[DynamoDB] Enable deletionProtectionEnabled, tags, and contributorInsights on table replicas

[vishalkatikineni]

Describe the bug
With global tables some of the configuration parameters like deletionProtectionEnabled, tags, and contributorInsights are not propagated to the replica tables.

Steps to reproduce

apiVersion: dynamodb.services.k8s.aws/v1alpha1
kind: Table
metadata:
  name: example-global
spec:
  attributeDefinitions:
  - attributeName: PK
    attributeType: S
  - attributeName: SK
    attributeType: S
  billingMode: PAY_PER_REQUEST
  continuousBackups:
    pointInTimeRecoveryEnabled: true
  contributorInsights: ENABLE
  deletionProtectionEnabled: true
  keySchema:
  - attributeName: PK
    keyType: HASH
  - attributeName: SK
    keyType: RANGE
  streamSpecification:
    streamEnabled: true
    streamViewType: NEW_AND_OLD_IMAGES
  tableClass: STANDARD
  tableName: example-global
  tableReplicas:
  - regionName: us-west-2
  tags:
  - key: Environment
    value: Dev

Expected outcome
Expectation is the same configuration parameters to be applied to the replica tables when global tables is enabled.

Environment
Production

• Kubernetes version -- v1.31.12
• Using EKS (yes/no), if so version?
• AWS service targeted (S3, RDS, etc.) -- DynamoDB

[github-actions]

Hello @vishalkatikineni 👋 Thank you for opening an issue in ACK! A maintainer will triage this issue soon.

We encourage community contributions, so if you're interested in tackling this yourself or suggesting a solution, please check out our Contribution and Code of Conduct guidelines.

You can find more information about ACK on our website.

[cheeseandcereal]

Can you confirm what functionality that you're talking about? There are global tables, global table v2, regular tables etc which all have different replication configs.

Can you please give some additional details to help clarify specifically what you're talking about here?

Some example ACK CR's you have applied/etc would help.

[vishalkatikineni]

I'm referring to the kind: Table which has the option to create table replicas as part of global tables.

Here's the example manifest:

apiVersion: dynamodb.services.k8s.aws/v1alpha1
kind: Table
metadata:
  name: example-global
spec:
  attributeDefinitions:
  - attributeName: PK
    attributeType: S
  - attributeName: SK
    attributeType: S
  billingMode: PAY_PER_REQUEST
  continuousBackups:
    pointInTimeRecoveryEnabled: true
  contributorInsights: ENABLE
  deletionProtectionEnabled: true
  keySchema:
  - attributeName: PK
    keyType: HASH
  - attributeName: SK
    keyType: RANGE
  streamSpecification:
    streamEnabled: true
    streamViewType: NEW_AND_OLD_IMAGES
  tableClass: STANDARD
  tableName: example-global
  tableReplicas:
  - regionName: us-west-2
  tags:
  - key: Environment
    value: Dev

[rushmash91]

Hi @vishalkatikineni,
Thank you for sharing the manifest!

The controller uses the UpdateTable api to create/update/delete replicas for the table. The api does not support the configuration mentioned here: deletionProtectionEnabled, tags, and contributorInsights

https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ReplicationGroupUpdate.html
https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_CreateReplicationGroupMemberAction.html
https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_UpdateReplicationGroupMemberAction.html

What is supported in UpdateTable for replicas includes:

• Creating a new replica in a specified region.
• Deleting an existing replica.
• Updating replica-specific settings like provisioned throughput, encryption keys, and indexes.

Tag propagation is not part of the DynamoDB UpdateTable API operation.

[vishalkatikineni]

@rushmash91 While the UpdateTable API doesn't support propagating deletionProtectionEnabled, tags, and contributorInsights directly to replica tables, is there a workaround similar to how terraform handles this using replica ARN?
https://github.com/hashicorp/terraform-provider-aws/blob/main/internal/service/dynamodb/update_tags_for_resource_gen.go#L45
https://github.com/hashicorp/terraform-provider-aws/blob/main/internal/service/dynamodb/table_replica.go

[rushmash91]

Hi @vishalkatikineni,

I think there's some confusion here about the resource types.

The Terraform links you shared are for Global Tables (aws_dynamodb_global_table resource), but you're using the ACK Table resource with tableReplicas.

The tableReplicas field uses the DynamoDB UpdateTable API which has limited support for replica configuration and doesn't support deletionProtectionEnabled, tags, or contributorInsights propagation.

[vishalkatikineni]

I used the Terraform implementation only as a reference to explore whether a similar approach could be applied in ACK by using the UpdateTable API with replica ARNs. If that’s not a feasible option, then perhaps raising a request for the upstream DynamoDB UpdateTable API to support modifying replica configurations would be the right next step

[rushmash91]

Yes, in this case we would need an upstream feature request. Closing this issue since this is out of scope for ACK.
Feel free to reopen if you have further comments 🙂

/close

[ack-prow]

@rushmash91: Closing this issue.

In response to this:

Yes, in this case we would need an upstream feature request. Closing this issue since this is out of scope for ACK.
Feel free to reopen if you have further comments 🙂

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.