AWS cli: DynamoDB UpdateTable: global table replica disassociation docs
Summary
Adds documentation for the new UpdateTable replica disassociation capability: the Disassociate replication group update, DisassociationMode (WAIT_FOR_REPLICATION), the --disassociation-protection-enabled flag, DisassociationProtectionEnabled in TableDescription, and the IAM permissions and verification steps required to disassociate a local global table replica.
Security assessment
The diff documents a new DynamoDB control-plane action and explicitly states the IAM permissions (dynamodb:UpdateTable, dynamodb:DisassociateTableReplica) and the requirement to use credentials for the account that owns the replica, plus a new disassociation-protection setting that guards against accidental removal of a global table replica. This is security-relevant guidance (authorization and protection configuration) but does not reference any specific vulnerability, CVE, or incident, so it is not security_issue_related.
Evidence
To use this operation to disassociate a local replica, you must have the `dynamodb:UpdateTable` and `dynamodb:DisassociateTableReplica` IAM permissions on the local replica. Send disassociation and disassociation protection requests to the replica's Region using credentials for the account that owns the replica. For prerequisites and the procedure, see [Disassociating a global table replica](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/globaltables-disassociate.html) in the _Amazon DynamoDB Developer Guide_ .
Diff
diff --git a/cli/latest/reference/dynamodb/update-table.md b/cli/latest/reference/dynamodb/update-table.md index ee11cba..17f4533 100644 --- a//cli/latest/reference/dynamodb/update-table.md +++ b//cli/latest/reference/dynamodb/update-table.md @@ -15 +15 @@ - * [AWS CLI 2.38.2 Command Reference](../../index.html) » + * [AWS CLI 2.38.3 Command Reference](../../index.html) » @@ -60 +60 @@ First time using the AWS CLI? See the [User Guide](https://docs.aws.amazon.com/c -Modifies the provisioned throughput settings, global secondary indexes, or DynamoDB Streams settings for a given table. +Modifies the provisioned throughput settings, global secondary indexes, DynamoDB Streams settings, or global table replica settings for a given table. @@ -66,0 +67,2 @@ You can only perform one of the following operations at once: + * Enable or disable disassociation protection for the local global table replica. + * Disassociate the local global table replica and keep it as a standalone regional table. The `Disassociate` action must be the only replica update in the request. If the request includes any other update, `UpdateTable` fails with a `ValidationException` and the disassociation does not start. @@ -70 +72,5 @@ You can only perform one of the following operations at once: -> `UpdateTable` is an asynchronous operation; while it’s executing, the table status changes from `ACTIVE` to `UPDATING` . While it’s `UPDATING` , you can’t issue another `UpdateTable` request. When the table returns to the `ACTIVE` state, the `UpdateTable` operation is complete. +> `UpdateTable` is an asynchronous operation; while it’s executing, the table status changes from `ACTIVE` to `UPDATING` . While it’s `UPDATING` , you can’t issue another `UpdateTable` request. Use `DescribeTable` to monitor the table’s status. + +To use this operation to disassociate a local replica, you must have the `dynamodb:UpdateTable` and `dynamodb:DisassociateTableReplica` IAM permissions on the local replica. Send disassociation and disassociation protection requests to the replica’s Region using credentials for the account that owns the replica. For prerequisites and the procedure, see [Disassociating a global table replica](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/globaltables-disassociate.html) in the _Amazon DynamoDB Developer Guide_ . + +To confirm successful disassociation, call `DescribeTable` in the replica’s Region and verify that `TableStatus` is `ACTIVE` and `Replicas` is absent or empty. If `TableStatus` returns to `ACTIVE` but the response still includes a `Replicas` list, the disassociation did not complete. Check `ReplicaStatus` for a replication-permission or encryption-access problem, resolve it, and retry. @@ -92,0 +99 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/dynamo + [--disassociation-protection-enabled | --no-disassociation-protection-enabled] @@ -683 +690 @@ JSON Syntax: -> A list of replica update actions (create, delete, or update) for the table. +> A list of replica update actions (create, delete, update, or disassociate) for the table. @@ -697,0 +705 @@ JSON Syntax: +>> * The local replica to be disassociated from a global table and retained as a standalone regional table. @@ -699,0 +708,2 @@ JSON Syntax: +>> +>> Each `ReplicationGroupUpdate` contains exactly one action. A `Disassociate` action must be the only replica update in the request; including other updates causes the request to fail. @@ -897,0 +908,18 @@ JSON Syntax: +>> +>> Disassociate -> (structure) +>> +>>> The parameters for disassociating the local replica from the global table and retaining it as a standalone regional table. +>>> +>>> RegionName -> (string) [required] +>>> +>>>> The Region of the replica to disassociate. Set this value to the Region where you send the `UpdateTable` request. You must use credentials for the account that owns the replica. +>>> +>>> DisassociationMode -> (string) [required] +>>> +>>>> The mode for handling pending replication before disassociation completes. You must specify `WAIT_FOR_REPLICATION` . For more information, see [Disassociating a global table replica](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/globaltables-disassociate.html) in the _Amazon DynamoDB Developer Guide_ . +>>>> +>>>> Possible values: +>>>> +>>>> * `WAIT_FOR_REPLICATION` +>>>> + @@ -951,0 +980,4 @@ JSON Syntax: + }, + "Disassociate": { + "RegionName": "string", + "DisassociationMode": "WAIT_FOR_REPLICATION" @@ -1142,0 +1175,8 @@ JSON Syntax: +`--disassociation-protection-enabled` | `--no-disassociation-protection-enabled` (boolean) + +> Specifies whether disassociation protection is enabled (`true` ) or disabled (`false` ) for the local replica of a multi-Region eventual consistency (MREC) global table using Version 2019.11.21. +> +> Disassociation protection is enabled by default. If you omit this parameter, the existing setting is unchanged. This setting is independent of `DeletionProtectionEnabled` . +> +> You can’t combine this change with any other change in the same `UpdateTable` request. + @@ -2626,0 +2667,2 @@ TableDescription -> (structure) +>> After a successful disassociation, this list is absent or empty. To confirm disassociation, also verify that `TableStatus` is `ACTIVE` . +>> @@ -3044,0 +3087,4 @@ TableDescription -> (structure) +> DisassociationProtectionEnabled -> (boolean) +> +>> Specifies whether disassociation protection is enabled (`true` ) or disabled (`false` ) for the local global table replica. Protection is enabled by default. +> @@ -3322 +3368 @@ TableDescription -> (structure) - * [AWS CLI 2.38.2 Command Reference](../../index.html) » + * [AWS CLI 2.38.3 Command Reference](../../index.html) »