fix(dynamodb): reset the table-level GlobalTable on-demand write ceiling when the template drops it

[go-to-k]

Summary

Removing WriteOnDemandThroughputSettings from a AWS::DynamoDB::GlobalTable
template never set flatChanged, so no UpdateTable went out and the old
ceiling stayed live in AWS while cdkd reported success — the absent-field-reset
silent drop (#1160), the table-level sibling of the per-GSI case #1423 closed.

The reset merges per member rather than branching on "the whole block
disappeared" (the shape the #1433 review caught: a block can survive with its
member dropped, which is the likelier user edit), and only fires when the table
is PAY_PER_REQUEST on both sides of the deploy — the ceiling is not a live,
resettable setting otherwise, and that condition also subsumes suppressing the
reset during a billing-mode flip (see the Review section for why "not flipping"
alone was wrong). oldBilling / newBilling are now resolved once above step 3
and reused by step 4, so the two sites share one binding.

The issue asked for three fields; only ONE is implementable

Live-probed against real AWS (us-east-1 source + us-west-2 replica, one global
table per probe, both torn down). Full transcripts are on the issue.

field	reset payload	result
table-level WriteOnDemandThroughputSettings	-1	works — accepted, reads back as ABSENCE, partial removal preserves the sibling
replica OnDemandThroughputOverride	-1	accepted but stored literally as -1
replica OnDemandThroughputOverride	{}	accepted, then wedged the table in UPDATING for over an hour, value unchanged
replica OnDemandThroughputOverride	omit member	ValidationException: There are no actions specified…
replica ProvisionedThroughputOverride	-1 / 0	rejected, must have value greater than or equal to 1
replica ProvisionedThroughputOverride	{}	InternalServerError

Table-level -1 was verified independently rather than inherited from
#1423, since reset semantics are field-specific.

The two replica overrides are deliberately not implemented: there is no
payload that resets them, and shipping any of the above would trade a silent
no-op for a live defect (a nonsense stored value, or a wedged table). The
registry schema agrees by construction — it declares those members
"minimum": 1, so no in-band sentinel exists. Suggest re-titling #1434 to the
table-level field and either closing the replica halves as
not-currently-possible or splitting them out with a CloudFormation-side A/B as
their acceptance criterion. #1434 is intentionally left open (Refs, not
Closes) so the record does not claim all three were fixed.

Self-review catch

The first cut swapped Number() for toFiniteNumber(), which routed a
present-but-unresolvable value (an unresolved intrinsic) into the reset
branch — silently CLEARING the ceiling the template was trying to set, i.e. the
same silent-wrong-action class this PR exists to remove. The gate now tests raw
key presence and the coercion is left exactly as it was, so such a value still
reaches AWS and fails loudly. Pinned by a test.

Test plan

• 8 units: full removal, PARTIAL removal, value-changed (never the
  sentinel), stringly-typed coercion, present-but-unresolvable,
  PROVISIONED -> PROVISIONED drop, billing-flip suppression, no-change
  redeploy. Revert-proofed — neutering the reset fails exactly the first two
  while the rest stay green, since they pin behavior the change does not alter.
• Integ (dynamodb-globaltable, real AWS, PASS in 253s, 3 deleted / 0
  errors / 0 orphans): a new drop-table-ondemand-limit UPDATE mode alongside
  the existing drop-gsi-ondemand-limits (AWS::DynamoDB::GlobalTable: removing a per-GSI on-demand limit silently no-ops (absent-field reset, #1160 class) #1423) one. verify.sh asserts
  BEFORE and AFTER, not just after — step 13b drops only the per-GSI limit,
  so the table-level ceiling must still read 200 going in. Without that
  precondition the post-drop absence check would also pass if the ceiling had
  never reached AWS at all.
• The table-level READ ceiling is deliberately NOT asserted: the canonical
  Billing.onDemand({ maxReadRequestUnits }) is never wired by cdkd, so pinning
  it would encode that gap as expected behavior.

Related finding filed, not fixed here

The probes surfaced a separate, more severe gap: the table-level on-demand READ
ceiling (Replicas[local].ReadOnDemandThroughputSettings) is never wired AT ALL
— dropped on the way in rather than merely un-reset. The repo's own
verbatim-cdk synth unit fixture already carried the value with no assertion
over it. Filed as #1436.

Review

/review-pr tiered this 1-reviewer (215 LOC / 6 files would be inline,
bumped one step by the src/provisioning/providers/** up-bias plus >1 fix-back
commit). A pr-code-reviewer pass ran against the branch and found one real
defect introduced by this PR, now fixed:

• !billingModeFlipping was the wrong predicate. PROVISIONED -> PROVISIONED
  is also "not flipping", so a provisioned template that carried
  WriteOnDemandThroughputSettings (legal in the CFn schema, reachable from
  hand-authored L1 and from pre-fix state) and then dropped it would have sent
  OnDemandThroughput on a provisioned table and earned a ValidationException —
  a NEW failure where the pre-fix behavior was a correct no-op. The gate now
  requires PAY_PER_REQUEST on BOTH sides, which subsumes the flip suppression
  (a flip makes the two sides differ) and adds the missing "the ceiling is
  actually live" condition. Pinned by a test.

Two further findings were filed rather than fixed here, to keep this PR's blast
radius on the table-level path:

• AWS::DynamoDB::GlobalTable: the per-GSI on-demand reset fires on a present-but-unresolvable value, silently clearing the ceiling #1440 — the per-GSI reset (AWS::DynamoDB::GlobalTable: removing a per-GSI on-demand limit silently no-ops (absent-field reset, #1160 class) #1423's shipped code) still decides "dropped"
  from whether the value COERCED, so a present-but-unresolvable per-GSI value
  silently clears the ceiling. Same class as the table-level hazard caught in
  self-review here, but fixing it means threading the raw CFn blob into a loop
  that iterates SDK-translated shapes — surgery on AWS::DynamoDB::GlobalTable: removing a per-GSI on-demand limit silently no-ops (absent-field reset, #1160 class) #1423 rather than a gate
  change.
• AWS::DynamoDB::GlobalTable: a table-level on-demand ceiling may be permanently stranded across a PROVISIONED round-trip (needs a probe) #1441 — a ceiling live before a flip TO PROVISIONED may be permanently
  stranded across a PROVISIONED round-trip, IF AWS retains the member across
  the flip. The AWS::DynamoDB::GlobalTable: table-level and cross-region-replica on-demand ceilings have the same absent-field-reset drop as #1423 #1434 probes cleared the ceiling before flipping, so they do not
  settle retention; the issue carries the exact probe that would.

Verified clean by the reviewer: the raw-presence gate, the oldBilling /
newBilling hoist (identical values at all 8 downstream consumers; nothing
mutates the property bags in between), leaving create() unchanged, and the
readCurrentState / drift interaction (the always-emit placeholder means the
post-reset baseline and the next read agree, so no phantom drift and no reset
loop).

Refs #1434

[github-actions]

🎉 This PR is included in version 0.278.17 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀