    }
+}
diff --git a/crates/server/src/authz_cache.rs b/crates/server/src/authz_cache.rs
index 30017c151..5204394cf 100644
--- a/crates/server/src/authz_cache.rs
+++ b/crates/server/src/authz_cache.rs
@@ -939,7 +939,7 @@ fn parse_document(s: &str) -> OpResult<Arc<PolicyDocument>> {
 }
 
 #[cfg(test)]
-mod tests {
+pub(crate) mod tests {
     use std::sync::Mutex;
     use std::sync::atomic::{AtomicUsize, Ordering};
     use std::time::Duration;
@@ -956,7 +956,7 @@ mod tests {
 
     /// Counts calls per method so tests can assert the cache prevents repeats.
     #[derive(Default)]
-    struct CountingAuthzStore {
+    pub(crate) struct CountingAuthzStore {
         user_policies_calls: AtomicUsize,
         user_group_policies_calls: AtomicUsize,
         user_boundary_calls: AtomicUsize,
@@ -965,17 +965,17 @@ mod tests {
         role_boundary_calls: AtomicUsize,
         role_tags_calls: AtomicUsize,
         session_data_calls: AtomicUsize,
-        resource_tags_calls: AtomicUsize,
+        pub(crate) resource_tags_calls: AtomicUsize,
 
-        user_policies: Mutex<HashMap<PrincipalKey, Vec<String>>>,
+        pub(crate) user_policies: Mutex<HashMap<PrincipalKey, Vec<String>>>,
         user_group_policies: Mutex<HashMap<PrincipalKey, Vec<String>>>,
         user_boundary: Mutex<HashMap<PrincipalKey, Option<String>>>,
         user_tags: Mutex<HashMap<PrincipalKey, TagPairs>>,
-        role_policies: Mutex<HashMap<PrincipalKey, Vec<String>>>,
+        pub(crate) role_policies: Mutex<HashMap<PrincipalKey, Vec<String>>>,
         role_boundary: Mutex<HashMap<PrincipalKey, Option<String>>>,
         role_tags: Mutex<HashMap<PrincipalKey, TagPairs>>,
         session_data: Mutex<HashMap<SessionKey, Option<SessionData>>>,
-        resource_tags: Mutex<HashMap<String, TagPairs>>,
+        pub(crate) resource_tags: Mutex<HashMap<String, TagPairs>>,
     }
 
     impl AuthorizationStore for CountingAuthzStore {
@@ -1151,7 +1151,7 @@ mod tests {
         }
     }
 
-    fn fast_authz_cfg() -> AuthzCacheConfig {
+    pub(crate) fn fast_authz_cfg() -> AuthzCacheConfig {
         let base = SwrCacheConfig {
             ttl: Duration::from_millis(200),
             soft_ttl: Duration::from_millis(50),
diff --git a/crates/server/src/authz_resource.rs b/crates/server/src/authz_resource.rs
new file mode 100644
index 000000000..3980f9edb
--- /dev/null
+++ b/crates/server/src/authz_resource.rs
@@ -0,0 +1,1312 @@
+// Copyright 2026 ExtendDB contributors
+// SPDX-License-Identifier: Apache-2.0
+
+//! Derivation of the (IAM action, resource ARN) pairs that a `DynamoDB` request
+//! is authorized against, matching live `DynamoDB`.
+//!
+//! The defect this fixes: `authorize_request` derived the
+//! authorization resource only from a top-level `TableName`. Operations that
+//! carry their resource in another field authorized against
+//! `arn:aws:dynamodb:<region>:<account>:table/*`, so an explicit Deny on a
+//! specific table, index, stream, or backup ARN never matched. In ABAC
+//! deployments this let a caller change the tags that drive access decisions.
+//!
+//! The service evaluates these resources (verified against live DynamoDB):
+//!
+//! | Operation | IAM action | resource |
+//! |---|---|---|
+//! | `TagResource`/`UntagResource`/`ListTagsOfResource` | same | the `ResourceArn` (a table or stream ARN) |
+//! | `DescribeStream`/`GetShardIterator` | same | the `StreamArn` |
+//! | `ListStreams` (with `TableName`) | `ListStreams` | `table/<T>/stream/*` |
+//! | `ListStreams` (no `TableName`) | `ListStreams` | `table/*/stream/*` |
+//! | `DescribeBackup`/`DeleteBackup` | same | the `BackupArn` |
+//! | `ListBackups` (with `TableName`) | `ListBackups` | `table/<T>/backup/*` |
+//! | `ListBackups` (no `TableName`) | `ListBackups` | `table/*/backup/*` |
+//! | `CreateBackup`/`DescribeContinuousBackups`/`UpdateContinuousBackups` | same | the table ARN |
+//! | `ExportTableToPointInTime` | same | the `TableArn` |
+//! | `ImportTable` | same | the new table ARN |
+//! | `Query`/`Scan` (with `IndexName`) | same | `table/<T>/index/<I>` |
+//! | `ListTables` | `ListTables` | `table/*` |
+//! | item/table ops | same | the table ARN (from `TableName`, name or ARN) |
+//!
+//! Every resource ARN produced here is CANONICAL for this deployment: the
+//! partition, service, region, and account are fixed to this server's, and only
+//! the resource identity (table name and optional sub-resource) is taken from
+//! the request. ExtendDB's stream and backup resolvers ignore the partition,
+//! service, region, and account of a supplied ARN and act within this
+//! deployment's account, so a caller who respells those fields would otherwise
+//! evade a Deny written against the canonical ARN. Canonicalizing here closes
+//! that bypass: a Deny on the real resource always matches.
+//!
+//! Fail-closed: a missing or unparseable resource field never falls back to
+//! `table/*`. It yields the field value verbatim (often empty), which an
+//! `Allow` on `*` still reaches so the engine returns its normal validation
+//! error, while no Deny on a specific resource is silently skipped.
+
+use extenddb_core::error::DynamoDbError;
+use serde_json::Value;
+
+/// Partition and service are fixed to this deployment's; see module docs.
+const PARTITION: &str = "aws";
+const SERVICE: &str = "dynamodb";
+
+/// The item actions the service requires on the target table of a restore, in
+/// addition to the restore action itself (measured live). A Deny on any of
+/// these for the target table name blocks a restore into it.
+const RESTORE_TARGET_ACTIONS: &[&str] = &[
+    "Scan",
+    "Query",
+    "GetItem",
+    "PutItem",
+    "UpdateItem",
+    "DeleteItem",
+    "BatchWriteItem",
+];
+
+/// A `DynamoDB` resource identity: a table and an optional sub-resource.
+#[derive(Debug, PartialEq, Eq)]
+enum Sub {
+    Index(String),
+    Stream(String),
+    Backup(String),
+}
+
+#[derive(Debug, PartialEq, Eq)]
+struct ResourceId {
+    table: String,
+    sub: Option<Sub>,
+}
+
+/// Extract the resource identity (table name and optional sub-resource) from a
+/// `DynamoDB` ARN, through the one shared parser ([`extenddb_core::arn::parse`]).
+/// Returns `None` for anything that is not a `table/...` resource. The
+/// partition, service, region, and account are intentionally ignored here: only
+/// the resource identity is trusted from the input, and authorization
+/// canonicalizes those fields to this deployment.
+fn parse_resource_identity(arn: &str) -> Option<ResourceId> {
+    let r = extenddb_core::arn::parse(arn)?;
+    let sub = r.sub.map(|s| match s {
+        extenddb_core::arn::SubResource::Index(i) => Sub::Index(i),
+        extenddb_core::arn::SubResource::Stream(s) => Sub::Stream(s),
+        extenddb_core::arn::SubResource::Backup(b) => Sub::Backup(b),
+    });
+    Some(ResourceId {
+        table: r.table,
+        sub,
+    })
+}
+
+/// Split an ARN into its five fields through the one shared parser. Returns
+/// `None` when the string is not shaped like an ARN with five colon-separated
+/// fields after the `arn:` prefix.
+fn arn_fields(arn: &str) -> Option<extenddb_core::arn::ArnFields<'_>> {
+    extenddb_core::arn::fields(arn)
+}
+
+/// Build a canonical ARN for this deployment from a resource identity.
+fn canonical(region: &str, account_id: &str, rid: &ResourceId) -> String {
+    let base = format!(
+        "arn:{PARTITION}:{SERVICE}:{region}:{account_id}:table/{}",
+        rid.table
+    );
+    match &rid.sub {
+        None => base,
+        Some(Sub::Index(i)) => format!("{base}/index/{i}"),
+        Some(Sub::Stream(s)) => format!("{base}/stream/{s}"),
+        Some(Sub::Backup(b)) => format!("{base}/backup/{b}"),
+    }
+}
+
+/// The canonical ARN for a resource field that [`validate_operation_arns`] has
+/// already confirmed parses to the expected kind before authorization. The
+/// `unwrap_or_else` raw branch is a fail-closed default that the
+/// pre-authorization validation makes unreachable in request handling: it never
+/// produces a `table/*` wildcard a specific Deny would miss, and an input that
+/// does not parse is refused with ValidationException before this is reached.
+fn canonical_resource(arn: &str, region: &str, account_id: &str) -> String {
+    match parse_resource_identity(arn) {
+        Some(rid) => canonical(region, account_id, &rid),
+        None => arn.to_owned(),
+    }
+}
+
+/// The resource ARN a tag operation authorizes against.
+///
+/// `validate_tag_resource_arn_shape` has already run: the value is a table ARN,
+/// a stream ARN, or a foreign-service ARN (an index, a backup, or a non-table
+/// `DynamoDB` ARN is rejected before authorization). A table or stream ARN is
+/// canonicalized to this deployment; a foreign-service ARN is left verbatim so
+/// authorization denies it, matching the service (measured, arn-1 table).
+fn tag_resource_arn(arn: &str, region: &str, account_id: &str) -> String {
+    match parse_resource_identity(arn) {
+        Some(rid @ ResourceId { sub: None, .. })
+        | Some(
+            rid @ ResourceId {
+                sub: Some(Sub::Stream(_)),
+                ..
+            },
+        ) => canonical(region, account_id, &rid),
+        // A foreign-service ARN (or, defensively, an index/backup the shape
+        // check already rejected): authorization denies it.
+        _ => arn.to_owned(),
+    }
+}
+
+/// The resource kind a strictly validated ARN-bearing request field must name.
+/// Only stream and backup fields are validated before authorization; an export
+/// `TableArn` is checked only for parseability (see `validate_operation_arns`).
+#[derive(Clone, Copy)]
+enum ArnKind {
+    Stream,
+    Backup,
+}
+
+/// Messages DynamoDB returns, before the IAM decision, for a request field
+/// whose ARN is not a valid resource ARN of the kind the field requires
+/// (measured live, `live-r2/arn-kinds-live.json`).
+const INVALID_STREAM_ARN_MESSAGE: &str = "Invalid StreamArn";
+const INVALID_BACKUP_ARN_MESSAGE: &str = "Invalid Backup ARN";
+const INVALID_EXPORT_TABLE_ARN_MESSAGE: &str =
+    "One or more parameter values were invalid: tableArn is not a valid ARN";
+
+/// True when `arn` is a well-formed DynamoDB resource ARN of `kind`: it parses
+/// to that kind and its partition, service, region, and account are all
+/// non-empty. The field checks catch an empty-partition ARN
+/// (`arn::dynamodb:...`), which the service rejects with `Invalid StreamArn`.
+fn arn_is_kind(arn: &str, kind: ArnKind) -> bool {
+    let Some(f) = extenddb_core::arn::fields(arn) else {
+        return false;
+    };
+    if f.partition.is_empty() || f.service.is_empty() || f.region.is_empty() || f.account.is_empty()
+    {
+        return false;
+    }
+    matches!(
+        (parse_resource_identity(arn), kind),
+        (
+            Some(ResourceId {
+                sub: Some(Sub::Stream(_)),
+                ..
+            }),
+            ArnKind::Stream
+        ) | (
+            Some(ResourceId {
+                sub: Some(Sub::Backup(_)),
+                ..
+            }),
+            ArnKind::Backup
+        )
+    )
+}
+
+/// Validate ARN-bearing fields before the IAM decision, matching the service
+/// (measured live, `live-r2/arn-kinds-live.json`).
+///
+/// The two field families differ, as the service does:
+///
+/// - `StreamArn` (DescribeStream, GetShardIterator) and `BackupArn`
+///   (DescribeBackup, DeleteBackup) are validated strictly: a value that is not
+///   a well-formed stream (resp. backup) ARN of the correct kind, including a
+///   table ARN, an `xrn:` ARN, or an empty partition, is refused before
+///   authorization with `Invalid StreamArn` (resp. `Invalid Backup ARN`).
+/// - An export `TableArn` is validated loosely: only an UNPARSEABLE value (a
+///   repeated `table/` segment such as `.../table/a/stream/table/b`, a bare
+///   `table/x`, or an `xrn:` ARN) is refused before authorization, with
+///   `tableArn is not a valid ARN`. A well-formed DynamoDB ARN of the wrong
+///   kind (a real stream or index ARN) is NOT refused here: it is authorized
+///   against its canonical form (preserving its kind, so authorization and the
+///   engine agree on the resource) and the export handler then refuses it with
+///   `Invalid Request: Table ARN is invalid.`
+///
+/// `RestoreTableFromBackup` and `RestoreTableToPointInTime` carry no pre-authz
+/// ARN check: a wrong-kind source is authorized first (so a no-permissions
+/// principal is denied) and the engine refuses it afterwards. Tag operations
+/// keep their own measured shape check (`validate_tag_resource_arn_shape`);
+/// `GetRecords` is handled through its iterator by [`getrecords_resource`].
+pub(crate) fn validate_operation_arns(operation: &str, input: &Value) -> Result<(), DynamoDbError> {
+    let present = |key: &str| {
+        input
+            .get(key)
+            .and_then(Value::as_str)
+            .filter(|s| !s.is_empty())
+    };
+    match operation {
+        "DescribeStream" | "GetShardIterator" => {
+            if let Some(arn) = present("StreamArn")
+                && !arn_is_kind(arn, ArnKind::Stream)
+            {
+                return Err(DynamoDbError::ValidationException(
+                    INVALID_STREAM_ARN_MESSAGE.to_owned(),
+                ));
+            }
+        }
+        "DescribeBackup" | "DeleteBackup" => {
+            if let Some(arn) = present("BackupArn")
+                && !arn_is_kind(arn, ArnKind::Backup)
+            {
+                return Err(DynamoDbError::ValidationException(
+                    INVALID_BACKUP_ARN_MESSAGE.to_owned(),
+                ));
+            }
+        }
+        // Export: refuse only an unparseable TableArn here. A well-formed ARN of
+        // the wrong kind goes through authorization against its canonical form
+        // and is refused by the export handler, so authorization never runs
+        // against a different table than the engine would read.
+        "ExportTableToPointInTime" => {
+            if let Some(arn) = present("TableArn")
+                && extenddb_core::arn::parse(arn).is_none()
+            {
+                return Err(DynamoDbError::ValidationException(
+                    INVALID_EXPORT_TABLE_ARN_MESSAGE.to_owned(),
+                ));
+            }
+        }
+        _ => {}
+    }
+    Ok(())
+}
+
+/// The ARN to look resource tags up under for authorization, or `None` when
+/// the authorized resource carries no tags, so `aws:ResourceTag/*` is absent.
+///
+/// Measured against DynamoDB:
+///
+/// | Authorized resource | Tags the request sees |
+/// |---|---|
+/// | Table ARN | the table's tags |
+/// | Index ARN | the base table's tags (indexes inherit them) |
+/// | Stream ARN | none, even when the stream or its table is tagged |
+/// | Backup ARN | none, even when the source table is tagged |
+///
+/// A stream holds a tag set of its own (`TagResource` on the stream ARN), but
+/// the service does not evaluate it, or the table's, for an operation on the
+/// stream: `StringEquals aws:ResourceTag/k` does not match and `Null` is true.
+/// Every other resource (an export, a foreign-service ARN, `*`) also gets no
+/// tags; nothing taggable is stored under one. A table wildcard such as
+/// `table/*` (ListTables) returns `Some`, and reads no tags because
+/// `CachedAuthzStore::fetch_resource_tags` short-circuits a `/*` ARN.
+pub(crate) fn resource_tag_lookup_arn(resource_arn: &str) -> Option<String> {
+    let f = extenddb_core::arn::fields(resource_arn)?;
+    match parse_resource_identity(resource_arn)? {
+        ResourceId { sub: None, .. } => Some(resource_arn.to_owned()),
+        ResourceId {
+            table,
+            sub: Some(Sub::Index(_)),
+        } => Some(format!(
+            "arn:{}:{}:{}:{}:table/{table}",
+            f.partition, f.service, f.region, f.account
+        )),
+        ResourceId {
+            sub: Some(Sub::Stream(_) | Sub::Backup(_)),
+            ..
+        } => None,
+    }
+}
+
+/// How `GetRecords` must answer its shard iterator, with the stream resource
+/// already canonicalized for authorization.
+pub(crate) enum GetRecordsResource {
+    /// Authorize against this canonical stream ARN.
+    Stream(String),
+    /// A pre-upgrade iterator: answer ExpiredIteratorException before authz.
+    Expired,
+    /// Answer "Invalid ShardIterator" ValidationException before authz.
+    Invalid,
+}
+
+/// Resolve the stream resource a `GetRecords` request authorizes against from
+/// its shard iterator, classifying a pre-upgrade or undecodable token.
+///
+/// The iterator is decoded once by the engine
+/// ([`extenddb_engine::classify_shard_iterator`]). A current token's stream ARN
+/// is canonicalized through the shared parser; a decoded stream ARN that does
+/// not parse to a stream is refused as Invalid rather than authorized verbatim,
+/// so no respelled or forged stream ARN is served.
+pub(crate) fn getrecords_resource(
+    input: &Value,
+    region: &str,
+    account_id: &str,
+) -> GetRecordsResource {
+    let token = input
+        .get("ShardIterator")
+        .and_then(Value::as_str)
+        .unwrap_or_default();
+    match extenddb_engine::classify_shard_iterator(token) {
+        extenddb_engine::ShardIteratorClass::Stream(arn) => match parse_resource_identity(&arn) {
+            Some(
+                rid @ ResourceId {
+                    sub: Some(Sub::Stream(_)),
+                    ..
+                },
+            ) => GetRecordsResource::Stream(canonical(region, account_id, &rid)),
+            _ => GetRecordsResource::Invalid,
+        },
+        extenddb_engine::ShardIteratorClass::Expired => GetRecordsResource::Expired,
+        extenddb_engine::ShardIteratorClass::Invalid => GetRecordsResource::Invalid,
+    }
+}
+
+/// The canonical table ARN for a `TableName` field that may be a bare name or a
+/// table ARN. Any sub-resource on a supplied ARN is dropped: a `TableName` names
+/// a table. Callers that need an index ARN append `/index/<name>` themselves.
+pub(crate) fn table_resource_arn(value: &str, region: &str, account_id: &str) -> String {
+    if value.starts_with("arn:") {
+        if let Some(rid) = parse_resource_identity(value) {
+            return canonical(
+                region,
+                account_id,
+                &ResourceId {
+                    table: rid.table,
+                    sub: None,
+                },
+            );
+        }
+        return value.to_owned();
+    }
+    format!("arn:{PARTITION}:{SERVICE}:{region}:{account_id}:table/{value}")
+}
+
+/// Account-wide table wildcard, for operations with no specific resource.
+pub(crate) fn table_wildcard(region: &str, account_id: &str) -> String {
+    format!("arn:{PARTITION}:{SERVICE}:{region}:{account_id}:table/*")
+}
+
+fn stream_wildcard(region: &str, account_id: &str) -> String {
+    format!("arn:{PARTITION}:{SERVICE}:{region}:{account_id}:table/*/stream/*")
+}
+
+fn backup_wildcard(region: &str, account_id: &str) -> String {
+    format!("arn:{PARTITION}:{SERVICE}:{region}:{account_id}:table/*/backup/*")
+}
+
+/// Validate the shape of a tag operation's `ResourceArn` before authorization,
+/// as the service does (measured live). The service returns ValidationException
+/// to every principal, before the IAM decision, for an ARN that does not start
+/// with `arn:`, a DynamoDB ARN whose resource is not a table or stream, or an
+/// index ARN (tags are accepted only on a table or stream). A table or stream
+/// ARN passes; so does a foreign-service ARN (for example an S3 bucket), which
+/// authorization then denies. The partition, service, region, account, and
+/// existence of a table ARN are checked after authorization by the engine
+/// handler, so for those a no-permissions principal is denied first and only an
+/// authorized principal sees the shape error.
+pub(crate) fn validate_tag_resource_arn_shape(arn: &str) -> Result<(), DynamoDbError> {
+    if !arn.starts_with("arn:") {
+        return Err(DynamoDbError::ValidationException(format!(
+            "One or more parameter values were invalid: ARNs must start with 'arn:': {arn}"
+        )));
+    }
+    match parse_resource_identity(arn) {
+        Some(ResourceId {
+            sub: None | Some(Sub::Stream(_)),
+            ..
+        }) => Ok(()),
+        // A backup ARN is not a taggable resource kind (measured live, with a
+        // real backup ARN and a short backup id).
+        Some(ResourceId {
+            sub: Some(Sub::Backup(_)),
+            ..
+        }) => Err(DynamoDbError::ValidationException(format!(
+            "One or more parameter values were invalid: Provided Arn is not a \
+             DynamoDB resource arn: {arn}"
+        ))),
+        Some(_) => Err(DynamoDbError::ValidationException(format!(
+            "One or more parameter values were invalid: Invalid resource arn \
+             provided, only table or stream is accepted. Provided resource arn: {arn}"
+        ))),
+        None => {
+            // Not a table/... resource. A DynamoDB-service ARN is reported as
+            // not a DynamoDB resource; a foreign-service ARN is left to
+            // authorization, which denies it (measured live).
+            if arn_fields(arn).map(|f| f.service) == Some(SERVICE) {
+                Err(DynamoDbError::ValidationException(format!(
+                    "One or more parameter values were invalid: Provided Arn is not a \
+                     DynamoDB resource arn: {arn}"
+                )))
+            } else {
+                Ok(())
+            }
+        }
+    }
+}
+
+/// A string request field, owned, or `None` when absent or not a string.
+fn str_field(input: &Value, key: &str) -> Option<String> {
+    input
+        .get(key)
+        .and_then(Value::as_str)
+        .map(ToOwned::to_owned)
+}
+
+/// Derive the `(action, resource ARN)` pairs to authorize for a non-batch,
+/// non-transact `DynamoDB` operation. `action` is the bare operation form
+/// (`check_authorization` prepends `dynamodb:`). Most operations map to a
+/// single pair; multi-permission operations return more than one.
+///
+/// This function never returns an empty list: the generic single-table path is
+/// the fallback for operations not named explicitly.
+pub(crate) fn authz_targets(
+    operation: &str,
+    input: &Value,
+    region: &str,
+    account_id: &str,
+) -> Vec<(String, String)> {
+    let one = |resource: String| vec![(operation.to_owned(), resource)];
+
+    match operation {
+        // Resource lives in ResourceArn (a table or stream ARN; a foreign ARN
+        // passes the shape check and is denied by authorization).
+        "TagResource" | "UntagResource" | "ListTagsOfResource" => one(tag_resource_arn(
+            &str_field(input, "ResourceArn").unwrap_or_default(),
+            region,
+            account_id,
+        )),
+        // Resource lives in StreamArn, validated to a stream before authz.
+        "DescribeStream" | "GetShardIterator" => one(canonical_resource(
+            &str_field(input, "StreamArn").unwrap_or_default(),
+            region,
+            account_id,
+        )),
+        // GetRecords carries only an opaque shard iterator, not the stream in a
+        // body field, so it is handled in `authorize_request`: the iterator is
+        // decoded for the stream ARN, and an iterator that names no stream gets
+        // ValidationException "Invalid ShardIterator". `authz_targets` is never
+        // called for it; the account stream space is mapped here only so the
+        // table covers every operation.
+        "GetRecords" => one(stream_wildcard(region, account_id)),
+        "ListStreams" => {
+            let res = match str_field(input, "TableName") {
+                Some(t) => {
+                    // TableName here is a bare name; build table/<T>/stream/*.
+                    let rid = ResourceId {
+                        table: table_name_only(&t),
+                        sub: Some(Sub::Stream("*".to_owned())),
+                    };
+                    canonical(region, account_id, &rid)
+                }
+                None => stream_wildcard(region, account_id),
+            };
+            one(res)
+        }
+        // Resource lives in BackupArn, validated to a backup before authz.
+        "DescribeBackup" | "DeleteBackup" => one(canonical_resource(
+            &str_field(input, "BackupArn").unwrap_or_default(),
+            region,
+            account_id,
+        )),
+        // Resource is the table named by TableName.
+        "CreateBackup" | "DescribeContinuousBackups" | "UpdateContinuousBackups" => {
+            one(table_resource_arn(
+                &str_field(input, "TableName").unwrap_or_default(),
+                region,
+                account_id,
+            ))
+        }
+        // ListBackups is scoped to a table's backups when TableName is given,
+        // else to every table's backups. The service evaluates
+        // table/<T>/backup/* and table/*/backup/* (measured live), the same
+        // sub-resource shape as ListStreams, not the bare table or table/*.
+        "ListBackups" => {
+            let res = match str_field(input, "TableName") {
+                Some(t) => {
+                    let rid = ResourceId {
+                        table: table_name_only(&t),
+                        sub: Some(Sub::Backup("*".to_owned())),
+                    };
+                    canonical(region, account_id, &rid)
+                }
+                None => backup_wildcard(region, account_id),
+            };
+            one(res)
+        }
+        // Export names its source in TableArn. Authorize against the canonical
+        // form of the ARN as given, preserving its kind: a well-formed stream or
+        // index ARN is authorized against that stream/index ARN (the service
+        // does the same, measured live), and the export handler then refuses a
+        // non-table ARN. Unparseable TableArns were already refused before
+        // authorization by `validate_operation_arns`.
+        "ExportTableToPointInTime" => one(canonical_resource(
+            &str_field(input, "TableArn").unwrap_or_default(),
+            region,
+            account_id,
+        )),
+        // Import creates a table; the resource is the new table.
+        "ImportTable" => {
+            let t = input
+                .get("TableCreationParameters")
+                .and_then(|p| p.get("TableName"))
+                .and_then(Value::as_str)
+                .unwrap_or_default();
+            one(table_resource_arn(t, region, account_id))
+        }
+        // RestoreTableFromBackup requires dynamodb:RestoreTableFromBackup on the
+        // source backup ARN and the item actions on the target table it writes
+        // (measured live). A Deny on the backup ARN, or on any item action for
+        // the target table, blocks the restore.
+        "RestoreTableFromBackup" => {
+            let mut v = vec![(
+                operation.to_owned(),
+                canonical_resource(
+                    &str_field(input, "BackupArn").unwrap_or_default(),
+                    region,
+                    account_id,
+                ),
+            )];
+            let target = table_resource_arn(
+                &str_field(input, "TargetTableName").unwrap_or_default(),
+                region,
+                account_id,
+            );
+            for a in RESTORE_TARGET_ACTIONS {
+                v.push(((*a).to_owned(), target.clone()));
+            }
+            v
+        }
+        // RestoreTableToPointInTime requires dynamodb:RestoreTableToPointInTime
+        // on the source table and the item actions on the target table it
+        // writes (measured live).
+        "RestoreTableToPointInTime" => {
+            let source = str_field(input, "SourceTableArn")
+                .or_else(|| str_field(input, "SourceTableName"))
+                .unwrap_or_default();
+            let mut v = vec![(
+                operation.to_owned(),
+                table_resource_arn(&source, region, account_id),
+            )];
+            let target = table_resource_arn(
+                &str_field(input, "TargetTableName").unwrap_or_default(),
+                region,
+                account_id,
+            );
+            for a in RESTORE_TARGET_ACTIONS {
+                v.push(((*a).to_owned(), target.clone()));
+            }
+            v
+        }
+        // Query and Scan on an index authorize the index ARN.
+        "Query" | "Scan" => {
+            let base = table_resource_arn(
+                &str_field(input, "TableName").unwrap_or_default(),
+                region,
+                account_id,
+            );
+            match str_field(input, "IndexName") {
+                Some(idx) if !idx.is_empty() => one(format!("{base}/index/{idx}")),
+                _ => one(base),
+            }
+        }
+        // Account-level operations. ListTables is evaluated against the table
+        // wildcard and DescribeLimits against "*" (measured live).
+        // DescribeEndpoints is not authorized at all (see authorize_request);
+        // its "*" entry is kept so the resource map covers every operation.
+        "ListTables" => one(table_wildcard(region, account_id)),
+        "DescribeLimits" | "DescribeEndpoints" => one("*".to_owned()),
+        // Generic single-table operations keyed by TableName (name or ARN).
+        _ => match str_field(input, "TableName") {
+            Some(t) => one(table_resource_arn(&t, region, account_id)),
+            None => one(table_wildcard(region, account_id)),
+        },
+    }
+}
+
+/// The bare table name from a value that may be a name or a table ARN.
+fn table_name_only(value: &str) -> String {
+    if value.starts_with("arn:")
+        && let Some(rid) = parse_resource_identity(value)
+    {
+        return rid.table;
+    }
+    value.to_owned()
+}
+
+/// The table name to look up key info under when a request names its table by
+/// `value`, which may be a bare table name or a table ARN.
+///
+/// A table ARN is reduced to its table name only when it names a table in this
+/// deployment's partition, service, region and the caller's account. Any other
+/// ARN is returned unchanged, so the lookup finds no table and the engine
+/// handles the request exactly as it would without this helper.
+pub(crate) fn key_lookup_name(value: &str, region: &str, account_id: &str) -> String {
+    if let Some(f) = arn_fields(value)
+        && f.partition == PARTITION
+        && f.service == SERVICE
+        && f.region == region
+        && f.account == account_id
+        && let Some(rid) = parse_resource_identity(value)
+        && rid.sub.is_none()
+    {
+        return rid.table;
+    }
+    value.to_owned()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    const R: &str = "us-east-1";
+    const A: &str = "964157134968";
+
+    fn only(op: &str, input: Value) -> String {
+        let t = authz_targets(op, &input, R, A);
+        assert_eq!(t.len(), 1, "expected one target for {op}: {t:?}");
+        assert_eq!(t[0].0, op);
+        t[0].1.clone()
+    }
+
+    // -- parser --
+
+    #[test]
+    fn parses_table() {
+        assert_eq!(
+            parse_resource_identity("arn:aws:dynamodb:us-east-1:1:table/T"),
+            Some(ResourceId {
+                table: "T".into(),
+                sub: None
+            })
+        );
+    }
+
+    #[test]
+    fn parses_stream_label_with_colons() {
+        assert_eq!(
+            parse_resource_identity(
+                "arn:aws:dynamodb:us-east-1:1:table/T/stream/2026-10-20T16:17:40.188"
+            ),
+            Some(ResourceId {
+                table: "T".into(),
+                sub: Some(Sub::Stream("2026-10-20T16:17:40.188".into())),
+            })
+        );
+    }
+
+    #[test]
+    fn parses_index_and_backup() {
+        assert_eq!(
+            parse_resource_identity("arn:aws:dynamodb:us-east-1:1:table/T/index/gsi1"),
+            Some(ResourceId {
+                table: "T".into(),
+                sub: Some(Sub::Index("gsi1".into()))
+            })
+        );
+        assert_eq!(
+            parse_resource_identity("arn:aws:dynamodb:us-east-1:1:table/T/backup/01-ab"),
+            Some(ResourceId {
+                table: "T".into(),
+                sub: Some(Sub::Backup("01-ab".into()))
+            })
+        );
+    }
+
+    #[test]
+    fn rejects_non_table_and_malformed() {
+        assert_eq!(parse_resource_identity("banana"), None);
+        assert_eq!(
+            parse_resource_identity("arn:aws:dynamodb:us-east-1:1:banana/x"),
+            None
+        );
+        assert_eq!(
+            parse_resource_identity("arn:aws:dynamodb:us-east-1:1:table/"),
+            None
+        );
+        assert_eq!(
+            parse_resource_identity("arn:aws:dynamodb:us-east-1:1:table/T/weird/x"),
+            None
+        );
+    }
+
+    // -- canonicalization closes the respelling bypass --
+
+    #[test]
+    fn respelled_partition_service_region_account_canonicalize_to_same_arn() {
+        let canonical =
+            "arn:aws:dynamodb:us-east-1:964157134968:table/T/stream/2026-10-20T16:17:40.188";
+        for respelled in [
+            "arn:aws-cn:dynamodb:us-east-1:964157134968:table/T/stream/2026-10-20T16:17:40.188",
+            "arn:aws:s3:us-east-1:964157134968:table/T/stream/2026-10-20T16:17:40.188",
+            "arn:aws:dynamodb:us-west-2:964157134968:table/T/stream/2026-10-20T16:17:40.188",
+            "arn:aws:dynamodb:us-east-1:111122223333:table/T/stream/2026-10-20T16:17:40.188",
+        ] {
+            assert_eq!(
+                only("DescribeStream", json!({ "StreamArn": respelled })),
+                canonical,
+                "respelled {respelled} must canonicalize"
+            );
+        }
+    }
+
+    // -- per-operation resource derivation (matches live DynamoDB) --
+
+    #[test]
+    fn tag_ops_use_resource_arn() {
+        let table_arn = "arn:aws:dynamodb:us-east-1:964157134968:table/bb";
+        for op in ["TagResource", "UntagResource", "ListTagsOfResource"] {
+            assert_eq!(only(op, json!({ "ResourceArn": table_arn })), table_arn);
+        }
+        // a stream ARN as the tag target is preserved
+        let stream =
+            "arn:aws:dynamodb:us-east-1:964157134968:table/bb/stream/2026-10-20T16:17:40.188";
+        assert_eq!(
+            only("TagResource", json!({ "ResourceArn": stream })),
+            stream
+        );
+    }
+
+    #[test]
+    fn stream_reads_use_stream_arn() {
+        let s = "arn:aws:dynamodb:us-east-1:964157134968:table/bb/stream/2026-10-20T16:17:40.188";
+        assert_eq!(only("DescribeStream", json!({ "StreamArn": s })), s);
+        assert_eq!(only("GetShardIterator", json!({ "StreamArn": s })), s);
+    }
+
+    #[test]
+    fn list_streams_scopes_to_table_then_account() {
+        assert_eq!(
+            only("ListStreams", json!({ "TableName": "bb" })),
+            "arn:aws:dynamodb:us-east-1:964157134968:table/bb/stream/*"
+        );
+        assert_eq!(
+            only("ListStreams", json!({})),
+            "arn:aws:dynamodb:us-east-1:964157134968:table/*/stream/*"
+        );
+    }
+
+    #[test]
+    fn list_backups_scopes_to_table_backups_then_account() {
+        // The service evaluates ListBackups against table/<T>/backup/* with a
+        // TableName and table/*/backup/* without (measured live), not the bare
+        // table or table/*.
+        assert_eq!(
+            only("ListBackups", json!({ "TableName": "bb" })),
+            "arn:aws:dynamodb:us-east-1:964157134968:table/bb/backup/*"
+        );
+        assert_eq!(
+            only("ListBackups", json!({})),
+            "arn:aws:dynamodb:us-east-1:964157134968:table/*/backup/*"
+        );
+        // A table ARN in TableName is reduced to its table name first.
+        assert_eq!(
+            only(
+                "ListBackups",
+                json!({ "TableName": "arn:aws:dynamodb:us-east-1:964157134968:table/bb" })
+            ),
+            "arn:aws:dynamodb:us-east-1:964157134968:table/bb/backup/*"
+        );
+    }
+
+    #[test]
+    fn backup_ops_use_backup_arn_or_table() {
+        let b = "arn:aws:dynamodb:us-east-1:964157134968:table/bb/backup/01-ab";
+        assert_eq!(only("DescribeBackup", json!({ "BackupArn": b })), b);
+        assert_eq!(only("DeleteBackup", json!({ "BackupArn": b })), b);
+        assert_eq!(
+            only(
+                "CreateBackup",
+                json!({ "TableName": "bb", "BackupName": "x" })
+            ),
+            "arn:aws:dynamodb:us-east-1:964157134968:table/bb"
+        );
+    }
+
+    #[test]
+    fn query_scan_on_index_use_index_arn() {
+        assert_eq!(
+            only("Query", json!({ "TableName": "bb", "IndexName": "gsi1" })),
+            "arn:aws:dynamodb:us-east-1:964157134968:table/bb/index/gsi1"
+        );
+        assert_eq!(
+            only("Scan", json!({ "TableName": "bb", "IndexName": "lsi1" })),
+            "arn:aws:dynamodb:us-east-1:964157134968:table/bb/index/lsi1"
+        );
+        assert_eq!(
+            only("Query", json!({ "TableName": "bb" })),
+            "arn:aws:dynamodb:us-east-1:964157134968:table/bb"
+        );
+    }
+
+    #[test]
+    fn table_name_may_be_an_arn() {
+        let arn = "arn:aws:dynamodb:us-east-1:964157134968:table/bb";
+        assert_eq!(only("GetItem", json!({ "TableName": arn })), arn);
+        // a respelled table ARN in TableName canonicalizes
+        assert_eq!(
+            only(
+                "GetItem",
+                json!({ "TableName": "arn:aws-cn:dynamodb:us-west-2:111122223333:table/bb" })
+            ),
+            arn
+        );
+    }
+
+    #[test]
+    fn account_level_ops_use_table_wildcard() {
+        assert_eq!(
+            only("ListTables", json!({})),
+            "arn:aws:dynamodb:us-east-1:964157134968:table/*"
+        );
+        assert_eq!(only("DescribeLimits", json!({})), "*");
+    }
+
+    #[test]
+    fn restore_export_import_use_measured_resource() {
+        let backup = "arn:aws:dynamodb:us-east-1:964157134968:table/bb/backup/01-ab";
+        // RestoreTableFromBackup: the restore action on the backup ARN plus the
+        // seven item actions on the target table.
+        let rfb = authz_targets(
+            "RestoreTableFromBackup",
+            &json!({ "TargetTableName": "restored", "BackupArn": backup }),
+            R,
+            A,
+        );
+        assert!(rfb.contains(&("RestoreTableFromBackup".to_owned(), backup.to_owned())));
+        let target = "arn:aws:dynamodb:us-east-1:964157134968:table/restored".to_owned();
+        for a in RESTORE_TARGET_ACTIONS {
+            assert!(
+                rfb.contains(&((*a).to_owned(), target.clone())),
+                "RestoreTableFromBackup missing {a} on target"
+            );
+        }
+        assert_eq!(rfb.len(), 1 + RESTORE_TARGET_ACTIONS.len());
+
+        // RestoreTableToPointInTime: the restore action on the source table
+        // plus the seven item actions on the target table.
+        let pitr = authz_targets(
+            "RestoreTableToPointInTime",
+            &json!({ "SourceTableName": "bb", "TargetTableName": "pitr" }),
+            R,
+            A,
+        );
+        assert!(pitr.contains(&(
+            "RestoreTableToPointInTime".to_owned(),
+            "arn:aws:dynamodb:us-east-1:964157134968:table/bb".to_owned()
+        )));
+        let ptarget = "arn:aws:dynamodb:us-east-1:964157134968:table/pitr".to_owned();
+        for a in RESTORE_TARGET_ACTIONS {
+            assert!(
+                pitr.contains(&((*a).to_owned(), ptarget.clone())),
+                "RestoreTableToPointInTime missing {a} on target"
+            );
+        }
+        assert_eq!(pitr.len(), 1 + RESTORE_TARGET_ACTIONS.len());
+
+        // ExportTableToPointInTime: only the export action on the source table.
+        assert_eq!(
+            only(
+                "ExportTableToPointInTime",
+                json!({ "TableArn": "arn:aws:dynamodb:us-east-1:964157134968:table/bb", "S3Bucket": "x" })
+            ),
+            "arn:aws:dynamodb:us-east-1:964157134968:table/bb"
+        );
+        // ImportTable: only the import action on the new table.
+        assert_eq!(
+            only(
+                "ImportTable",
+                json!({ "TableCreationParameters": { "TableName": "imp" } })
+            ),
+            "arn:aws:dynamodb:us-east-1:964157134968:table/imp"
+        );
+    }
+
+    #[test]
+    fn missing_resource_field_never_falls_back_to_table_wildcard() {
+        // An absent ResourceArn yields the empty string, not table/*, so no
+        // specific Deny is silently skipped.
+        assert_eq!(only("TagResource", json!({})), "");
+        assert_eq!(only("DescribeStream", json!({})), "");
+    }
+
+    #[test]
+    fn tag_resource_arn_shape_rejects_index_and_backup() {
+        // Tags are accepted only on a table or a stream. An index is rejected
+        // as not a table or stream; a backup is not a DynamoDB resource arn.
+        // Both measured live.
+        let index = "arn:aws:dynamodb:us-east-1:964157134968:table/bb/index/gsi1";
+        assert!(matches!(
+            validate_tag_resource_arn_shape(index),
+            Err(DynamoDbError::ValidationException(ref m))
+                if m.contains("only table or stream is accepted") && m.contains(index)
+        ));
+        for backup in [
+            "arn:aws:dynamodb:us-east-1:964157134968:table/bb/backup/01792513080555-82c5bd04",
+            "arn:aws:dynamodb:us-east-1:964157134968:table/bb/backup/01-ab",
+        ] {
+            assert!(
+                matches!(
+                    validate_tag_resource_arn_shape(backup),
+                    Err(DynamoDbError::ValidationException(ref m))
+                        if m == &format!(
+                            "One or more parameter values were invalid: Provided Arn is not a \
+                             DynamoDB resource arn: {backup}"
+                        )
+                ),
+                "expected not-a-DynamoDB-resource for {backup}"
+            );
+        }
+        // A table ARN and a stream ARN pass the shape check.
+        assert!(
+            validate_tag_resource_arn_shape("arn:aws:dynamodb:us-east-1:964157134968:table/bb")
+                .is_ok()
+        );
+        assert!(
+            validate_tag_resource_arn_shape(
+                "arn:aws:dynamodb:us-east-1:964157134968:table/bb/stream/2026-10-20T16:17:40.188"
+            )
+            .is_ok()
+        );
+    }
+
+    #[test]
+    fn tag_resource_arn_shape_matches_service_ordering() {
+        // Measured live. ValidationException before authorization, every
+        // principal:
+        let not_arn = validate_tag_resource_arn_shape("banana");
+        assert!(matches!(
+            not_arn,
+            Err(DynamoDbError::ValidationException(ref m))
+                if m.contains("ARNs must start with 'arn:': banana")
+        ));
+        let bad_type =
+            validate_tag_resource_arn_shape("arn:aws:dynamodb:us-east-1:964157134968:banana/x");
+        assert!(matches!(
+            bad_type,
+            Err(DynamoDbError::ValidationException(ref m))
+                if m.contains("Provided Arn is not a DynamoDB resource arn")
+        ));
+        // A foreign-service ARN whose resource is not a table passes the shape
+        // check and is left to authorization (which denies it).
+        assert!(validate_tag_resource_arn_shape("arn:aws:s3:::mybucket").is_ok());
+        // A table ARN whose partition, service, or region is this deployment's
+        // or not passes the shape check; the engine handler validates those
+        // fields after authorization.
+        assert!(
+            validate_tag_resource_arn_shape("arn:aws-cn:dynamodb:us-east-1:964157134968:table/bb")
+                .is_ok()
+        );
+        assert!(
+            validate_tag_resource_arn_shape("arn:aws:s3:us-east-1:964157134968:table/bb").is_ok()
+        );
+    }
+
+    // One differential corpus for every entry point that turns an ARN into a
+    // resource identity. All of them now route through the single shared parser
+    // `extenddb_core::arn`: authorization (`parse_resource_identity`), the
+    // export table resolver and both tagging parsers (`extenddb_core::arn`
+    // directly), the backup account split (`extenddb_core::arn::fields`), and
+    // the engine stream resolver (`extenddb_storage::util::parse_stream_arn`).
+    // The corpus asserts they agree on (table, sub-resource) or all refuse, so
+    // no respelling exists that one layer resolves and another does not. This is
+    // the property whose absence let the A2 bypass (`xrn:` authorized as the raw
+    // string, served as the real stream) and the A1 bypass (export reading a
+    // different table than authorization checked) happen.
+    #[test]
+    fn every_arn_entry_point_agrees_or_all_refuse() {
+        use extenddb_core::arn::{self, SubResource};
+        use extenddb_storage::util::parse_stream_arn;
+
+        // Inputs spanning: non-`arn` prefixes, empty fields, repeated `table/`
+        // segments, appended sub-resources on every kind, unknown kinds,
+        // trailing slashes, empty ids, foreign partition/service/region/account,
+        // colons in stream labels, and `/` inside ids.
+        let corpus = [
+            "banana",
+            "xrn:aws:dynamodb:us-east-1:1:table/T/stream/2026-10-20T16:17:40.188",
+            ":aws:dynamodb:us-east-1:1:table/T",
+            "arn:aws::us-east-1:1:table/T",
+            "arn:aws:dynamodb::1:table/T",
+            "arn:aws:dynamodb:us-east-1::table/T",
+            "arn:aws:dynamodb:us-east-1:1:table/T",
+            "arn:aws:dynamodb:us-east-1:1:table/allowed/stream/table/secret",
+            "arn:aws:dynamodb:us-east-1:1:table/a/table/b",
+            "arn:aws:dynamodb:us-east-1:1:table/T/index/gsi1",
+            "arn:aws:dynamodb:us-east-1:1:table/T/index/gsi1/extra",
+            "arn:aws:dynamodb:us-east-1:1:table/T/stream/2026-10-20T16:17:40.188",
+            "arn:aws:dynamodb:us-east-1:1:table/T/stream/a/b",
+            "arn:aws:dynamodb:us-east-1:1:table/T/backup/01-ab",
+            "arn:aws:dynamodb:us-east-1:1:table/T/weird/x",
+            "arn:aws:dynamodb:us-east-1:1:table/",
+            "arn:aws:dynamodb:us-east-1:1:table/T/",
+            "arn:aws:dynamodb:us-east-1:1:table/T/stream/",
+            "arn:aws-cn:dynamodb:us-east-1:1:table/T/stream/2026-10-20T16:17:40.188",
+            "arn:aws:s3:us-east-1:1:table/T/stream/2026-10-20T16:17:40.188",
+            "arn:aws:dynamodb:eu-west-1:1:table/T/backup/01-ab",
+            "arn:aws:dynamodb:us-east-1:999999999999:table/T",
+        ];
+
+        for input in corpus {
+            let core = arn::parse(input);
+
+            // Authorization's parser wraps the shared parser: they agree on
+            // (table, sub-resource) for every input.
+            let authz = parse_resource_identity(input);
+            match (&core, &authz) {
+                (None, None) => {}
+                (Some(c), Some(a)) => {
+                    assert_eq!(a.table, c.table, "authz table mismatch for {input}");
+                    let want_sub = c.sub.clone().map(|s| match s {
+                        SubResource::Index(i) => Sub::Index(i),
+                        SubResource::Stream(s) => Sub::Stream(s),
+                        SubResource::Backup(b) => Sub::Backup(b),
+                    });
+                    assert_eq!(a.sub, want_sub, "authz sub mismatch for {input}");
+                }
+                _ => panic!("authz and core parser disagree on {input}"),
+            }
+
+            // The engine stream resolver accepts an input iff the shared parser
+            // yields a stream, with the same table and label.
+            match (&core, parse_stream_arn(input)) {
+                (
+                    Some(arn::TableResource {
+                        table,
+                        sub: Some(SubResource::Stream(label)),
+                        ..
+                    }),
+                    Ok((t, l)),
+                ) => {
+                    assert_eq!(&t, table, "stream table mismatch for {input}");
+                    assert_eq!(&l, label, "stream label mismatch for {input}");
+                }
+                (
+                    Some(arn::TableResource {
+                        sub: Some(SubResource::Stream(_)),
+                        ..
+                    }),
+                    Err(_),
+                ) => {
+                    panic!("shared parser accepted stream but engine rejected it: {input}")
+                }
+                (_, Ok(_)) => panic!("engine resolved a non-stream input as a stream: {input}"),
+                (_, Err(_)) => {}
+            }
+
+            // The export table resolver accepts an input iff the shared parser
+            // yields a bare table (no sub-resource); a repeated `table/` segment
+            // or any sub-resource is refused, so it cannot read a different
+            // table than authorization canonicalized.
+            let export_ok = matches!(core, Some(arn::TableResource { sub: None, .. }));
+            if input == "arn:aws:dynamodb:us-east-1:1:table/allowed/stream/table/secret" {
+                assert!(!export_ok, "export must refuse the A1 bypass ARN");
+            }
+
+            // Canonicalization closes the respelling bypass: every parseable
+            // resource maps to this deployment's partition, service, region, and
+            // account, so a Deny on the real resource is always evaluated
+            // against the real resource.
+            if let Some(rid) = &authz {
+                let c = canonical("us-east-1", "964157134968", rid);
+                assert!(
+                    c.starts_with("arn:aws:dynamodb:us-east-1:964157134968:table/"),
+                    "canonical did not pin deployment fields for {input}"
+                );
+            }
+        }
+
+        // The two bypass inputs that motivated this round, stated explicitly.
+        // `xrn:` is refused everywhere (A2): authorization rejects it and the
+        // engine stream resolver rejects it, so it is never authorized as the
+        // raw string nor served.
+        assert!(parse_resource_identity("xrn:aws:dynamodb:us-east-1:1:table/T/stream/x").is_none());
+        assert!(parse_stream_arn("xrn:aws:dynamodb:us-east-1:1:table/T/stream/x").is_err());
+
+        // The export A1 bypass input `.../table/allowed/stream/table/secret` is
+        // a repeated `table/` segment, so it does not parse (the id would
+        // contain `/`). Under the old code authorization canonicalized it to
+        // table `allowed` while the engine's `rsplit_once("table/")` exported
+        // `secret`. It is now unparseable, so export refuses it before
+        // authorization with the service's "not a valid ARN" message.
+        let a1 = "arn:aws:dynamodb:us-east-1:1:table/allowed/stream/table/secret";
+        assert!(arn::parse(a1).is_none());
+        assert!(matches!(
+            validate_operation_arns("ExportTableToPointInTime", &json!({ "TableArn": a1 })),
+            Err(DynamoDbError::ValidationException(ref m)) if m == INVALID_EXPORT_TABLE_ARN_MESSAGE
+        ));
+    }
+
+    #[test]
+    fn validate_operation_arns_matches_measured_live_behaviour() {
+        let err_msg = |op: &str, input: Value| match validate_operation_arns(op, &input) {
+            Err(DynamoDbError::ValidationException(m)) => Some(m),
+            Ok(()) => None,
+            other => panic!("unexpected {other:?}"),
+        };
+
+        // Export: only an UNPARSEABLE TableArn is refused before authz, with the
+        // "tableArn is not a valid ARN" message (repeated table/ segments, a
+        // bare name, an xrn: ARN). A well-formed stream or index ARN is NOT
+        // refused here: it is authorized against its canonical form and the
+        // export handler refuses it afterwards.
+        for arn in [
+            "arn:aws:dynamodb:us-east-1:1:table/a/stream/table/b",
+            "arn:aws:dynamodb:us-east-1:1:table/a/index/table/b",
+            "table/x",
+            "xrn:aws:dynamodb:us-east-1:1:table/t",
+        ] {
+            assert_eq!(
+                err_msg("ExportTableToPointInTime", json!({ "TableArn": arn })).as_deref(),
+                Some(INVALID_EXPORT_TABLE_ARN_MESSAGE),
+                "export should refuse unparseable {arn} before authz"
+            );
+        }
+        for arn in [
+            "arn:aws:dynamodb:us-east-1:1:table/t",
+            "arn:aws:dynamodb:us-east-1:1:table/t/stream/2026-10-20T16:17:40.188",
+            "arn:aws:dynamodb:us-east-1:1:table/t/index/g",
+        ] {
+            assert_eq!(
+                err_msg("ExportTableToPointInTime", json!({ "TableArn": arn })),
+                None,
+                "export should NOT refuse well-formed {arn} before authz"
+            );
+        }
+
+        // Stream reads: a table ARN, an xrn: ARN, and an empty partition are all
+        // refused before authz with exactly "Invalid StreamArn"; a stream ARN
+        // passes.
+        for arn in [
+            "arn:aws:dynamodb:us-east-1:1:table/t",
+            "xrn:aws:dynamodb:us-east-1:1:table/t/stream/x",
+            "arn::dynamodb:us-east-1:1:table/t/stream/x",
+        ] {
+            for op in ["DescribeStream", "GetShardIterator"] {
+                assert_eq!(
+                    err_msg(op, json!({ "StreamArn": arn })).as_deref(),
+                    Some(INVALID_STREAM_ARN_MESSAGE),
+                    "{op} should refuse {arn}"
+                );
+            }
+        }
+        assert_eq!(
+            err_msg(
+                "DescribeStream",
+                json!({ "StreamArn": "arn:aws:dynamodb:us-east-1:1:table/t/stream/2026-10-20T16:17:40.188" })
+            ),
+            None
+        );
+
+        // Backup ops: a table ARN and an xrn: ARN are refused before authz with
+        // exactly "Invalid Backup ARN"; a backup ARN passes.
+        for arn in [
+            "arn:aws:dynamodb:us-east-1:1:table/t",
+            "xrn:aws:dynamodb:us-east-1:1:table/t/backup/01-ab",
+        ] {
+            for op in ["DescribeBackup", "DeleteBackup"] {
+                assert_eq!(
+                    err_msg(op, json!({ "BackupArn": arn })).as_deref(),
+                    Some(INVALID_BACKUP_ARN_MESSAGE),
+                    "{op} should refuse {arn}"
+                );
+            }
+        }
+        assert_eq!(
+            err_msg(
+                "DeleteBackup",
+                json!({ "BackupArn": "arn:aws:dynamodb:us-east-1:1:table/t/backup/01-ab" })
+            ),
+            None
+        );
+
+        // An absent or empty field is left to the normal path.
+        assert_eq!(err_msg("ExportTableToPointInTime", json!({})), None);
+        assert_eq!(err_msg("DescribeStream", json!({ "StreamArn": "" })), None);
+    }
+
+    #[test]
+    fn resource_tag_lookup_arn_reads_tags_only_for_tables_and_indexes() {
+        // A table ARN is looked up under itself.
+        assert_eq!(
+            resource_tag_lookup_arn("arn:aws:dynamodb:us-east-1:1:table/bb").as_deref(),
+            Some("arn:aws:dynamodb:us-east-1:1:table/bb")
+        );
+        // An index ARN resolves its tags under the base table ARN.
+        assert_eq!(
+            resource_tag_lookup_arn("arn:aws:dynamodb:us-east-1:1:table/bb/index/gsi1").as_deref(),
+            Some("arn:aws:dynamodb:us-east-1:1:table/bb")
+        );
+        // A table wildcard is looked up as given; the cache returns no tags.
+        assert_eq!(
+            resource_tag_lookup_arn("arn:aws:dynamodb:us-east-1:1:table/*").as_deref(),
+            Some("arn:aws:dynamodb:us-east-1:1:table/*")
+        );
+        // A stream, backup, export, foreign-service or wildcard resource has no
+        // tags for authorization (None), even though a stream can be tagged.
+        for arn in [
+            "arn:aws:dynamodb:us-east-1:1:table/bb/stream/2026-10-20T16:17:40.188",
+            "arn:aws:dynamodb:us-east-1:1:table/bb/backup/01792513080555-82c5bd04",
+            "arn:aws:dynamodb:us-east-1:1:table/bb/export/01761100000000-abcd1234",
+            "arn:aws:s3:::bucket",
+            "*",
+        ] {
+            assert_eq!(resource_tag_lookup_arn(arn), None, "{arn}");
+        }
+    }
+
+    #[test]
+    fn getrecords_resource_classifies_and_canonicalizes() {
+        // A current token authorizes against its canonical stream ARN.
+        let stream = "arn:aws:dynamodb:us-east-1:1:table/T/stream/2026-10-20T16:17:40.188";
+        let tok = extenddb_engine::encode_shard_iterator(
+            "shardId-1",
+            "AFTER_SEQUENCE_NUMBER",
+            "42",
+            1000,
+            stream,
+        );
+        match getrecords_resource(&json!({ "ShardIterator": tok }), R, A) {
+            GetRecordsResource::Stream(arn) => assert_eq!(
+                arn,
+                "arn:aws:dynamodb:us-east-1:964157134968:table/T/stream/2026-10-20T16:17:40.188"
+            ),
+            _ => panic!("expected Stream"),
+        }
+        // A token that carries no stream ARN but a parseable timestamp is the
+        // pre-upgrade shape; it is Expired.
+        let old = extenddb_engine::encode_shard_iterator(
+            "shardId-2",
+            "AFTER_SEQUENCE_NUMBER",
+            "7",
+            1000,
+            "",
+        );
+        assert!(matches!(
+            getrecords_resource(&json!({ "ShardIterator": old }), R, A),
+            GetRecordsResource::Expired
+        ));
+        // Garbage and an absent iterator are Invalid.
+        assert!(matches!(
+            getrecords_resource(&json!({ "ShardIterator": "!!!" }), R, A),
+            GetRecordsResource::Invalid
+        ));
+        assert!(matches!(
+            getrecords_resource(&json!({}), R, A),
+            GetRecordsResource::Invalid
+        ));
+    }
+}
+
+#[cfg(test)]
+mod key_lookup_name_tests {
+    use super::key_lookup_name;
+
+    #[test]
+    fn table_arn_for_this_account_and_region_resolves_to_the_table_name() {
+        let r = "us-east-1";
+        let a = "964157134968";
+        assert_eq!(key_lookup_name("orders", r, a), "orders");
+        assert_eq!(
+            key_lookup_name("arn:aws:dynamodb:us-east-1:964157134968:table/orders", r, a),
+            "orders"
+        );
+        for other in [
+            "arn:aws:dynamodb:us-east-1:111111111111:table/orders",
+            "arn:aws:dynamodb:eu-west-1:964157134968:table/orders",
+            "arn:aws-cn:dynamodb:us-east-1:964157134968:table/orders",
+            "arn:aws:s3:us-east-1:964157134968:table/orders",
+            "arn:aws:dynamodb:us-east-1:964157134968:table/orders/index/g1",
+            "arn:aws:dynamodb:us-east-1:964157134968:backup/orders",
+            "arn:aws:dynamodb",
+        ] {
+            assert_eq!(key_lookup_name(other, r, a), other, "{other}");
+        }
+    }
+}
diff --git a/crates/server/src/lib.rs b/crates/server/src/lib.rs
index a1ff087cc..69dc9e0a4 100755
--- a/crates/server/src/lib.rs
+++ b/crates/server/src/lib.rs
@@ -10,6 +10,7 @@
 
 pub(crate) mod authorization;
 pub mod authz_cache;
+pub(crate) mod authz_resource;
 pub mod console;
 pub mod dev_credentials;
 mod handler;
diff --git a/crates/server/src/request_helpers.rs b/crates/server/src/request_helpers.rs
index ed2599920..e7d12abf9 100755
--- a/crates/server/src/request_helpers.rs
+++ b/crates/server/src/request_helpers.rs
@@ -10,6 +10,7 @@ use serde_json::Value;
 
 use crate::AppState;
 use crate::authorization;
+use crate::authz_resource;
 
 /// Extract operation name from X-Amz-Target header.
 /// Accepts both `DynamoDB_20120810` and `DynamoDBStreams_20120810` wire-format prefixes.
@@ -35,11 +36,13 @@ pub(crate) fn extract_operation(headers: &HeaderMap) -> Result<String, DynamoDbE
         .ok_or_else(|| DynamoDbError::UnknownOperationException(String::new()))
 }
 
-/// Extract the table name from a `DynamoDB` request body.
+/// Extract the top-level `TableName` from a request body.
 ///
-/// Most operations use `TableName`. Batch and transact operations embed table
-/// names in nested structures, so this returns `None` for those; the caller
-/// maps `None` to `*` via `build_resource_arn`.
+/// Used to pre-fetch table key info for item operations. Batch and transact
+/// operations embed table names in nested structures and carry no top-level
+/// `TableName`, so this returns `None` for them. The authorization resource is
+/// derived separately by `authz_resource::authz_targets`, which never falls
+/// back to a `table/*` wildcard.
 pub(crate) fn extract_table_name(input: &Value) -> Option<String> {
     input
         .get("TableName")
@@ -108,17 +111,30 @@ pub(crate) async fn authorize_request(
     let table_name = extract_table_name(input);
     let mut authorized_key_info = extenddb_engine::AuthorizedKeyInfo::new();
 
+    // TableName may be a table ARN. dynamodb:LeadingKeys and the other item
+    // condition keys are read with the table's key schema, so key info is
+    // looked up by the table name the ARN names (this account and region only).
+    // Without this, the lookup misses, LeadingKeys is absent, and a
+    // ForAllValues condition is satisfied vacuously. The key info found this
+    // way is used for authorization only and is not put in the snapshot handed
+    // to the engine, which resolves the request's TableName itself as before.
+    let named_by_arn = table_name.as_deref().is_some_and(|t| t.starts_with("arn:"));
+
     // P118: Fetch table_key_info for item-level operations via the SWR cache.
     // The result is used for LeadingKeys extraction here AND returned to the
     // caller to avoid a redundant fetch in the engine layer.
+    let mut key_info = None;
     if let Some(ref tn) = table_name
         && matches!(
             operation,
             "GetItem" | "PutItem" | "DeleteItem" | "UpdateItem" | "Query" | "Scan"
         )
     {
-        let ki = key_info_for_authz(state.table_key_info_cache.get(account_id, tn).await)?;
-        authorized_key_info.insert(tn.clone(), ki);
+        let lookup = authz_resource::key_lookup_name(tn, &state.region, account_id);
+        key_info = key_info_for_authz(state.table_key_info_cache.get(account_id, &lookup).await)?;
+        if !named_by_arn {
+            authorized_key_info.insert(tn.clone(), key_info.clone());
+        }
     }
 
     // Developer mode opens authorization for the authenticated caller. SigV4
@@ -136,6 +152,88 @@ pub(crate) async fn authorize_request(
         return Ok(authorized_key_info);
     }
 
+    // Request-level condition keys every evaluation below carries: the
+    // deployment region, aws:SecureTransport, aws:SourceIp and aws:UserAgent.
+    let base_params = || extenddb_auth::policy::context::RequestParams {
+        region: Some(state.region.to_string()),
+        secure_transport: state.tls_enabled,
+        source_ip: source_ip.map(ToOwned::to_owned),
+        user_agent: user_agent.map(ToOwned::to_owned),
+        ..Default::default()
+    };
+
+    // DescribeEndpoints needs a signed request (SigV4 verification already ran
+    // upstream) but no IAM permission, as on DynamoDB: a caller with no policy,
+    // or with an explicit Deny on dynamodb:DescribeEndpoints or dynamodb:*, gets
+    // the endpoint list (measured 2026-10-20).
+    if operation == "DescribeEndpoints" {
+        return Ok(authorized_key_info);
+    }
+
+    // Tag operations validate the ResourceArn shape before the IAM decision, as
+    // the service does: an index ARN (tags are accepted only on a table or
+    // stream) is rejected with ValidationException for every principal, before
+    // authorization. A table or stream ARN passes; its account, region, and
+    // existence are checked after authorization by the engine tag handler.
+    if matches!(
+        operation,
+        "TagResource" | "UntagResource" | "ListTagsOfResource"
+    ) && let Some(arn) = input.get("ResourceArn").and_then(Value::as_str)
+        && !arn.is_empty()
+    {
+        authz_resource::validate_tag_resource_arn_shape(arn)?;
+    }
+
+    // Every other ARN-bearing field (StreamArn, BackupArn, the export TableArn,
+    // a restore SourceTableArn) must parse to the resource kind the operation
+    // takes, or the request is refused with ValidationException before the IAM
+    // decision. Without this, an ARN the engine resolves one way and
+    // authorization reads another lets a Deny on the real resource be bypassed.
+    authz_resource::validate_operation_arns(operation, input)?;
+
+    // GetRecords carries its resource only inside the opaque shard iterator, not
+    // in a request body field. Decode the iterator for the stream ARN and
+    // authorize against that specific stream, as the service does. The engine
+    // separately confirms the shard belongs to that stream before reading, so a
+    // token that names an allowed stream but a different stream's shard reads
+    // nothing.
+    //
+    // A token that does not decode, or decodes to neither a current token nor
+    // the pre-upgrade shape, is rejected with ValidationException "Invalid
+    // ShardIterator" before authorization. A pre-upgrade token (the four
+    // pre-stream-ARN fields with a parseable timestamp) is answered with
+    // ExpiredIteratorException before authorization, so a consumer reading
+    // across the upgrade renews its iterator instead of failing on the
+    // non-retryable "Invalid ShardIterator". The service answers an iterator it
+    // did not issue the same way whatever the caller's policy (measured
+    // 2026-10-20).
+    if operation == "GetRecords" {
+        let resource_arn =
+            match authz_resource::getrecords_resource(input, &state.region, account_id) {
+                authz_resource::GetRecordsResource::Stream(arn) => arn,
+                authz_resource::GetRecordsResource::Expired => {
+                    return Err(DynamoDbError::ExpiredIteratorException(
+                        extenddb_engine::SHARD_ITERATOR_EXPIRED_MESSAGE.to_owned(),
+                    ));
+                }
+                authz_resource::GetRecordsResource::Invalid => {
+                    return Err(DynamoDbError::ValidationException(
+                        "Invalid ShardIterator".to_owned(),
+                    ));
+                }
+            };
+        authorization::check_authorization(
+            state.authz_cache.as_ref(),
+            identity,
+            "GetRecords",
+            &resource_arn,
+            false,
+            base_params(),
+        )
+        .await?;
+        return Ok(authorized_key_info);
+    }
+
     // Batch and transaction operations address multiple tables in nested request
     // structures with no top-level TableName. DynamoDB authorizes each of them
     // per table, against that table's specific ARN, using the IAM action the
@@ -173,7 +271,10 @@ pub(crate) async fn authorize_request(
         // hand what was read to the engine. The engine resolves these tables
         // from the snapshot, so it never acts on a table authorization saw as
         // missing, and it sees the catalog as fresh as these handlers always
-        // read it.
+        // read it. A table named by ARN is read under that ARN string, which
+        // the catalog does not hold, so it is recorded as missing: LeadingKeys
+        // stays absent for it, and the engine answers ResourceNotFound from the
+        // same snapshot instead of resolving the ARN to the real table.
         for table in tables {
             let ki = key_info_for_authz(state.storage.table_key_info(account_id, &table).await)?;
             authorized_key_info.insert(table, ki);
@@ -187,33 +288,27 @@ pub(crate) async fn authorize_request(
             // empty one): still require the operation's action on the table
             // wildcard, as the generic path would, then let the engine reject
             // the body. This never silently skips authorization.
-            let resource_arn = build_resource_arn(&state.region, account_id, None);
+            let resource_arn = authz_resource::table_wildcard(&state.region, account_id);
             authorization::check_authorization(
                 state.authz_cache.as_ref(),
                 identity,
                 operation,
                 &resource_arn,
                 false,
-                extenddb_auth::policy::context::RequestParams {
-                    region: Some(state.region.to_string()),
-                    secure_transport: state.tls_enabled,
-                    source_ip: source_ip.map(ToOwned::to_owned),
-                    user_agent: user_agent.map(ToOwned::to_owned),
-                    ..Default::default()
-                },
+                base_params(),
             )
             .await?;
         } else {
             for target in targets {
+                // The RequestItems key (or TransactItems TableName) may be a
+                // bare name or a table ARN; canonicalize either to this
+                // deployment's table ARN so a respelled ARN cannot evade a
+                // per-table Deny.
                 let resource_arn =
-                    build_resource_arn(&state.region, account_id, Some(&target.table));
+                    authz_resource::table_resource_arn(&target.table, &state.region, account_id);
                 let params = extenddb_auth::policy::context::RequestParams {
                     leading_keys: target.leading_keys,
-                    region: Some(state.region.to_string()),
-                    secure_transport: state.tls_enabled,
-                    source_ip: source_ip.map(ToOwned::to_owned),
-                    user_agent: user_agent.map(ToOwned::to_owned),
-                    ..Default::default()
+                    ..base_params()
                 };
                 authorization::check_authorization(
                     state.authz_cache.as_ref(),
@@ -229,47 +324,65 @@ pub(crate) async fn authorize_request(
         return Ok(authorized_key_info);
     }
 
-    let resource_arn = build_resource_arn(&state.region, account_id, table_name.as_deref());
-    let key_info = table_name
-        .as_ref()
-        .and_then(|tn| authorized_key_info.get(tn))
-        .and_then(Option::as_ref);
+    // Derive the (action, resource ARN) pairs the service authorizes this
+    // operation against. The resource comes from the field the operation
+    // actually carries it in (ResourceArn, StreamArn, BackupArn, TableArn,
+    // IndexName, or a table ARN in TableName), canonicalized to this
+    // deployment, never a `table/*` fallback. See `authz_resource`.
+    let targets = authz_resource::authz_targets(operation, input, &state.region, account_id);
+    let is_scan = operation == "Scan";
 
-    let params = extenddb_auth::policy::context::RequestParams {
-        leading_keys: crate::leading_keys::single_table_leading_keys(
-            input,
-            operation,
-            key_info,
-            state.limits.max_expression_tokens,
-        ),
-        attributes: extract_attributes(input),
-        select: input
-            .get("Select")
-            .and_then(|v| v.as_str())
-            .map(ToOwned::to_owned),
-        return_values: input
-            .get("ReturnValues")
-            .and_then(|v| v.as_str())
-            .map(ToOwned::to_owned),
-        return_consumed_capacity: input
-            .get("ReturnConsumedCapacity")
-            .and_then(|v| v.as_str())
-            .map(ToOwned::to_owned),
-        region: Some(state.region.to_string()),
-        secure_transport: state.tls_enabled,
-        source_ip: source_ip.map(ToOwned::to_owned),
-        user_agent: user_agent.map(ToOwned::to_owned),
-        ..Default::default()
-    };
-    authorization::check_authorization(
-        state.authz_cache.as_ref(),
-        identity,
-        operation,
-        &resource_arn,
-        operation == "Scan",
-        params,
-    )
-    .await?;
+    if targets.len() == 1 {
+        // Single-resource operations carry the request params the policy engine
+        // reads for item-level condition keys.
+        let params = extenddb_auth::policy::context::RequestParams {
+            leading_keys: crate::leading_keys::single_table_leading_keys(
+                input,
+                operation,
+                key_info.as_ref(),
+                state.limits.max_expression_tokens,
+            ),
+            attributes: extract_attributes(input),
+            select: input
+                .get("Select")
+                .and_then(|v| v.as_str())
+                .map(ToOwned::to_owned),
+            return_values: input
+                .get("ReturnValues")
+                .and_then(|v| v.as_str())
+                .map(ToOwned::to_owned),
+            return_consumed_capacity: input
+                .get("ReturnConsumedCapacity")
+                .and_then(|v| v.as_str())
+                .map(ToOwned::to_owned),
+            ..base_params()
+        };
+        let (action, resource_arn) = &targets[0];
+        authorization::check_authorization(
+            state.authz_cache.as_ref(),
+            identity,
+            action,
+            resource_arn,
+            is_scan,
+            params,
+        )
+        .await?;
+    } else {
+        // Multi-permission operations (restore). Each pair is authorized with
+        // the request-level params; a Deny on any required resource fails the
+        // request.
+        for (action, resource_arn) in &targets {
+            authorization::check_authorization(
+                state.authz_cache.as_ref(),
+                identity,
+                action,
+                resource_arn,
+                false,
+                base_params(),
+            )
+            .await?;
+        }
+    }
 
     Ok(authorized_key_info)
 }
@@ -299,17 +412,6 @@ pub(crate) fn extract_attributes(input: &Value) -> Option<Vec<String>> {
     if names.is_empty() { None } else { Some(names) }
 }
 
-/// Build a `DynamoDB` table ARN for authorization.
-///
-/// If no table name is available (e.g. `ListTables`, `DescribeEndpoints`),
-/// uses `*` as the resource.
-fn build_resource_arn(region: &str, account_id: &str, table_name: Option<&str>) -> String {
-    match table_name {
-        Some(name) => format!("arn:aws:dynamodb:{region}:{account_id}:table/{name}"),
-        None => format!("arn:aws:dynamodb:{region}:{account_id}:table/*"),
-    }
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/crates/storage/src/util/arn.rs b/crates/storage/src/util/arn.rs
index 813c217bc..9ac7fc209 100755
--- a/crates/storage/src/util/arn.rs
+++ b/crates/storage/src/util/arn.rs
@@ -61,20 +61,21 @@ pub fn table_arn(region: &str, account_id: &str, table_name: &str) -> String {
 ///
 /// Stream ARNs contain ISO 8601 timestamps with colons in the stream label,
 /// e.g. `arn:aws:dynamodb:us-east-1:<account-id>:table/T/stream/2026-04-08T08:40:22`.
-/// We use `splitn(6, ':')` so the 6th element preserves everything after the 5th
-/// colon delimiter, including colons within the stream label.
+/// Parsing goes through [`extenddb_core::arn::parse`], the one parser shared
+/// with request validation and authorization, so a string the engine resolves
+/// to a stream is exactly a string authorization canonicalizes to the same
+/// stream. A missing `arn:` prefix, fewer than five fields, or a resource that
+/// is not `table/<name>/stream/<label>` is rejected.
 pub fn parse_stream_arn(arn: &str) -> Result<(String, String), StorageError> {
-    let segments: Vec<&str> = arn.splitn(6, ':').collect();
-    let resource = segments
-        .get(5)
-        .ok_or_else(|| StorageError::Validation(format!("Invalid stream ARN: {arn}")))?;
-    let parts: Vec<&str> = resource.splitn(4, '/').collect();
-    if parts.len() == 4 && parts[0] == "table" && parts[2] == "stream" {
-        Ok((parts[1].to_owned(), parts[3].to_owned()))
-    } else {
-        Err(StorageError::Validation(format!(
+    match extenddb_core::arn::parse(arn) {
+        Some(extenddb_core::arn::TableResource {
+            table,
+            sub: Some(extenddb_core::arn::SubResource::Stream(label)),
+            ..
+        }) => Ok((table, label)),
+        _ => Err(StorageError::Validation(format!(
             "Invalid stream ARN format: {arn}"
-        )))
+        ))),
     }
 }
 
diff --git a/docs/differences-from-dynamodb.md b/docs/differences-from-dynamodb.md
index 79ba14056..7c66291ee 100755
--- a/docs/differences-from-dynamodb.md
+++ b/docs/differences-from-dynamodb.md
@@ -28,6 +28,8 @@ adaptation when switching between ExtendDB and the real service.
 | Role chaining | Supported | Not implemented |
 | SourceIdentity, TransitiveTagKeys | Supported | Not implemented |
 | Resource policies | Supported | Not implemented (deferred) |
+| Table ARN as `TableName` | Accepted; the request acts on that table | Authorized against that table, then the request fails with `ResourceNotFoundException` |
+| AccessDenied message for an ARN outside this deployment (caller with no policy) | Names the ARN as supplied; an ARN in another account gets `Access is denied` | Names the ARN rewritten to this deployment's partition, service, region and account; an ARN in another account gets the full `is not authorized to perform` message. The decision is the same. |
 
 ## Import and Export
 
diff --git a/docs/manuals/05-admin-guide.md b/docs/manuals/05-admin-guide.md
index b76cf842c..f1e6160d7 100755
--- a/docs/manuals/05-admin-guide.md
+++ b/docs/manuals/05-admin-guide.md
@@ -528,6 +528,102 @@ absent, as the service leaves it unset for a non-MFA session. Like
 request path only; in a trust policy it is absent, as on the service for an
 `AssumeRole` caller using long-term credentials.
 
+### Resource-level authorization
+
+Every operation is authorized against the specific resource ARN, matching
+DynamoDB. The `Resource` element of a policy is matched field by field, and a
+`*` or `?` in the resource part of the ARN spans the `:` and `/` inside it.
+
+| Operation | Resource ARN authorized |
+|-----------|-------------------------|
+| Item and table operations (GetItem, PutItem, Query and Scan on the base table, CreateTable, UpdateTable, DescribeTable, and so on) | `table/<name>` |
+| Query and Scan with an `IndexName` | `table/<name>/index/<index>` |
+| TagResource, UntagResource, ListTagsOfResource | the `ResourceArn` (a table or stream ARN) |
+| DescribeStream, GetShardIterator | the `StreamArn` |
+| GetRecords | the stream the shard iterator reads |
+| ListStreams | `table/<name>/stream/*` when a table is named, else `table/*/stream/*` |
+| DescribeBackup, DeleteBackup | the `BackupArn` |
+| CreateBackup, DescribeContinuousBackups, UpdateContinuousBackups | `table/<name>` |
+| ExportTableToPointInTime | the source `table/<name>` |
+| ImportTable | the new `table/<name>` |
+| RestoreTableFromBackup | the backup ARN, plus Scan, Query, GetItem, PutItem, UpdateItem, DeleteItem and BatchWriteItem on the target `table/<name>` |
+| RestoreTableToPointInTime | the source `table/<name>`, plus the same item actions on the target `table/<name>` |
+| ListTables | `table/*` |
+| DescribeLimits | `*` |
+| DescribeEndpoints | not authorized (signed request, no IAM permission) |
+
+A policy that names another partition, service, region, or account in a
+resource ARN it supplies (for example on a stream or backup operation) cannot
+evade a Deny written against the real resource: the resource is resolved in this
+deployment's account regardless of those fields.
+
+#### Compatibility notes
+
+Earlier builds authorized several of these operations against
+`table/*` instead of the specific resource. Review existing policies before
+upgrading:
+
+- **Index reads.** Query and Scan with an `IndexName` are authorized against
+  `table/<name>/index/<index>`. A policy that granted a principal only
+  `table/<name>` no longer allows reads of that table's indexes. Grant
+  `table/<name>/index/<index>` or `table/<name>/index/*` as needed. This
+  matches DynamoDB.
+- **Fencing a whole table with a Deny.** Index reads, `ListStreams` with a
+  TableName, and `ListBackups` with a TableName are authorized against a
+  sub-resource ARN (`table/<name>/index/*`, `table/<name>/stream/*`,
+  `table/<name>/backup/*`), not the bare `table/<name>`. A `Deny` written only
+  on `table/<name>` therefore does not cover them. An operator who means to
+  fence a whole table adds `table/<name>/*` to the `Deny` alongside
+  `table/<name>`.
+- **Index reads and resource tags.** An index Query or Scan evaluates the base
+  table's resource tags (`aws:ResourceTag/*`; `dynamodb:ResourceTag/*` is
+  absent for every resource),
+  because a secondary index inherits the tags of its table. An ABAC `Deny` or
+  `Allow` conditioned on the table's tags applies to its indexes.
+- **Streams, backups, and resource tags.** An operation on a stream ARN
+  (DescribeStream, GetShardIterator, GetRecords, and a tag operation on the
+  stream) and an operation on a backup ARN evaluate no resource tags, as on
+  DynamoDB: `aws:ResourceTag/*` and `dynamodb:ResourceTag/*` are absent. A
+  stream holds a tag set of its own, separate from its table's, but neither set
+  is evaluated for the stream's operations. A condition on the key evaluates as
+  for an absent key: `StringEquals` and `StringLike` do not match, while a
+  negated operator, an `IfExists` form, `ForAllValues`, and `Null` true do. A
+  backup ARN cannot be tagged.
+- **DescribeLimits and DescribeEndpoints.** DescribeLimits is authorized against
+  `*`, not `table/*`, so a grant or a `Deny` scoped to `table/*` no longer
+  applies to it; scope its statement to `*`. DescribeEndpoints is not evaluated
+  against IAM at all (it needs a signed request but no permission), so a `Deny`
+  on it does not block it, matching DynamoDB.
+- **Streams.** A policy whose resource is `table/<name>/stream/*` now matches
+  concrete stream ARNs (the stream label contains `:`, which the resource
+  wildcard now spans). A Deny on a specific stream ARN, or on a tag, backup, or
+  index ARN, now takes effect where before it was bypassed.
+- **GetRecords.** GetRecords is authorized against the stream its shard iterator
+  reads, so a principal needs `dynamodb:GetRecords` on that stream. A shard
+  iterator issued by a build before this change does not identify its stream;
+  after upgrade, GetRecords on such an iterator returns
+  `ExpiredIteratorException` with the expiry message, so a stream client renews
+  it by calling GetShardIterator rather than failing on a non-retryable error.
+  This matters during the upgrade itself: a consumer reading when the server
+  restarts holds a pre-upgrade iterator, and its iterator chain renews cleanly
+  instead of stalling. A token that does not decode at all still returns
+  `ValidationException` with the message `Invalid ShardIterator`, which is what
+  DynamoDB returns for an iterator it did not issue. Shard iterators expire after
+  15 minutes.
+- **Restores.** A restore writes items into its target table, so
+  RestoreTableFromBackup and RestoreTableToPointInTime require the item write
+  and read actions on the target table in addition to the restore action. A
+  principal that could previously restore with only the restore permission now
+  also needs those actions on the target table name.
+- **Denial messages.** An AccessDeniedException now ends with the clause the
+  service uses: "with an explicit deny in an identity-based policy" when an
+  explicit Deny matched the request, or "because no identity-based policy allows
+  the <action> action" otherwise. Earlier builds returned the common prefix with
+  no trailing clause and did not distinguish the two cases. The error code is
+  unchanged, so a client that checks the code or the substring "is not
+  authorized to perform" is unaffected; tooling that matched the full message
+  text verbatim will see the new clause.
+
 ### Permissions Boundaries
 
 ```bash
diff --git a/docs/manuals/07-upgrade-manual.md b/docs/manuals/07-upgrade-manual.md
index 6f4bd25c8..063a15ad0 100755
--- a/docs/manuals/07-upgrade-manual.md
+++ b/docs/manuals/07-upgrade-manual.md
@@ -297,6 +297,54 @@ LeadingKeys policies with `extenddb manage list-user-policies` /
 
 ---
 
+### IAM: operations authorize against their specific resource ARN
+
+**What changed.** Every operation is now authorized against the specific resource
+it acts on, resolved through one parser shared by authorization and the engine,
+rather than a `table/*` wildcard or the raw request string. A `Deny` or a narrow
+`Allow` written against a specific table, index, stream, or backup now takes
+effect where it was previously bypassed.
+
+**Who is affected and what to change** (no catalog migration is required):
+
+- **Index reads need an index grant.** Query and Scan with an `IndexName` are
+  authorized against `table/<name>/index/<index>`. A policy granting only
+  `table/<name>` no longer allows that table's index reads; grant
+  `table/<name>/index/<index>` or `table/<name>/index/*`.
+- **Fencing a whole table with a Deny.** Index reads, `ListStreams` with a
+  TableName, and `ListBackups` with a TableName are authorized against a
+  sub-resource ARN (`table/<name>/index/*`, `table/<name>/stream/*`,
+  `table/<name>/backup/*`), not the bare `table/<name>`. A `Deny` on
+  `table/<name>` does not cover them: add `table/<name>/*` to the `Deny`
+  alongside `table/<name>` to fence the whole table.
+- **Index reads and resource tags.** An index Query or Scan evaluates the base
+  table's resource tags, because an index inherits its table's tags. An ABAC
+  `Deny` or `Allow` conditioned on the table's tags now applies to its indexes.
+- **ListStreams, ListBackups, and resource tags.** ListStreams and ListBackups
+  with a TableName are authorized against the table's `stream/*` or `backup/*`
+  sub-resource, which carries no resource tags, as on DynamoDB. Before this
+  release they evaluated the table's tags. A condition on `aws:ResourceTag/*`
+  for these calls now evaluates as for an absent key: `StringEquals` no longer
+  matches, and a negated operator or `Null` true now does.
+- **DescribeLimits and DescribeEndpoints.** DescribeLimits is authorized against
+  `*`, not `table/*`, so a grant or `Deny` scoped to `table/*` no longer applies
+  to it; scope its statement to `*`. DescribeEndpoints is not evaluated against
+  IAM at all, so a `Deny` on it does not block it.
+- **GetRecords across the upgrade.** A shard iterator issued before this release
+  does not identify its stream. GetRecords on such an iterator now returns
+  `ExpiredIteratorException` with the expiry message, so a consumer reading when
+  the server restarts renews its iterator by calling GetShardIterator instead of
+  failing on a non-retryable `ValidationException`. A token that does not decode
+  at all still returns `ValidationException` `Invalid ShardIterator`.
+- **Restores.** RestoreTableFromBackup and RestoreTableToPointInTime require the
+  item read and write actions on the target table in addition to the restore
+  action, because a restore writes into the target.
+- **Export.** `ExportTableToPointInTime` requires `TableArn` to be exactly a
+  table ARN. An ARN carrying a sub-resource or an extra `table/` segment is
+  rejected with `ValidationException` before authorization.
+
+---
+
 ### v0.1.6 — IAM: bare operators on multivalued condition keys are no-ops (BR-7085)
 
 **What changed.** A **bare** condition operator (no `ForAnyValue:` / `ForAllValues:`
diff --git a/tests/test_attribute_value_validation.py b/tests/test_attribute_value_validation.py
index 4bfcc7cdf..f6704227e 100644
--- a/tests/test_attribute_value_validation.py
+++ b/tests/test_attribute_value_validation.py
@@ -7,8 +7,8 @@
 wire, so call patterns like ``attrVal.setBOOL(null)`` and ``attrVal.setM(null)``
 emit a literal ``{}`` AttributeValue. Real DynamoDB rejects these with a
 ``ValidationException`` whose message starts with
-``"Supplied AttributeValue is empty"`` (error code ``EMPTY_ATTRIBUTE_VALUE`` in
-the BigBird parity tests). The same shape is expected for AttributeValues
+``"Supplied AttributeValue is empty"`` (error code ``EMPTY_ATTRIBUTE_VALUE``).
+The same shape is expected for AttributeValues
 that contain more than one type-key (``MULTI_ATTRIBUTE_VALUE``) and for
 ``SS``/``NS``/``BS`` arrays whose elements include a JSON null.
 
@@ -148,9 +148,8 @@ def _assert_empty_attribute_value(resp: requests.Response) -> None:
 def _assert_ss_with_null_specific_message(resp: requests.Response) -> None:
     """Assert the SS-with-null-element response uses the exact DDB wording.
 
-    BigBird parity tests (``putItemTestListWithNullStringSet``,
-    ``putItemTestMapWithNullStringSet``) check for the specific
-    ``INVALID_PARAMETER_VALUE`` prefix plus
+    An SS array containing a JSON null (directly, or nested inside a list or a
+    map) is rejected with the ``INVALID_PARAMETER_VALUE`` prefix plus
     ``"An string set may not have a null string as a member"`` (the awkward
     "An string set" wording is verbatim from real DDB).
     """
@@ -518,12 +517,11 @@ def test_empty_attribute_value_in_exclusive_start_key(self, hash_table, bad_av):
 #
 # Real DynamoDB returns a type-specific INVALID_PARAMETER_VALUE message for
 # the ``{"SS":[..., null]}`` case rather than the generic
-# EMPTY_ATTRIBUTE_VALUE wording. BigBird parity tests
-# (``putItemTestListWithNullStringSet``, ``putItemTestMapWithNullStringSet``)
-# match on the suffix verbatim, so we lock the wording in here on a few
-# representative APIs. Other APIs route through the same deserializer so
-# they automatically inherit the fix; the broader EMPTY_AV_SCENARIOS suite
-# above covers them under the more permissive helper.
+# EMPTY_ATTRIBUTE_VALUE wording. We lock that exact wording in here on a few
+# representative APIs (top-level, inside a list, inside a map). Other APIs route
+# through the same deserializer so they automatically inherit the fix; the
+# broader EMPTY_AV_SCENARIOS suite above covers them under the more permissive
+# helper.
 # ---------------------------------------------------------------------------
 
 
@@ -541,7 +539,7 @@ def test_put_item_top_level_ss_with_null(self, hash_table):
         _assert_ss_with_null_specific_message(_signed_post("PutItem", body))
 
     def test_put_item_ss_with_null_inside_list(self, hash_table):
-        # Mirrors BigBird ``putItemTestListWithNullStringSet`` shape.
+        # A string set with a null element nested inside a list.
         body = {
             "TableName": hash_table,
             "Item": {
@@ -552,7 +550,7 @@ def test_put_item_ss_with_null_inside_list(self, hash_table):
         _assert_ss_with_null_specific_message(_signed_post("PutItem", body))
 
     def test_put_item_ss_with_null_inside_map(self, hash_table):
-        # Mirrors BigBird ``putItemTestMapWithNullStringSet`` shape.
+        # A string set with a null element nested inside a map.
         body = {
             "TableName": hash_table,
             "Item": {
diff --git a/tests/test_auth_permissions.py b/tests/test_auth_permissions.py
index 30b967d69..a66136554 100755
--- a/tests/test_auth_permissions.py
+++ b/tests/test_auth_permissions.py
@@ -1122,7 +1122,7 @@ def _user_with_key(self, name):
         return creds["access_key_id"], creds["secret_access_key"]
 
     def test_explicit_deny_all_service_operations(self):
-        """Deny with 'dynamodb:*' blocks all operations even with a separate Allow."""
+        """Deny with 'dynamodb:*' blocks every authorized operation even with a separate Allow."""
         user = f"u-{uuid.uuid4().hex[:8]}"
         ak, sk = self._user_with_key(user)
         self.mgmt.put_user_policy(self.account_id, user, "allow-all", _full_policy())
@@ -1136,9 +1136,10 @@ def test_explicit_deny_all_service_operations(self):
                 client.list_tables()
             assert exc.value.response["Error"]["Code"] == "AccessDeniedException"
 
-            with pytest.raises(ClientError) as exc:
-                client.describe_endpoints()
-            assert exc.value.response["Error"]["Code"] == "AccessDeniedException"
+            # DescribeEndpoints needs a signed request but no IAM permission,
+            # so a Deny on dynamodb:* does not block it (measured on DynamoDB
+            # 2026-10-20).
+            client.describe_endpoints()
         finally:
             self.mgmt.delete_user(self.account_id, user)
 
diff --git a/tests/test_authz_resource_arn.py b/tests/test_authz_resource_arn.py
new file mode 100644
index 000000000..c7e54e99c
--- /dev/null
+++ b/tests/test_authz_resource_arn.py
@@ -0,0 +1,926 @@
+# Copyright 2026 ExtendDB contributors
+# SPDX-License-Identifier: Apache-2.0
+
+"""Explicit-Deny enforcement on resource-ARN operations.
+
+Operations that carry their resource in a field other than a top-level
+TableName (ResourceArn on the tag operations, StreamArn on stream operations,
+BackupArn on backup operations, IndexName on Query and Scan, and a table ARN in
+TableName) must authorize against that specific resource. A policy that allows
+dynamodb:* on * but explicitly Denies one action on one specific ARN must block
+that action, matching live DynamoDB: every case below returns
+AccessDeniedException while an allowed control on the same principal succeeds.
+
+These tests provision builtin-IAM principals through the management API, so they
+run against ExtendDB on every storage backend in CI. The equivalent behavior on
+live DynamoDB was measured with real IAM principals and recorded in the builder
+report's Service measurements section.
+
+Prerequisites:
+  - extenddb running with `auth.provider = "builtin"` on EXTENDDB_TEST_ENDPOINT
+  - Admin credentials in EXTENDDB_ADMIN_USER / EXTENDDB_ADMIN_PASSWORD
+
+REQ-TEST-001, REQ-AUTH-002
+"""
+
+from __future__ import annotations
+
+import base64
+import os
+import time
+import uuid
+from typing import Any
+
+import boto3
+import pytest
+from botocore.config import Config as BotoConfig
+from botocore.exceptions import ClientError
+
+from conftest import wait_for_active
+from management_helpers import ManagementClient
+
+
+def _require_auth_env() -> tuple[str, str, str]:
+    endpoint = os.environ.get("EXTENDDB_TEST_ENDPOINT", "").strip()
+    admin_user = os.environ.get("EXTENDDB_ADMIN_USER", "").strip()
+    admin_pass = os.environ.get("EXTENDDB_ADMIN_PASSWORD", "").strip()
+    if not endpoint or not admin_user or not admin_pass:
+        pytest.fail(
+            "MISCONFIGURED: resource-ARN authz tests require EXTENDDB_TEST_ENDPOINT, "
+            "EXTENDDB_ADMIN_USER, and EXTENDDB_ADMIN_PASSWORD. "
+            "These must be set by devtools/run-tests before test execution."
+        )
+    return endpoint, admin_user, admin_pass
+
+
+def _client(endpoint: str, ak: str, sk: str, region: str, service: str = "dynamodb") -> Any:
+    kwargs: dict = dict(
+        service_name=service,
+        endpoint_url=endpoint,
+        aws_access_key_id=ak,
+        aws_secret_access_key=sk,
+        region_name=region,
+        config=BotoConfig(retries={"max_attempts": 0}),
+    )
+    if endpoint.startswith("https://"):
+        kwargs["verify"] = False
+    return boto3.client(**kwargs)
+
+
+ALLOW_ALL = {
+    "Version": "2012-10-17",
+    "Statement": [{"Effect": "Allow", "Action": "dynamodb:*", "Resource": "*"}],
+}
+
+
+def _allow_all_deny(action: str, resource: str) -> dict:
+    return {
+        "Version": "2012-10-17",
+        "Statement": [
+            {"Effect": "Allow", "Action": "dynamodb:*", "Resource": "*"},
+            {"Effect": "Deny", "Action": f"dynamodb:{action}", "Resource": resource},
+        ],
+    }
+
+
+@pytest.fixture(scope="module")
+def auth_env():
+    return _require_auth_env()
+
+
+@pytest.fixture(scope="module")
+def mgmt(auth_env) -> ManagementClient:
+    endpoint, admin_user, admin_pass = auth_env
+    return ManagementClient(endpoint, admin_user, admin_pass)
+
+
+@pytest.fixture(scope="module")
+def region() -> str:
+    return os.environ.get("AWS_DEFAULT_REGION", "us-east-1")
+
+
+@pytest.fixture(scope="module")
+def account_id(mgmt) -> str:
+    acct = f"{uuid.uuid4().int % 10**12:012d}"
+    resp = mgmt.create_account(acct, f"arnauthz-{acct}")
+    assert resp.status_code == 201, resp.text
+    yield acct
+    mgmt.delete_account(acct)
+
+
+def _user_with_policy(mgmt: ManagementClient, account_id: str, policy: dict) -> tuple[str, str]:
+    """Create a fresh IAM user with the given policy and return (ak, sk)."""
+    user = f"u{uuid.uuid4().hex[:10]}"
+    assert mgmt.create_user(account_id, user, "TestPass123!").status_code == 201
+    assert mgmt.put_user_policy(account_id, user, "p", policy).status_code == 204
+    resp = mgmt.create_access_key(account_id, user)
+    assert resp.status_code == 201, resp.text
+    creds = resp.json()
+    return creds["access_key_id"], creds["secret_access_key"]
+
+
+@pytest.fixture(scope="module")
+def table(auth_env, mgmt, account_id, region):
+    """A table with a GSI, a stream, one item, and a backup. Returns the
+    canonical table, index, stream, and backup ARNs."""
+    endpoint = auth_env[0]
+    ak, sk = _user_with_policy(mgmt, account_id, ALLOW_ALL)
+    admin = _client(endpoint, ak, sk, region)
+    name = f"t{uuid.uuid4().hex[:8]}"
+    admin.create_table(
+        TableName=name,
+        AttributeDefinitions=[
+            {"AttributeName": "pk", "AttributeType": "S"},
+            {"AttributeName": "g1pk", "AttributeType": "S"},
+        ],
+        KeySchema=[{"AttributeName": "pk", "KeyType": "HASH"}],
+        GlobalSecondaryIndexes=[{
+            "IndexName": "gsi1",
+            "KeySchema": [{"AttributeName": "g1pk", "KeyType": "HASH"}],
+            "Projection": {"ProjectionType": "ALL"},
+        }],
+        BillingMode="PAY_PER_REQUEST",
+        StreamSpecification={"StreamEnabled": True, "StreamViewType": "NEW_AND_OLD_IMAGES"},
+    )
+    wait_for_active(admin, name)
+    admin.put_item(TableName=name, Item={"pk": {"S": "p1"}, "g1pk": {"S": "g1"}})
+    desc = admin.describe_table(TableName=name)["Table"]
+    table_arn = desc["TableArn"]
+    backup_arn = admin.create_backup(TableName=name, BackupName="arnbk")["BackupDetails"]["BackupArn"]
+    return {
+        "name": name,
+        "table_arn": table_arn,
+        "index_arn": table_arn + "/index/gsi1",
+        "stream_arn": desc.get("LatestStreamArn"),
+        "backup_arn": backup_arn,
+    }
+
+
+class TestExplicitDenyOnResourceArn:
+    @pytest.fixture(autouse=True)
+    def setup(self, auth_env, mgmt, account_id, region):
+        self.endpoint = auth_env[0]
+        self.mgmt = mgmt
+        self.account_id = account_id
+        self.region = region
+
+    def _ddb(self, policy: dict, service: str = "dynamodb"):
+        ak, sk = _user_with_policy(self.mgmt, self.account_id, policy)
+        return _client(self.endpoint, ak, sk, self.region, service)
+
+    def _assert_denied(self, fn):
+        with pytest.raises(ClientError) as exc:
+            fn()
+        assert exc.value.response["Error"]["Code"] == "AccessDeniedException", (
+            exc.value.response["Error"]
+        )
+
+    def _assert_validation(self, fn, substr: str):
+        with pytest.raises(ClientError) as exc:
+            fn()
+        err = exc.value.response["Error"]
+        assert err["Code"] == "ValidationException", err
+        assert substr in err.get("Message", ""), err
+
+    # -- tag operations: the core defect, explicit Deny on a tagged resource --
+
+    def test_tag_resource_deny_blocks(self, table):
+        d = self._ddb(_allow_all_deny("TagResource", table["table_arn"]))
+        self._assert_denied(lambda: d.tag_resource(
+            ResourceArn=table["table_arn"], Tags=[{"Key": "k", "Value": "v"}]))
+
+    def test_untag_resource_deny_blocks(self, table):
+        d = self._ddb(_allow_all_deny("UntagResource", table["table_arn"]))
+        self._assert_denied(lambda: d.untag_resource(
+            ResourceArn=table["table_arn"], TagKeys=["k"]))
+
+    def test_list_tags_deny_blocks(self, table):
+        d = self._ddb(_allow_all_deny("ListTagsOfResource", table["table_arn"]))
+        self._assert_denied(lambda: d.list_tags_of_resource(ResourceArn=table["table_arn"]))
+
+    # -- stream, backup, index operations --
+
+    def test_describe_stream_deny_blocks(self, table):
+        s = self._ddb(_allow_all_deny("DescribeStream", table["stream_arn"]), "dynamodbstreams")
+        self._assert_denied(lambda: s.describe_stream(StreamArn=table["stream_arn"]))
+
+    def test_describe_stream_wildcard_label_deny_blocks(self, table):
+        # A stream label contains ':'. A Deny on table/<T>/stream/* must match
+        # the concrete stream ARN, so the resource field is matched as a whole
+        # with the wildcard spanning the colons in the label.
+        wild = table["table_arn"] + "/stream/*"
+        s = self._ddb(_allow_all_deny("DescribeStream", wild), "dynamodbstreams")
+        self._assert_denied(lambda: s.describe_stream(StreamArn=table["stream_arn"]))
+
+    def test_describe_stream_wildcard_label_allow_permits(self, table):
+        # An Allow that grants only DescribeStream on table/<T>/stream/* must
+        # match the concrete stream ARN and permit the call.
+        wild = table["table_arn"] + "/stream/*"
+        policy = {"Version": "2012-10-17", "Statement": [
+            {"Effect": "Allow", "Action": "dynamodb:DescribeStream", "Resource": wild}]}
+        s = self._ddb(policy, "dynamodbstreams")
+        s.describe_stream(StreamArn=table["stream_arn"])  # must not raise
+
+    def test_getrecords_exact_stream_deny_blocks(self, table):
+        # GetShardIterator stays allowed; GetRecords against the same stream is
+        # denied, because GetRecords is authorized against the stream the
+        # iterator reads, not a table/*/stream/* wildcard.
+        s = self._ddb(_allow_all_deny("GetRecords", table["stream_arn"]), "dynamodbstreams")
+        desc = s.describe_stream(StreamArn=table["stream_arn"])["StreamDescription"]
+        shard_id = desc["Shards"][0]["ShardId"]
+        it = s.get_shard_iterator(
+            StreamArn=table["stream_arn"], ShardId=shard_id,
+            ShardIteratorType="TRIM_HORIZON")["ShardIterator"]
+        self._assert_denied(lambda: s.get_records(ShardIterator=it))
+
+    def test_getrecords_preupgrade_iterator_is_expired_not_invalid(self, table):
+        # A shard iterator from a build before the stream ARN was carried in the
+        # token decodes to exactly four fields (shard, type, seq, timestamp) with
+        # no stream ARN. Before, GetRecords answered it with the non-retryable
+        # ValidationException "Invalid ShardIterator", so a consumer reading
+        # across the upgrade failed hard and its iterator chain renewed into the
+        # same error on every call. It is now answered with
+        # ExpiredIteratorException before authorization, whatever the caller's
+        # policy, so the consumer renews its iterator instead.
+        now = int(time.time())
+        old_token = base64.standard_b64encode(
+            f"shardId-00000000000000000000-00000001|TRIM_HORIZON||{now}".encode()
+        ).decode()
+        stream_wildcard = f"arn:aws:dynamodb:{self.region}:{self.account_id}:table/*/stream/*"
+        policies = [
+            ALLOW_ALL,
+            {"Version": "2012-10-17", "Statement": [
+                {"Effect": "Allow", "Action": "dynamodb:ListTables", "Resource": "*"}]},
+            _allow_all_deny("GetRecords", stream_wildcard),
+        ]
+        for policy in policies:
+            s = self._ddb(policy, "dynamodbstreams")
+            with pytest.raises(ClientError) as exc:
+                s.get_records(ShardIterator=old_token)
+            err = exc.value.response["Error"]
+            assert err["Code"] == "ExpiredIteratorException", (policy, err)
+            assert err.get("Message") == "Shard iterator has expired", (policy, err)
+
+    def test_getrecords_undecodable_iterator_is_invalid(self, table):
+        # A token that does not decode (random base64, or a non-base64 string)
+        # stays ValidationException "Invalid ShardIterator" before authorization,
+        # whatever the caller's policy (measured 2026-10-20 for an allow-all
+        # principal, a principal allowed only ListTables, and one with an
+        # explicit Deny on GetRecords for every stream).
+        tokens = [
+            base64.standard_b64encode(uuid.uuid4().bytes * 8).decode(),
+            "not-a-real-iterator-" + "x" * 40,
+        ]
+        stream_wildcard = f"arn:aws:dynamodb:{self.region}:{self.account_id}:table/*/stream/*"
+        policies = [
+            ALLOW_ALL,
+            {"Version": "2012-10-17", "Statement": [
+                {"Effect": "Allow", "Action": "dynamodb:ListTables", "Resource": "*"}]},
+            _allow_all_deny("GetRecords", stream_wildcard),
+        ]
+        for policy in policies:
+            s = self._ddb(policy, "dynamodbstreams")
+            for token in tokens:
+                with pytest.raises(ClientError) as exc:
+                    s.get_records(ShardIterator=token)
+                err = exc.value.response["Error"]
+                assert err["Code"] == "ValidationException", (policy, token, err)
+                assert err.get("Message") == "Invalid ShardIterator", (policy, token, err)
+
+    def test_getrecords_forged_shard_reads_nothing(self, table):
+        # A token that names the allowed stream ARN but a shard that does not
+        # belong to it must not read: the engine confirms the shard belongs to
+        # the stream before reading. The real shard reads; the forged one errors.
+        s = self._ddb({"Version": "2012-10-17", "Statement": [
+            {"Effect": "Allow", "Action": "dynamodb:*", "Resource": "*"}]}, "dynamodbstreams")
+        desc = s.describe_stream(StreamArn=table["stream_arn"])["StreamDescription"]
+        shard_id = desc["Shards"][0]["ShardId"]
+        real_it = s.get_shard_iterator(
+            StreamArn=table["stream_arn"], ShardId=shard_id,
+            ShardIteratorType="TRIM_HORIZON")["ShardIterator"]
+        s.get_records(ShardIterator=real_it)  # control: real shard reads
+        now = int(time.time())
+        forged_raw = f"shardId-forged-0000000000000000|AFTER_SEQUENCE_NUMBER||{now}|{table['stream_arn']}"
+        forged = base64.standard_b64encode(forged_raw.encode()).decode()
+        with pytest.raises(ClientError):
+            s.get_records(ShardIterator=forged)
+
+    def test_delete_backup_deny_blocks(self, table):
+        d = self._ddb(_allow_all_deny("DeleteBackup", table["backup_arn"]))
+        self._assert_denied(lambda: d.delete_backup(BackupArn=table["backup_arn"]))
+
+    # -- ListBackups authorizes the backup sub-resource, not the table --
+    # The service evaluates table/<T>/backup/* (with TableName) and
+    # table/*/backup/* (without), measured live. A Deny on that resource must
+    # block ListBackups, and a least-privilege Allow on it must permit it; a
+    # policy written against the bare table ARN does not affect ListBackups.
+
+    def _backup_wild_table(self, table) -> str:
+        return table["table_arn"] + "/backup/*"
+
+    def _backup_wild_all(self) -> str:
+        return f"arn:aws:dynamodb:{self.region}:{self.account_id}:table/*/backup/*"
+
+    def test_list_backups_deny_backup_wildcard_with_table_blocks(self, table):
+        d = self._ddb(_allow_all_deny("ListBackups", self._backup_wild_table(table)))
+        self._assert_denied(lambda: d.list_backups(TableName=table["name"]))
+
+    def test_list_backups_deny_backup_wildcard_no_table_blocks(self, table):
+        d = self._ddb(_allow_all_deny("ListBackups", self._backup_wild_all()))
+        self._assert_denied(lambda: d.list_backups())
+
+    def test_list_backups_allow_backup_wildcard_with_table_permits(self, table):
+        policy = {"Version": "2012-10-17", "Statement": [
+            {"Effect": "Allow", "Action": "dynamodb:ListBackups",
+             "Resource": self._backup_wild_table(table)}]}
+        d = self._ddb(policy)
+        d.list_backups(TableName=table["name"])  # must not raise
+
+    def test_list_backups_allow_bare_table_denies(self, table):
+        # An Allow written only on the bare table ARN does not grant ListBackups,
+        # because the service evaluates the backup sub-resource.
+        policy = {"Version": "2012-10-17", "Statement": [
+            {"Effect": "Allow", "Action": "dynamodb:ListBackups",
+             "Resource": table["table_arn"]}]}
+        d = self._ddb(policy)
+        self._assert_denied(lambda: d.list_backups(TableName=table["name"]))
+
+    def test_list_backups_deny_bare_table_permits(self, table):
+        # A Deny written on the bare table ARN does not block ListBackups,
+        # because that is not the resource the service evaluates.
+        d = self._ddb(_allow_all_deny("ListBackups", table["table_arn"]))
+        d.list_backups(TableName=table["name"])  # must not raise
+
+    def test_query_on_index_deny_blocks(self, table):
+        d = self._ddb(_allow_all_deny("Query", table["index_arn"]))
+        self._assert_denied(lambda: d.query(
+            TableName=table["name"], IndexName="gsi1",
+            KeyConditionExpression="g1pk = :p",
+            ExpressionAttributeValues={":p": {"S": "g1"}}))
+
+    # -- tag operations on an index ARN: ValidationException for every principal
+    # The service accepts tags only on a table or stream; an index ARN is a
+    # ValidationException before the IAM decision, for a principal with full
+    # access and for one with none.
+
+    _INDEX_MSG = "only table or stream is accepted"
+
+    def test_tag_ops_on_index_arn_rejected_admin(self, table):
+        d = self._ddb(ALLOW_ALL)
+        self._assert_validation(lambda: d.tag_resource(
+            ResourceArn=table["index_arn"], Tags=[{"Key": "k", "Value": "v"}]), self._INDEX_MSG)
+        self._assert_validation(lambda: d.untag_resource(
+            ResourceArn=table["index_arn"], TagKeys=["k"]), self._INDEX_MSG)
+        self._assert_validation(lambda: d.list_tags_of_resource(
+            ResourceArn=table["index_arn"]), self._INDEX_MSG)
+
+    def test_tag_ops_on_index_arn_rejected_noperm(self, table):
+        noperm = {"Version": "2012-10-17", "Statement": [
+            {"Effect": "Allow", "Action": "dynamodb:ListTables", "Resource": "*"}]}
+        d = self._ddb(noperm)
+        self._assert_validation(lambda: d.tag_resource(
+            ResourceArn=table["index_arn"], Tags=[{"Key": "k", "Value": "v"}]), self._INDEX_MSG)
+        self._assert_validation(lambda: d.untag_resource(
+            ResourceArn=table["index_arn"], TagKeys=["k"]), self._INDEX_MSG)
+        self._assert_validation(lambda: d.list_tags_of_resource(
+            ResourceArn=table["index_arn"]), self._INDEX_MSG)
+
+    # -- tag operations on a backup ARN: not a DynamoDB resource, every principal
+    # Measured live with a real backup ARN and with a short backup id.
+
+    def test_tag_ops_on_backup_arn_rejected(self, table):
+        arn = table["backup_arn"]
+        msg = f"Provided Arn is not a DynamoDB resource arn: {arn}"
+        noperm = {"Version": "2012-10-17", "Statement": [
+            {"Effect": "Allow", "Action": "dynamodb:ListTables", "Resource": "*"}]}
+        for policy in (ALLOW_ALL, noperm):
+            d = self._ddb(policy)
+            self._assert_validation(lambda: d.tag_resource(
+                ResourceArn=arn, Tags=[{"Key": "k", "Value": "v"}]), msg)
+            self._assert_validation(lambda: d.untag_resource(ResourceArn=arn, TagKeys=["k"]), msg)
+            self._assert_validation(lambda: d.list_tags_of_resource(ResourceArn=arn), msg)
+
+    # -- resource tags on stream and backup operations, measured live --
+    # The service evaluates aws:ResourceTag only for a table, and for an index
+    # through its base table. A stream holds a tag set of its own, but neither
+    # the stream's tags nor the table's reach an operation on the stream, and a
+    # backup operation sees none of the source table's tags. A StringEquals on
+    # the tag never matches there and a Null test is true.
+
+    def _abac_user(self, actions: list, key: str, null: bool = False):
+        cond = ({"Null": {f"aws:ResourceTag/{key}": "true"}} if null
+                else {"StringEquals": {f"aws:ResourceTag/{key}": "v"}})
+        policy = {"Version": "2012-10-17", "Statement": [
+            {"Effect": "Allow", "Action": actions, "Resource": "*", "Condition": cond}]}
+        ak, sk = _user_with_policy(self.mgmt, self.account_id, policy)
+        return (_client(self.endpoint, ak, sk, self.region),
+                _client(self.endpoint, ak, sk, self.region, "dynamodbstreams"))
+
+    def test_stream_operations_see_no_resource_tags(self, table):
+        admin = self._ddb(ALLOW_ALL)
+        stream, tbl = table["stream_arn"], table["table_arn"]
+        admin.tag_resource(ResourceArn=stream, Tags=[{"Key": "stk", "Value": "v"}])
+        admin.tag_resource(ResourceArn=tbl, Tags=[{"Key": "ttk", "Value": "v"}])
+        try:
+            # The stream and its table hold separate tag sets.
+            stream_tags = admin.list_tags_of_resource(ResourceArn=stream)["Tags"]
+            table_tags = admin.list_tags_of_resource(ResourceArn=tbl)["Tags"]
+            assert {"Key": "stk", "Value": "v"} in stream_tags
+            assert {"Key": "ttk", "Value": "v"} not in stream_tags
+            assert {"Key": "ttk", "Value": "v"} in table_tags
+            assert {"Key": "stk", "Value": "v"} not in table_tags
+
+            actions = ["dynamodb:DescribeStream", "dynamodb:GetShardIterator",
+                       "dynamodb:ListTagsOfResource"]
+            for key in ("stk", "ttk"):
+                d, s = self._abac_user(actions, key)
+                self._assert_denied(lambda: s.describe_stream(StreamArn=stream))
+                self._assert_denied(lambda: d.list_tags_of_resource(ResourceArn=stream))
+            # Control: the table-tag condition is in force for the table itself.
+            d, _ = self._abac_user(actions, "ttk")
+            d.list_tags_of_resource(ResourceArn=tbl)  # must not raise
+
+            # The tag is absent on the stream, so a Null test matches.
+            d, s = self._abac_user(actions, "stk", null=True)
+            shard = s.describe_stream(StreamArn=stream)["StreamDescription"]["Shards"][0]["ShardId"]
+            s.get_shard_iterator(StreamArn=stream, ShardId=shard, ShardIteratorType="TRIM_HORIZON")
+            d.list_tags_of_resource(ResourceArn=stream)
+        finally:
+            admin.untag_resource(ResourceArn=stream, TagKeys=["stk"])
+            admin.untag_resource(ResourceArn=tbl, TagKeys=["ttk"])
+
+    def test_backup_operations_see_no_resource_tags(self, table):
+        # Pins the measured behaviour; the branch before the fix also read no
+        # tags here, because nothing can be stored under a backup ARN.
+        admin = self._ddb(ALLOW_ALL)
+        tbl, backup = table["table_arn"], table["backup_arn"]
+        admin.tag_resource(ResourceArn=tbl, Tags=[{"Key": "btk", "Value": "v"}])
+        try:
+            actions = ["dynamodb:DescribeBackup", "dynamodb:ListTagsOfResource"]
+            d, _ = self._abac_user(actions, "btk")
+            self._assert_denied(lambda: d.describe_backup(BackupArn=backup))
+            d.list_tags_of_resource(ResourceArn=tbl)  # control: must not raise
+            d, _ = self._abac_user(actions, "btk", null=True)
+            d.describe_backup(BackupArn=backup)  # must not raise
+        finally:
+            admin.untag_resource(ResourceArn=tbl, TagKeys=["btk"])
+
+    # -- TagResource ResourceArn error ordering, measured live, every row --
+    # ValidationException before authorization (every principal) for a malformed
+    # or non-table/stream ARN; for an admin, a table ARN with a wrong partition,
+    # service, or region is ValidationException where a no-permissions principal
+    # is denied by authorization. Every case is a refusal.
+
+    def _ordering_variants(self, table) -> dict:
+        parts = table["table_arn"].split(":")  # arn:aws:dynamodb:region:acct:table/name
+        region, account = parts[3], parts[4]
+        other_region = "us-west-2" if region != "us-west-2" else "us-east-1"
+        return {
+            "not_an_arn": "banana",
+            "bad_resource_type": f"arn:aws:dynamodb:{region}:{account}:banana/x",
+            "wrong_partition": table["table_arn"].replace("arn:aws:", "arn:aws-cn:", 1),
+            "wrong_service": table["table_arn"].replace(":dynamodb:", ":s3:", 1),
+            "cross_account": f"arn:aws:dynamodb:{region}:111122223333:table/{table['name']}",
+            "cross_region": f"arn:aws:dynamodb:{other_region}:{account}:table/{table['name']}",
+            "nonexistent": f"arn:aws:dynamodb:{region}:{account}:table/{table['name']}-nope-xyz",
+            "index_arn_for_tag": table["index_arn"],
+        }
+
+    def _assert_code(self, fn, code: str, substr: str = ""):
+        with pytest.raises(ClientError) as exc:
+            fn()
+        err = exc.value.response["Error"]
+        assert err["Code"] == code, err
+        if substr:
+            assert substr in err.get("Message", ""), err
+
+    def test_tag_ordering_noperm_matches_service(self, table):
+        v = self._ordering_variants(table)
+        noperm = {"Version": "2012-10-17", "Statement": [
+            {"Effect": "Allow", "Action": "dynamodb:ListTables", "Resource": "*"}]}
+        expect = {
+            "not_an_arn": ("ValidationException", "ARNs must start with 'arn:'"),
+            "bad_resource_type": ("ValidationException", "Provided Arn is not a DynamoDB resource arn"),
+            "wrong_partition": ("AccessDeniedException", ""),
+            "wrong_service": ("AccessDeniedException", ""),
+            "cross_account": ("AccessDeniedException", ""),
+            "cross_region": ("AccessDeniedException", ""),
+            "nonexistent": ("AccessDeniedException", ""),
+            "index_arn_for_tag": ("ValidationException", "only table or stream is accepted"),
+        }
+        for label, arn in v.items():
+            code, substr = expect[label]
+            d = self._ddb(noperm)
+            self._assert_code(
+                lambda a=arn, dd=d: dd.tag_resource(ResourceArn=a, Tags=[{"Key": "k", "Value": "v"}]),
+                code, substr)
+
+    def test_tag_ordering_admin_matches_service(self, table):
+        v = self._ordering_variants(table)
+        expect = {
+            "not_an_arn": ("ValidationException", "ARNs must start with 'arn:'"),
+            "bad_resource_type": ("ValidationException", "Provided Arn is not a DynamoDB resource arn"),
+            "wrong_partition": ("ValidationException", "Invalid TableArn"),
+            "wrong_service": ("ValidationException", "Invalid TableArn"),
+            "cross_account": ("AccessDeniedException", ""),
+            "cross_region": ("ValidationException", "Invalid TableArn"),
+            "nonexistent": ("ResourceNotFoundException", ""),
+            "index_arn_for_tag": ("ValidationException", "only table or stream is accepted"),
+        }
+        for label, arn in v.items():
+            code, substr = expect[label]
+            d = self._ddb(ALLOW_ALL)
+            self._assert_code(
+                lambda a=arn, dd=d: dd.tag_resource(ResourceArn=a, Tags=[{"Key": "k", "Value": "v"}]),
+                code, substr)
+
+    # -- permission chains: a Deny anywhere in the chain blocks the operation --
+
+    def test_restore_from_backup_deny_target_item_action_blocks(self, table):
+        # A restore writes items into the target table, so the service (and now
+        # ExtendDB) require the item actions on the target. A Deny on PutItem for
+        # the target table name blocks the restore.
+        target = table["table_arn"] + "-rfb"
+        d = self._ddb(_allow_all_deny("PutItem", target))
+        self._assert_denied(lambda: d.restore_table_from_backup(
+            TargetTableName=table["name"] + "-rfb", BackupArn=table["backup_arn"]))
+
+    def test_restore_to_point_in_time_deny_target_item_action_blocks(self, table):
+        target = table["table_arn"] + "-pitr"
+        d = self._ddb(_allow_all_deny("PutItem", target))
+        self._assert_denied(lambda: d.restore_table_to_point_in_time(
+            SourceTableName=table["name"], TargetTableName=table["name"] + "-pitr"))
+
+    def test_export_deny_table_blocks(self, table):
+        d = self._ddb(_allow_all_deny("ExportTableToPointInTime", table["table_arn"]))
+        self._assert_denied(lambda: d.export_table_to_point_in_time(
+            TableArn=table["table_arn"], S3Bucket="bb-arn-nobucket"))
+
+    def test_import_deny_new_table_blocks(self, table):
+        new_table = table["table_arn"] + "-imp"
+        d = self._ddb(_allow_all_deny("ImportTable", new_table))
+        self._assert_denied(lambda: d.import_table(
+            S3BucketSource={"S3Bucket": "bb-arn-nobucket"},
+            InputFormat="DYNAMODB_JSON",
+            TableCreationParameters={
+                "TableName": table["name"] + "-imp", "BillingMode": "PAY_PER_REQUEST",
+                "AttributeDefinitions": [{"AttributeName": "pk", "AttributeType": "S"}],
+                "KeySchema": [{"AttributeName": "pk", "KeyType": "HASH"}]}))
+
+    # -- fail closed: a respelled ARN cannot evade a Deny on the canonical ARN --
+
+    def test_respelled_stream_arn_cannot_bypass_deny(self, table):
+        """A Deny on the canonical stream ARN must also block a request that
+        respells the partition. ExtendDB resolves the stream in this account
+        regardless of the ARN's partition, so authorizing the respelled string
+        verbatim would bypass the Deny."""
+        respelled = table["stream_arn"].replace("arn:aws:", "arn:aws-cn:")
+        s = self._ddb(_allow_all_deny("DescribeStream", table["stream_arn"]), "dynamodbstreams")
+        self._assert_denied(lambda: s.describe_stream(StreamArn=respelled))
+
+    def test_table_arn_in_tablename_deny_blocks(self, table):
+        """A Deny on the table ARN blocks GetItem whether TableName is the bare
+        name or the table ARN."""
+        d = self._ddb(_allow_all_deny("GetItem", table["table_arn"]))
+        self._assert_denied(lambda: d.get_item(
+            TableName=table["name"], Key={"pk": {"S": "p1"}}))
+        d2 = self._ddb(_allow_all_deny("GetItem", table["table_arn"]))
+        self._assert_denied(lambda: d2.get_item(
+            TableName=table["table_arn"], Key={"pk": {"S": "p1"}}))
+
+    def test_table_arn_in_tablename_keeps_leading_keys_fence(self, table):
+        """A principal fenced to one partition with dynamodb:LeadingKeys is
+        refused another partition when it names the table by ARN, as it is when
+        it names the table by name. Measured on DynamoDB 2026-10-20: GetItem with
+        the table ARN as TableName for a partition outside the fence returns
+        AccessDeniedException."""
+        d = self._ddb({
+            "Version": "2012-10-17",
+            "Statement": [{
+                "Effect": "Allow",
+                "Action": "dynamodb:*",
+                "Resource": table["table_arn"],
+                "Condition": {"ForAllValues:StringEquals": {"dynamodb:LeadingKeys": ["p1"]}},
+            }],
+        })
+        self._assert_denied(lambda: d.get_item(
+            TableName=table["name"], Key={"pk": {"S": "other"}}))
+        self._assert_denied(lambda: d.get_item(
+            TableName=table["table_arn"], Key={"pk": {"S": "other"}}))
+
+    # -- positive control: without the Deny, the operation is allowed --
+
+    def test_allow_without_deny_permits_tagging(self, table):
+        d = self._ddb(ALLOW_ALL)
+        # Must not raise.
+        d.tag_resource(ResourceArn=table["table_arn"], Tags=[{"Key": "ctrl", "Value": "1"}])
+        time.sleep(0)
+
+    # -- AccessDenied message form matches the service (both forms) --
+
+    def test_explicit_deny_message_form(self, table):
+        d = self._ddb(_allow_all_deny("TagResource", table["table_arn"]))
+        with pytest.raises(ClientError) as exc:
+            d.tag_resource(ResourceArn=table["table_arn"], Tags=[{"Key": "k", "Value": "v"}])
+        msg = exc.value.response["Error"]["Message"]
+        assert "with an explicit deny in an identity-based policy" in msg, msg
+
+    def test_implicit_deny_message_form(self, table):
+        # A principal allowed only ListTables is denied GetItem with the
+        # implicit-deny message form.
+        policy = {"Version": "2012-10-17", "Statement": [
+            {"Effect": "Allow", "Action": "dynamodb:ListTables", "Resource": "*"}]}
+        d = self._ddb(policy)
+        with pytest.raises(ClientError) as exc:
+            d.get_item(TableName=table["name"], Key={"pk": {"S": "p1"}})
+        msg = exc.value.response["Error"]["Message"]
+        assert "because no identity-based policy allows the dynamodb:GetItem action" in msg, msg
+
+    # -- DescribeEndpoints: signed request, no IAM permission ----------------
+
+    def test_describe_endpoints_needs_no_iam_permission(self):
+        # DynamoDB checks the signature on DescribeEndpoints but evaluates no
+        # IAM policy: a user with no policy, one allowed only ListTables, and
+        # ones with an explicit Deny on dynamodb:DescribeEndpoints or on
+        # dynamodb:* all get the endpoint list (measured 2026-10-20).
+        user = f"u{uuid.uuid4().hex[:10]}"
+        assert self.mgmt.create_user(self.account_id, user, "TestPass123!").status_code == 201
+        resp = self.mgmt.create_access_key(self.account_id, user)
+        assert resp.status_code == 201, resp.text
+        creds = resp.json()
+        no_policy = _client(self.endpoint, creds["access_key_id"],
+                            creds["secret_access_key"], self.region)
+        clients = [
+            no_policy,
+            self._ddb({"Version": "2012-10-17", "Statement": [
+                {"Effect": "Allow", "Action": "dynamodb:ListTables", "Resource": "*"}]}),
+            self._ddb(_allow_all_deny("DescribeEndpoints", "*")),
+            self._ddb({"Version": "2012-10-17", "Statement": [
+                {"Effect": "Deny", "Action": "dynamodb:*", "Resource": "*"}]}),
+        ]
+        for c in clients:
+            endpoints = c.describe_endpoints()["Endpoints"]
+            assert len(endpoints) == 1, endpoints
+            assert endpoints[0]["Address"], endpoints
+
+
+def _deny_tag(actions: list[str], key: str, value: str = "secret") -> dict:
+    return {
+        "Version": "2012-10-17",
+        "Statement": [
+            {"Effect": "Allow", "Action": "dynamodb:*", "Resource": "*"},
+            {
+                "Effect": "Deny",
+                "Action": [f"dynamodb:{a}" for a in actions],
+                "Resource": "*",
+                "Condition": {"StringEquals": {key: value}},
+            },
+        ],
+    }
+
+
+def _abac_allow_tag(actions: list[str], key: str, region: str, account_id: str,
+                    value: str = "secret") -> dict:
+    return {
+        "Version": "2012-10-17",
+        "Statement": [
+            {
+                "Effect": "Allow",
+                "Action": [f"dynamodb:{a}" for a in actions],
+                "Resource": f"arn:aws:dynamodb:{region}:{account_id}:table/*",
+                "Condition": {"StringEquals": {key: value}},
+            }
+        ],
+    }
+
+
+@pytest.fixture(scope="module")
+def tagged_table(auth_env, mgmt, account_id, region):
+    """A table with a GSI, one item, and a resource tag classification=secret."""
+    endpoint = auth_env[0]
+    ak, sk = _user_with_policy(mgmt, account_id, ALLOW_ALL)
+    admin = _client(endpoint, ak, sk, region)
+    name = f"t{uuid.uuid4().hex[:8]}"
+    admin.create_table(
+        TableName=name,
+        AttributeDefinitions=[
+            {"AttributeName": "pk", "AttributeType": "S"},
+            {"AttributeName": "g1pk", "AttributeType": "S"},
+        ],
+        KeySchema=[{"AttributeName": "pk", "KeyType": "HASH"}],
+        GlobalSecondaryIndexes=[{
+            "IndexName": "gsi1",
+            "KeySchema": [{"AttributeName": "g1pk", "KeyType": "HASH"}],
+            "Projection": {"ProjectionType": "ALL"},
+        }],
+        BillingMode="PAY_PER_REQUEST",
+        Tags=[{"Key": "classification", "Value": "secret"}],
+    )
+    wait_for_active(admin, name)
+    admin.put_item(TableName=name, Item={"pk": {"S": "p1"}, "g1pk": {"S": "g1"}})
+    desc = admin.describe_table(TableName=name)["Table"]
+    return {"name": name, "table_arn": desc["TableArn"],
+            "index_arn": desc["TableArn"] + "/index/gsi1"}
+
+
+class TestIndexResourceTagAuthorization:
+    """A secondary index inherits its table's tags for authorization.
+
+    Resource tags are stored under the table ARN. An index Query or Scan is
+    authorized against the index ARN, so looking tags up by that exact ARN found
+    nothing: an ABAC Deny on the table's tags did not reach the index (the index
+    read returned the same items the base-table read was denied), and an ABAC
+    Allow conditioned on the table's tags refused every index read. The key is
+    aws:ResourceTag, the only form the service resolves; dynamodb:ResourceTag is
+    absent for every resource (see test_abac.py). The DynamoDB developer guide
+    states indexes inherit the tags you add to the table.
+    """
+
+    @pytest.fixture(autouse=True)
+    def setup(self, auth_env, mgmt, account_id, region):
+        self.endpoint = auth_env[0]
+        self.mgmt = mgmt
+        self.account_id = account_id
+        self.region = region
+
+    def _ddb(self, policy: dict):
+        ak, sk = _user_with_policy(self.mgmt, self.account_id, policy)
+        return _client(self.endpoint, ak, sk, self.region)
+
+    def _base_query(self, d, name):
+        return d.query(TableName=name, KeyConditionExpression="pk = :p",
+                       ExpressionAttributeValues={":p": {"S": "p1"}})
+
+    def _index_query(self, d, name):
+        return d.query(TableName=name, IndexName="gsi1",
+                       KeyConditionExpression="g1pk = :g",
+                       ExpressionAttributeValues={":g": {"S": "g1"}})
+
+    def _index_scan(self, d, name):
+        return d.scan(TableName=name, IndexName="gsi1")
+
+    def _denied(self, fn):
+        with pytest.raises(ClientError) as exc:
+            fn()
+        assert exc.value.response["Error"]["Code"] == "AccessDeniedException", (
+            exc.value.response["Error"]
+        )
+
+    @pytest.mark.parametrize("key", ["aws:ResourceTag/classification"])
+    def test_abac_deny_on_table_tag_reaches_index(self, tagged_table, key):
+        # Allow * with a Deny on Query/Scan when the resource tag
+        # classification=secret. The base-table Query is denied (the tag
+        # resolves on the table); the index Query and index Scan must be denied
+        # too, because the index inherits the table's tag. Before, the index
+        # read saw an empty tag set and returned the items.
+        d = self._ddb(_deny_tag(["Query", "Scan"], key))
+        self._denied(lambda: self._base_query(d, tagged_table["name"]))
+        self._denied(lambda: self._index_query(d, tagged_table["name"]))
+        self._denied(lambda: self._index_scan(d, tagged_table["name"]))
+
+    @pytest.mark.parametrize("key", ["aws:ResourceTag/classification"])
+    def test_abac_allow_conditioned_on_table_tag_grants_index(self, tagged_table, key):
+        # An Allow on Query/Scan for table/* conditioned on the resource tag
+        # classification=secret grants the base-table Query and must also grant
+        # the index Query and Scan, because the index inherits the table's tag.
+        # Before, the index read saw an empty tag set and was refused.
+        d = self._ddb(_abac_allow_tag(["Query", "Scan"], key, self.region, self.account_id))
+        self._base_query(d, tagged_table["name"])
+        self._index_query(d, tagged_table["name"])
+        self._index_scan(d, tagged_table["name"])
+
+
+class TestArnKindValidationMessages:
+    """ARN-field validation before the IAM decision, measured on live DynamoDB
+    (security-2026-10-20/bounty/live-r2/arn-kinds-live.json).
+
+    Stream and backup fields are validated strictly before authorization: a
+    table ARN, an xrn: ARN, or an empty partition gives ValidationException
+    'Invalid StreamArn' / 'Invalid Backup ARN', for a no-permissions principal
+    and an admin alike. An export TableArn is validated loosely: only an
+    unparseable value is refused before authorization ('tableArn is not a valid
+    ARN'); a well-formed stream ARN of the wrong kind is authorized against that
+    stream ARN (a no-permissions principal is denied naming it) and the export
+    handler then refuses it ('Invalid Request: Table ARN is invalid.').
+    """
+
+    @pytest.fixture(autouse=True)
+    def setup(self, auth_env, mgmt, account_id, region):
+        self.endpoint = auth_env[0]
+        self.mgmt = mgmt
+        self.account_id = account_id
+        self.region = region
+
+    def _ddb(self, policy: dict, service: str = "dynamodb"):
+        ak, sk = _user_with_policy(self.mgmt, self.account_id, policy)
+        return _client(self.endpoint, ak, sk, self.region, service)
+
+    def _tarn(self, name: str = "t") -> str:
+        return f"arn:aws:dynamodb:{self.region}:{self.account_id}:table/{name}"
+
+    def _assert_validation(self, fn, msg: str):
+        with pytest.raises(ClientError) as exc:
+            fn()
+        err = exc.value.response["Error"]
+        assert err["Code"] == "ValidationException", err
+        assert err.get("Message") == msg, err
+
+    # -- stream reads: strict, 'Invalid StreamArn' before authz --
+
+    def test_describe_stream_wrong_kind_is_invalid_streamarn(self):
+        for policy in (ALLOW_ALL, {"Version": "2012-10-17", "Statement": []}):
+            s = self._ddb(policy, "dynamodbstreams")
+            for arn in [
+                self._tarn(),  # a table ARN
+                "xrn:aws:dynamodb:" + self.region + ":" + self.account_id + ":table/t/stream/x",
+                "arn::dynamodb:" + self.region + ":" + self.account_id + ":table/t/stream/x",
+            ]:
+                self._assert_validation(
+                    lambda a=arn, c=s: c.describe_stream(StreamArn=a), "Invalid StreamArn")
+
+    def test_get_shard_iterator_table_arn_is_invalid_streamarn(self):
+        s = self._ddb(ALLOW_ALL, "dynamodbstreams")
+        self._assert_validation(
+            lambda: s.get_shard_iterator(
+                StreamArn=self._tarn(), ShardId="shardId-00000000000000000000-00000001", ShardIteratorType="TRIM_HORIZON"),
+            "Invalid StreamArn")
+
+    # -- backup ops: strict, 'Invalid Backup ARN' before authz --
+
+    def test_describe_backup_wrong_kind_is_invalid_backup_arn(self):
+        for policy in (ALLOW_ALL, {"Version": "2012-10-17", "Statement": []}):
+            d = self._ddb(policy)
+            for arn in [
+                self._tarn(),
+                "xrn:aws:dynamodb:" + self.region + ":" + self.account_id + ":table/t/backup/01-ab",
+            ]:
+                self._assert_validation(
+                    lambda a=arn, c=d: c.describe_backup(BackupArn=a), "Invalid Backup ARN")
+
+    def test_delete_backup_table_arn_is_invalid_backup_arn(self):
+        d = self._ddb(ALLOW_ALL)
+        self._assert_validation(
+            lambda: d.delete_backup(BackupArn=self._tarn()), "Invalid Backup ARN")
+
+    # -- export: unparseable refused before authz; well-formed wrong-kind after --
+
+    def test_export_unparseable_tablearn_is_refused_before_authz(self):
+        # Refused for a no-permissions principal and an admin alike, before the
+        # IAM decision. Includes the A1 bypass ARN (repeated table/ segment).
+        for arn in [
+            self._tarn("allowed") + "/stream/table/secret",  # A1 bypass
+            self._tarn("a") + "/index/table/b",
+            "table/x",
+            "xrn:aws:dynamodb:" + self.region + ":" + self.account_id + ":table/t",
+        ]:
+            for policy in (ALLOW_ALL, {"Version": "2012-10-17", "Statement": []}):
+                d = self._ddb(policy)
+                self._assert_validation(
+                    lambda a=arn, c=d: c.export_table_to_point_in_time(
+                        TableArn=a, S3Bucket="b"),
+                    "One or more parameter values were invalid: tableArn is not a valid ARN")
+
+    def test_export_wellformed_stream_arn_is_authorized_then_refused(self):
+        # A well-formed stream ARN of the wrong kind is NOT refused before
+        # authorization: authorization runs against the stream ARN as given,
+        # not against the table it belongs to (measured live: a no-permissions
+        # principal's AccessDenied names the stream ARN).
+        stream = self._tarn("t") + "/stream/2026-01-01T00:00:00.000"
+
+        # No-permissions principal: denied, and the denial names the stream
+        # ARN. An authorization that dropped the stream sub-resource would name
+        # the bare table ARN instead.
+        noperm = self._ddb({"Version": "2012-10-17", "Statement": []})
+        with pytest.raises(ClientError) as exc:
+            noperm.export_table_to_point_in_time(TableArn=stream, S3Bucket="b")
+        err = exc.value.response["Error"]
+        assert err["Code"] == "AccessDeniedException", err
+        assert f"on resource: {stream} because" in err.get("Message", ""), err
+
+        # An Allow on the bare table ARN does not cover the stream ARN, so the
+        # export is denied. An authorization against the bare table would let
+        # it through to the handler.
+        table_only = self._ddb({
+            "Version": "2012-10-17",
+            "Statement": [{
+                "Effect": "Allow",
+                "Action": "dynamodb:ExportTableToPointInTime",
+                "Resource": self._tarn("t"),
+            }],
+        })
+        with pytest.raises(ClientError) as exc:
+            table_only.export_table_to_point_in_time(TableArn=stream, S3Bucket="b")
+        err = exc.value.response["Error"]
+        assert err["Code"] == "AccessDeniedException", err
+        assert f"on resource: {stream} because" in err.get("Message", ""), err
+
+        # An authorized principal passes authorization and the handler refuses
+        # the request with a ValidationException. The handler's own 'Invalid
+        # Request: Table ARN is invalid.' message is covered by the
+        # extract_table_name_from_arn unit test, because this server has no
+        # export paths configured and its 'export disabled' check runs first.
+        admin = self._ddb(ALLOW_ALL)
+        with pytest.raises(ClientError) as exc:
+            admin.export_table_to_point_in_time(TableArn=stream, S3Bucket="b")
+        assert exc.value.response["Error"]["Code"] == "ValidationException", (
+            exc.value.response["Error"])
diff --git a/tests/test_cross_account_isolation.py b/tests/test_cross_account_isolation.py
index d7b377ff4..cb88bc3d6 100755
--- a/tests/test_cross_account_isolation.py
+++ b/tests/test_cross_account_isolation.py
@@ -492,27 +492,48 @@ def drain(client: Any, shard_id: str) -> list:
             + str(drained)[:600]
         )
 
-        # Construct a shard-iterator token for the shard holding account A's
-        # record and call GetRecords with account B's own credentials. The
-        # token is "<shard_id>|AFTER_SEQUENCE_NUMBER|<seq>|<ts>" in plain base64.
-        other_iterator = base64.b64encode(
-            f"{target_shard}|AFTER_SEQUENCE_NUMBER||{int(time.time())}".encode()
-        ).decode()
-        # Real DynamoDB rejects a GetRecords iterator it did not issue with
-        # ValidationException("Invalid ShardIterator") -- and does not
-        # distinguish "exists but not yours" from "does not exist", so the
-        # response cannot be used to probe another account's shard existence.
-        with pytest.raises(ClientError) as exc:
-            other["streams"].get_records(ShardIterator=other_iterator, Limit=100)
-        err = exc.value.response["Error"]
-        assert err["Code"] == "ValidationException", (
-            "a shard iterator for another account's shard must be rejected as "
-            f"ValidationException, got {err}"
-        )
-        assert err["Message"] == "Invalid ShardIterator", (
-            "expected DynamoDB-verbatim 'Invalid ShardIterator', got "
-            f"{err['Message']!r}"
-        )
+        # Account B calls GetRecords with iterators that name account A's shard.
+        # None of them may return A's records, and the answer must not depend on
+        # whether the shard exists, so it cannot be used to probe another
+        # account's streams. A made-up shard id is the control.
+        missing_shard = "shardId-00000000-0000-0000-0000-000000000000-0000000000000000"
+
+        def get_records_error(token: str) -> dict:
+            with pytest.raises(ClientError) as exc:
+                other["streams"].get_records(ShardIterator=token, Limit=100)
+            return exc.value.response["Error"]
+
+        # A token in the format issued before iterators carried their stream
+        # ARN ("<shard>|<type>|<seq>|<ts>"). It is answered by its shape alone,
+        # before any lookup, with ExpiredIteratorException, which is what
+        # DynamoDB returns for an expired iterator; the client asks for a new
+        # one.
+        def old_format(shard_id: str) -> str:
+            return base64.b64encode(
+                f"{shard_id}|AFTER_SEQUENCE_NUMBER||{int(time.time())}".encode()
+            ).decode()
+
+        err = get_records_error(old_format(target_shard))
+        assert err["Code"] == "ExpiredIteratorException", err
+        assert err["Message"] == "Shard iterator has expired", err
+        assert get_records_error(old_format(missing_shard)) == err
+
+        # A token in the current format that names account A's stream ARN.
+        # Authorization pins the stream ARN to account B, and the engine looks
+        # the stream up in account B, where it does not exist, so the request
+        # fails the same way for a real and a made-up shard.
+        def current_format(shard_id: str) -> str:
+            return base64.b64encode(
+                f"{shard_id}|AFTER_SEQUENCE_NUMBER||{int(time.time())}|{arn}".encode()
+            ).decode()
+
+        err = get_records_error(current_format(target_shard))
+        assert err["Code"] == "ResourceNotFoundException", err
+        assert get_records_error(current_format(missing_shard)) == err
+
+        # An iterator that does not decode gets DynamoDB's verbatim answer.
+        err = get_records_error("bm90LWFuLWl0ZXJhdG9y")
+        assert err == {"Code": "ValidationException", "Message": "Invalid ShardIterator"}, err
 
     def test_metrics_endpoint_requires_admin_auth(self, auth_env):
         endpoint, admin_user, admin_pass = auth_env