Hi there! In my

StorageStack

I'm creating an sst.Table construct that references an existing table, like so:

this.myDataTable = new sst.Table(this, 'MyData', {
      dynamodbTable: dynamodb.Table.fromTableArn(this, 'MyDataTable', `arn:aws:dynamodb:${scope.region}:${scope.account}:table/${scope.stage}-my-data`)
    })

Then in my

ApiStack

I'm granting the Api permissions, like so:

this.api.attachPermissions([myDataTable])

All is well.. Hurray. But... If I want to query from a global secondary index, such as

GSI0

, I get permission denied. Do I need to create an additional sst.Table construct pointing to that index? such as:

this.myDataGSITable = new sst.Table(this, 'MyDataGSI', {
      dynamodbTable: dynamodb.Table.fromTableArn(this, 'MyDataTableGSI', `arn:aws:dynamodb:${scope.region}:${scope.account}:table/${scope.stage}-my-data/index/GSI0`)
    })

Or is there a more appropriate method to grant access to the API?

how are you specifying that this table has global secondary indexes?

Instead of

fromTableArn

you need to use

fromTableAttributes

and specify that the table has secondary indexes.

Aaaah!! That sounds promising! Thank you very much!

You in JS? its got a shape…

Seems to fit the description in the cdk docs, but still doesn't seem to apply the permissions.

pulling up a stack…one moment.

Thanks

our fromTableAttributes looks the same…

I'll try that. I was using this in my APIStack and massing the table ref in.

this.api.attachPermissions([myDataTable])

not sure why attach permissions would work differently, but perhaps the SST gang will chime in

Ok.. so.. umm.. sometimes we overlook things. 🤦‍♂️ My actual implementation has a number of tables in it, so what I posted was a simplification. All the while I didn't notice that the table I was trying to read from wasn't even in my list of tables to add permission to.. So it works with what you gave me initially.. Thanks a bunch!

lol, it happens to everyone