AWS streams documentation change

Service: streams · 2026-06-25 · Documentation low

File: streams/latest/dev/kcl-iam-permissions.md

Summary

Added 'DeleteTable' permission to DynamoDB actions required for KCL metadata tables and added a note explaining this permission is only needed for single table format cleanup

Security assessment

The change adds a new permission requirement but doesn't address any security vulnerability or weakness. It's operational guidance for table cleanup after migration, not a security fix.

Diff

diff --git a/streams/latest/dev/kcl-iam-permissions.md b/streams/latest/dev/kcl-iam-permissions.md
index 07f928c8b..45be18f48 100644
--- a//streams/latest/dev/kcl-iam-permissions.md
+++ b//streams/latest/dev/kcl-iam-permissions.md
@@ -21 +21 @@ Amazon DynamoDB |  `CreateTable` `DescribeTable` `UpdateTable` `Scan` `GetItem`
-Amazon DynamoDB |  `CreateTable` `DescribeTable` `Scan` `GetItem` `PutItem` `UpdateItem` `DeleteItem` |  Worker metrics and coordinator state table (metadata tables in DynamoDB) created by KCL. `arn:aws:dynamodb:region:account:table/KCLApplicationName-WorkerMetricStats` `arn:aws:dynamodb:region:account:table/KCLApplicationName-CoordinatorState` |  Thess actions are required for KCL to manage the worker metrics and coordinator state metadata tables in DynamoDB.  
+Amazon DynamoDB |  `CreateTable` `DescribeTable` `Scan` `GetItem` `PutItem` `UpdateItem` `DeleteItem` `DeleteTable` |  Worker metrics and coordinator state table (metadata tables in DynamoDB) created by KCL. `arn:aws:dynamodb:region:account:table/KCLApplicationName-WorkerMetricStats` `arn:aws:dynamodb:region:account:table/KCLApplicationName-CoordinatorState` |  Thess actions are required for KCL to manage the worker metrics and coordinator state metadata tables in DynamoDB.  
@@ -28,0 +29,4 @@ Replace "region," "account," "StreamName," and "KCLApplicationName" in the ARNs
+###### Note
+
+The `DeleteTable` permission for the worker metrics and coordinator state tables is required only if you use the single table format. After the migration completes, you must manually delete the old tables. The `DeleteTable` permission allows you to perform this cleanup. For more information, see [Single table format for KCL](./kcl-single-table-format.html).
+