A table ARN in TableName with another partition, service or region is not refused as the service refuses it #794

What DynamoDB does

DynamoDB refuses a TableName that is a table ARN with another partition, service or region with ValidationException before the IAM decision. A caller allowed dynamodb:* on * and a caller allowed only on the canonical table ARN get the same answer. Measured 2026-11-03 in us-east-1 against a table in the caller's account:

With a table ARN in another account, GetItem gets the same ValidationException whether or not the account exists. DescribeTable gets it when the account exists and AccessDeniedException "Access is denied" when it does not.

What ExtendDB does

Authorization matches the policies against this deployment's table, so a caller with no policy is denied, naming the ARN as supplied. A caller allowed on the table reaches the engine. Measured on SQLite with a caller allowed dynamodb:* on *:

#509 refuses a table ARN in another account before the IAM decision, with the cross-account answer. For the spellings above, and for an index or backup ARN in TableName, the service answers the ValidationException instead: on GetItem whether or not the account exists, and on DescribeTable when it exists (measured 2026-11-03). The check belongs ahead of that refusal.

Reproduction

aws dynamodb describe-table --region us-east-1 \
    --table-name arn:aws:dynamodb:us-west-2:<acct>:table/<T>
aws dynamodb get-item --region us-east-1 \
    --table-name arn:aws-cn:dynamodb:us-east-1:<acct>:table/<T> \
    --key '{"pk": {"S": "a"}}'

Run against DynamoDB and against ExtendDB (--endpoint-url) with a caller allowed on the table.

Related

#442 asks for a table ARN of this deployment in TableName to act on that table; #200 implements it. The partition, service and region check belongs in the same place, so a respelled ARN is refused there rather than resolved or reported as a missing table. #451 covers the same gap for StreamArn on DescribeStream and GetShardIterator.