AWS::DynamoDB::Table GlobalSecondaryIndex Support for Multiple GSIs

[thesilentg]

2. Scope of request

Cloudformation cannot perform more than one DynamoDB GSI creation or deletion in a single update. Instead, users must add/delete a single GSI per update, and then manually create a new update for each GSI which needs to be added. For teams which have Cloudformation run as part of a deployment pipeline, this is even more bothersome as it necessitates waiting for multiple end-to-end runs of the entire deployment pipeline for each GSI that needs to be created/deleted.

Furthermore, once a Cloudformation stack includes a DynamoDB table with more than one GSI, it is no longer possible for someone to re-use this stack without manually editing it and going though the one-at-a-time GSI update process. This issue seems to be in direct contrast with the advertised goals of CloudFormation.

https://aws.amazon.com/cloudformation/

AWS CloudFormation provisions your resources in a safe, repeatable manner, allowing you to build and rebuild your infrastructure and applications, without having to perform manual actions or write custom scripts.

3. Expected behavior

1. Update operations to existing DynamoDb tables succeed even when adding/deleting multiple GSIs
2. Creating a new DynamoDb table using an Cloudformation stack that includes multiple GSIs succeeds

4. Suggest specific test cases

1. Creating a new DynamoDb table with two GSIs is able to complete successfully
2. Adding two GSIs in a single update to an existing table is able to complete successfully
3. Deleting a DynamoDb table with two GSIs is able to complete successfully
4. Removing two GSIs in a single update to an existing table is able to complete successfully

5. Helpful Links to speed up research and evaluation

https://stackoverflow.com/questions/28402003/creating-multiple-gsis-by-updatetable-dynamodb
https://stackoverflow.com/questions/47920665/how-to-delete-more-than-one-global-secondary-index-from-the-cloudformation-at-on
Managing Global Secondary Indexes documentation

6. Category

DB: DynamoDb

[PatMyron]

Creating and deleting multiple DynamoDB tables with multiple Global Secondary Indexes in one operation is possible in CloudFormation already:

ExampleTemplate.yaml

---

Difficult to guarantee multiple Global Secondary Index additions in one CloudFormation update for any existing DynamoDB table because:

1. CloudFormation uses temporary credentials to provision resources
2. DynamoDB Global Secondary Index creation for existing tables is performed serially
3. DynamoDB Global Secondary Index creation time has no guarantees:

Adding a Global Secondary Index to a Large Table
The time required for building a global secondary index depends on several factors, such as the following:

• The size of the table
• The number of items in the table that qualify for inclusion in the index
• The number of attributes projected into the index
• The provisioned write capacity of the index
• Write activity on the main table during index builds

If you are adding a global secondary index to a very large table, it might take a long time for the creation process to complete.

---

GSI deletion time should be faster, so possible for CloudFormation to add support for multiple GSI operations on existing tables if one or fewer of the operations are GSI creations

[benkehoe]

Will the new resource framework help solve this, given that it has dedicated support for long-running operations?

[PatMyron]

New framework still has time limits for the foreseeable future, right @rjlohan? I don't think there are guarantees on GSI creation time, so that could still be problematic even with longer time limits

[benbridts]

if I understand it correctly, there is a PR (aws-cloudformation/cloudformation-resource-schema#61) open that would give you a maximum execution time of 12 hours (https://github.com/aws-cloudformation/aws-cloudformation-resource-schema/pull/61/files#diff-c22e96ee3efd905ffecd2b8dcad5c260R23)

[rjlohan]

The new framework will still have some time limit for the foreseeable future, right @rjlohan? I don't think there are any guarantees on GSI creation time, so that case could still be problematic even with a longer time limit

Correct. At some point, we are always going to be bound by the maximum session duration on credentials which CloudFormation assumes from the customer. For private types in the new framework, that maximum is 12 hours, bound by the maximum duration we can request in an sts:AssumeRole call.

For AWS-owned public types, we use a different authorization mechanism which lets us run to 36hours maximum. Anything longer, or transient, would require a new authZ model inside CloudFormation itself, which is a bigger ask. There are ways to achieve this, but will require some investment.

[benkehoe]

I guess when I think about the authentication part of this, which is that the user has an authenticated session that expires at some specific time, I balance that against the purpose of CloudFormation, which is to create persistent resources. It's often going to be the case that I can create resources with CloudFormation that can carry out my session's capability beyond my session expiration anyway.

[luiseduardocolon]

We will likely not pursue this in the short- or medium-term. The API specifically expects to perform only one single creation or deletion per update, and we believe we need to support it as the API dictates it. I'll close it for now - I believe that if we ever support this it will be if or when the underlying DynamoDB API supports it.

[et304383]

This should be reopened. All AWS needs to do is create a stand-alone resource for GSIs on an existing table. Then, we could chain them together with a bunch of depends on calls.

Creating and deleting multiple DynamoDB tables with multiple Global Secondary Indexes in one operation is possible in CloudFormation already:

ExampleTemplate.yaml

I can't believe someone from the CFN team suggested this as an example. The issue is clearly about defining 2 or more GSIs on a single table and you give a template with two table resources each with one GSI.

[gelpenaddict]

I understand that DynamoDB's API allows only 1 GSI but isn't the purpose of CloudFormation to automate deployments, including serializing such API calls to other services?