feat(dynamodb): throw ValidationErrors instead of untyped Errors (#33871)

### Issue # (if applicable)

Relates to #32569

### Reason for this change

untyped Errors are not recommended

### Description of changes

ValidationErrors everywhere

### Describe any new or updated permissions being added

None

### Description of how you validated changes

Existing tests. Exemptions granted as this is a refactor of existing code.

### Checklist
- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Author: kaizencc

packages/aws-cdk-lib/.eslintrc.js

@@ -48,6 +48,7 @@ const enableNoThrowDefaultErrorIn = [
   'aws-cognito',
   'aws-config',
   'aws-docdb',
+  'aws-dynamodb',
   'aws-ecr',
   'aws-efs',
   'aws-elasticloadbalancing',

packages/aws-cdk-lib/aws-dynamodb/lib/capacity.ts

@@ -1,4 +1,5 @@
 import { CfnGlobalTable } from './dynamodb.generated';
+import { UnscopedValidationError } from '../../core';
 
 /**
  * Capacity modes
@@ -71,7 +72,7 @@ export abstract class Capacity {
       }
 
       public _renderWriteCapacity() {
-        throw new Error(`You cannot configure 'writeCapacity' with ${CapacityMode.FIXED} capacity mode`);
+        throw new UnscopedValidationError(`You cannot configure 'writeCapacity' with ${CapacityMode.FIXED} capacity mode`);
       }
     }) (CapacityMode.FIXED);
   }
@@ -88,15 +89,15 @@ export abstract class Capacity {
         super(mode);
 
         if ((options.minCapacity ?? 1) > options.maxCapacity) {
-          throw new Error('`minCapacity` must be less than or equal to `maxCapacity`');
+          throw new UnscopedValidationError('`minCapacity` must be less than or equal to `maxCapacity`');
         }
 
         if (options.targetUtilizationPercent !== undefined && (options.targetUtilizationPercent < 20 || options.targetUtilizationPercent > 90)) {
-          throw new Error('`targetUtilizationPercent` cannot be less than 20 or greater than 90');
+          throw new UnscopedValidationError('`targetUtilizationPercent` cannot be less than 20 or greater than 90');
         }
 
         if (options.seedCapacity !== undefined && (options.seedCapacity < 1)) {
-          throw new Error(`'seedCapacity' cannot be less than 1 - received ${options.seedCapacity}`);
+          throw new UnscopedValidationError(`'seedCapacity' cannot be less than 1 - received ${options.seedCapacity}`);
         }
       }
 

packages/aws-cdk-lib/aws-dynamodb/lib/encryption.ts

@@ -2,7 +2,7 @@ import { Construct } from 'constructs';
 import { CfnGlobalTable } from './dynamodb.generated';
 import { TableEncryption } from './shared';
 import { IKey } from '../../aws-kms';
-import { Stack, Token } from '../../core';
+import { Stack, Token, ValidationError } from '../../core';
 
 /**
  * Represents server-side encryption for a DynamoDB table.
@@ -61,11 +61,11 @@ export abstract class TableEncryptionV2 {
       public _renderReplicaSseSpecification(scope: Construct, replicaRegion: string) {
         const stackRegion = Stack.of(scope).region;
         if (Token.isUnresolved(stackRegion)) {
-          throw new Error('Replica SSE specification cannot be rendered in a region agnostic stack');
+          throw new ValidationError('Replica SSE specification cannot be rendered in a region agnostic stack', scope);
         }
 
         if (replicaKeyArns.hasOwnProperty(stackRegion)) {
-          throw new Error(`KMS key for deployment region ${stackRegion} cannot be defined in 'replicaKeyArns'`);
+          throw new ValidationError(`KMS key for deployment region ${stackRegion} cannot be defined in 'replicaKeyArns'`, scope);
         }
 
         if (replicaRegion === stackRegion) {
@@ -76,7 +76,7 @@ export abstract class TableEncryptionV2 {
 
         const regionInReplicaKeyArns = replicaKeyArns.hasOwnProperty(replicaRegion);
         if (!regionInReplicaKeyArns) {
-          throw new Error(`KMS key for ${replicaRegion} was not found in 'replicaKeyArns'`);
+          throw new ValidationError(`KMS key for ${replicaRegion} was not found in 'replicaKeyArns'`, scope);
         }
 
         return {

packages/aws-cdk-lib/aws-dynamodb/lib/table-v2-base.ts

@@ -4,7 +4,7 @@ import { Operation, SystemErrorsForOperationsMetricOptions, OperationsMetricOpti
 import { IMetric, MathExpression, Metric, MetricOptions, MetricProps } from '../../aws-cloudwatch';
 import { AddToResourcePolicyResult, Grant, IGrantable, IResourceWithPolicy, PolicyDocument, PolicyStatement } from '../../aws-iam';
 import { IKey } from '../../aws-kms';
-import { Resource } from '../../core';
+import { Resource, ValidationError } from '../../core';
 
 /**
  * Represents an instance of a DynamoDB table.
@@ -95,7 +95,7 @@ export abstract class TableBaseV2 extends Resource implements ITableV2, IResourc
    */
   public grantStream(grantee: IGrantable, ...actions: string[]): Grant {
     if (!this.tableStreamArn) {
-      throw new Error(`No stream ARN found on the table ${this.node.path}`);
+      throw new ValidationError(`No stream ARN found on the table ${this.node.path}`, this);
     }
 
     return Grant.addToPrincipal({
@@ -131,7 +131,7 @@ export abstract class TableBaseV2 extends Resource implements ITableV2, IResourc
    */
   public grantTableListStreams(grantee: IGrantable): Grant {
     if (!this.tableStreamArn) {
-      throw new Error(`No stream ARN found on the table ${this.node.path}`);
+      throw new ValidationError(`No stream ARN found on the table ${this.node.path}`, this);
     }
 
     return Grant.addToPrincipal({
@@ -257,7 +257,7 @@ export abstract class TableBaseV2 extends Resource implements ITableV2, IResourc
    */
   public metricUserErrors(props?: MetricOptions): Metric {
     if (props?.dimensions) {
-      throw new Error('`dimensions` is not supported for the `UserErrors` metric');
+      throw new ValidationError('`dimensions` is not supported for the `UserErrors` metric', this);
     }
 
     return this.metric('UserErrors', { statistic: 'sum', ...props, dimensionsMap: {} });
@@ -281,7 +281,7 @@ export abstract class TableBaseV2 extends Resource implements ITableV2, IResourc
    */
   public metricSuccessfulRequestLatency(props?: MetricOptions): Metric {
     if (!props?.dimensions?.Operation && !props?.dimensionsMap?.Operation) {
-      throw new Error('`Operation` dimension must be passed for the `SuccessfulRequestLatency` metric');
+      throw new ValidationError('`Operation` dimension must be passed for the `SuccessfulRequestLatency` metric', this);
     }
 
     const dimensionsMap = {
@@ -351,7 +351,7 @@ export abstract class TableBaseV2 extends Resource implements ITableV2, IResourc
   public metricSystemErrors(props?: MetricOptions): Metric {
     if (!props?.dimensions?.Operation && !props?.dimensionsMap?.Operation) {
       // 'Operation' must be passed because its an operational metric.
-      throw new Error("'Operation' dimension must be passed for the 'SystemErrors' metric.");
+      throw new ValidationError("'Operation' dimension must be passed for the 'SystemErrors' metric.", this);
     }
 
     const dimensionsMap = {
@@ -368,7 +368,7 @@ export abstract class TableBaseV2 extends Resource implements ITableV2, IResourc
    */
   private sumMetricsForOperations(metricName: string, expressionLabel: string, props?: OperationsMetricOptions) {
     if (props?.dimensions?.Operation) {
-      throw new Error('The Operation dimension is not supported. Use the `operations` property');
+      throw new ValidationError('The Operation dimension is not supported. Use the `operations` property', this);
     }
 
     const operations = props?.operations ?? Object.values(Operation);
@@ -396,7 +396,7 @@ export abstract class TableBaseV2 extends Resource implements ITableV2, IResourc
     const mapper = metricNameMapper ?? (op => op.toLowerCase());
 
     if (props?.dimensions?.Operation) {
-      throw new Error('Invalid properties. Operation dimension is not supported when calculating operational metrics');
+      throw new ValidationError('Invalid properties. Operation dimension is not supported when calculating operational metrics', this);
     }
 
     for (const operation of operations) {
@@ -408,7 +408,7 @@ export abstract class TableBaseV2 extends Resource implements ITableV2, IResourc
       const operationMetricName = mapper(operation);
       const firstChar = operationMetricName.charAt(0);
       if (firstChar === firstChar.toUpperCase()) {
-        throw new Error(`Mapper generated an illegal operation metric name: ${operationMetricName}. Must start with a lowercase letter`);
+        throw new ValidationError(`Mapper generated an illegal operation metric name: ${operationMetricName}. Must start with a lowercase letter`, this);
       }
 
       metrics[operationMetricName] = metric;
@@ -441,7 +441,7 @@ export abstract class TableBaseV2 extends Resource implements ITableV2, IResourc
 
     if (options.streamActions) {
       if (!this.tableStreamArn) {
-        throw new Error(`No stream ARNs found on the table ${this.node.path}`);
+        throw new ValidationError(`No stream ARNs found on the table ${this.node.path}`, this);
       }
 
       return Grant.addToPrincipal({
@@ -452,7 +452,7 @@ export abstract class TableBaseV2 extends Resource implements ITableV2, IResourc
       });
     }
 
-    throw new Error(`Unexpected 'action', ${options.tableActions || options.streamActions}`);
+    throw new ValidationError(`Unexpected 'action', ${options.tableActions || options.streamActions}`, this);
   }
 
   private configureMetric(props: MetricProps) {

packages/aws-cdk-lib/aws-dynamodb/lib/table-v2.ts

@@ -454,7 +454,7 @@ export class TableV2 extends TableBaseV2 {
 
         const resourceRegion = stack.splitArn(tableArn, ArnFormat.SLASH_RESOURCE_NAME).region;
         if (!resourceRegion) {
-          throw new Error('Table ARN must be of the form: arn:<partition>:dynamodb:<region>:<account>:table/<table-name>');
+          throw new ValidationError('Table ARN must be of the form: arn:<partition>:dynamodb:<region>:<account>:table/<table-name>', this);
         }
 
         this.region = resourceRegion;
@@ -472,7 +472,7 @@ export class TableV2 extends TableBaseV2 {
     const stack = Stack.of(scope);
     if (!attrs.tableArn) {
       if (!attrs.tableName) {
-        throw new Error('At least one of `tableArn` or `tableName` must be provided');
+        throw new ValidationError('At least one of `tableArn` or `tableName` must be provided', scope);
       }
 
       tableName = attrs.tableName;
@@ -483,13 +483,13 @@ export class TableV2 extends TableBaseV2 {
       });
     } else {
       if (attrs.tableName) {
-        throw new Error('Only one of `tableArn` or `tableName` can be provided, but not both');
+        throw new ValidationError('Only one of `tableArn` or `tableName` can be provided, but not both', scope);
       }
 
       tableArn = attrs.tableArn;
       const resourceName = stack.splitArn(tableArn, ArnFormat.SLASH_RESOURCE_NAME).resourceName;
       if (!resourceName) {
-        throw new Error('Table ARN must be of the form: arn:<partition>:dynamodb:<region>:<account>:table/<table-name>');
+        throw new ValidationError('Table ARN must be of the form: arn:<partition>:dynamodb:<region>:<account>:table/<table-name>', scope);
       }
       tableName = resourceName;
     }
@@ -691,19 +691,19 @@ export class TableV2 extends TableBaseV2 {
   @MethodMetadata()
   public replica(region: string): ITableV2 {
     if (Token.isUnresolved(this.stack.region)) {
-      throw new Error('Replica tables are not supported in a region agnostic stack');
+      throw new ValidationError('Replica tables are not supported in a region agnostic stack', this);
     }
 
     if (Token.isUnresolved(region)) {
-      throw new Error('Provided `region` cannot be a token');
+      throw new ValidationError('Provided `region` cannot be a token', this);
     }
 
     if (region === this.stack.region) {
       return this;
     }
 
     if (!this.replicaTables.has(region)) {
-      throw new Error(`No replica table exists in region ${region}`);
+      throw new ValidationError(`No replica table exists in region ${region}`, this);
     }
 
     const replicaTableArn = this.replicaTableArns.find(arn => arn.includes(region));
@@ -874,7 +874,7 @@ export class TableV2 extends TableBaseV2 {
 
     props.nonKeyAttributes?.forEach(attr => this.nonKeyAttributes.add(attr));
     if (this.nonKeyAttributes.size > MAX_NON_KEY_ATTRIBUTES) {
-      throw new Error(`The maximum number of 'nonKeyAttributes' across all secondary indexes is ${MAX_NON_KEY_ATTRIBUTES}`);
+      throw new ValidationError(`The maximum number of 'nonKeyAttributes' across all secondary indexes is ${MAX_NON_KEY_ATTRIBUTES}`, this);
     }
 
     return {
@@ -938,7 +938,7 @@ export class TableV2 extends TableBaseV2 {
 
     const existingAttributeDef = this.attributeDefinitions.find(def => def.attributeName === name);
     if (existingAttributeDef && existingAttributeDef.attributeType !== type) {
-      throw new Error(`Unable to specify ${name} as ${type} because it was already defined as ${existingAttributeDef.attributeType}`);
+      throw new ValidationError(`Unable to specify ${name} as ${type} because it was already defined as ${existingAttributeDef.attributeType}`, this);
     }
 
     if (!existingAttributeDef) {
@@ -952,77 +952,77 @@ export class TableV2 extends TableBaseV2 {
 
   private validateIndexName(indexName: string) {
     if (this.globalSecondaryIndexes.has(indexName) || this.localSecondaryIndexes.has(indexName)) {
-      throw new Error(`Duplicate secondary index name, ${indexName}, is not allowed`);
+      throw new ValidationError(`Duplicate secondary index name, ${indexName}, is not allowed`, this);
     }
   }
 
   private validateIndexProjection(props: SecondaryIndexProps) {
     if (props.projectionType === ProjectionType.INCLUDE && !props.nonKeyAttributes) {
-      throw new Error(`Non-key attributes should be specified when using ${ProjectionType.INCLUDE} projection type`);
+      throw new ValidationError(`Non-key attributes should be specified when using ${ProjectionType.INCLUDE} projection type`, this);
     }
 
     if (props.projectionType !== ProjectionType.INCLUDE && props.nonKeyAttributes) {
-      throw new Error(`Non-key attributes should not be specified when not using ${ProjectionType.INCLUDE} projection type`);
+      throw new ValidationError(`Non-key attributes should not be specified when not using ${ProjectionType.INCLUDE} projection type`, this);
     }
   }
 
   private validateReplicaIndexOptions(options: { [indexName: string]: ReplicaGlobalSecondaryIndexOptions }) {
     for (const indexName of Object.keys(options)) {
       if (!this.globalSecondaryIndexes.has(indexName)) {
-        throw new Error(`Cannot configure replica global secondary index, ${indexName}, because it is not defined on the primary table`);
+        throw new ValidationError(`Cannot configure replica global secondary index, ${indexName}, because it is not defined on the primary table`, this);
       }
 
       const replicaGsiOptions = options[indexName];
       if (this.billingMode === BillingMode.PAY_PER_REQUEST && replicaGsiOptions.readCapacity) {
-        throw new Error(`Cannot configure 'readCapacity' for replica global secondary index, ${indexName}, because billing mode is ${BillingMode.PAY_PER_REQUEST}`);
+        throw new ValidationError(`Cannot configure 'readCapacity' for replica global secondary index, ${indexName}, because billing mode is ${BillingMode.PAY_PER_REQUEST}`, this);
       }
     }
   }
 
   private validateReplica(props: ReplicaTableProps) {
     const stackRegion = this.stack.region;
     if (Token.isUnresolved(stackRegion)) {
-      throw new Error('Replica tables are not supported in a region agnostic stack');
+      throw new ValidationError('Replica tables are not supported in a region agnostic stack', this);
     }
 
     if (Token.isUnresolved(props.region)) {
-      throw new Error('Replica table region must not be a token');
+      throw new ValidationError('Replica table region must not be a token', this);
     }
 
     if (props.region === this.stack.region) {
-      throw new Error(`You cannot add a replica table in the same region as the primary table - the primary table region is ${this.region}`);
+      throw new ValidationError(`You cannot add a replica table in the same region as the primary table - the primary table region is ${this.region}`, this);
     }
 
     if (this.replicaTables.has(props.region)) {
-      throw new Error(`Duplicate replica table region, ${props.region}, is not allowed`);
+      throw new ValidationError(`Duplicate replica table region, ${props.region}, is not allowed`, this);
     }
 
     if (this.billingMode === BillingMode.PAY_PER_REQUEST && props.readCapacity) {
-      throw new Error(`You cannot provide 'readCapacity' on a replica table when the billing mode is ${BillingMode.PAY_PER_REQUEST}`);
+      throw new ValidationError(`You cannot provide 'readCapacity' on a replica table when the billing mode is ${BillingMode.PAY_PER_REQUEST}`, this);
     }
   }
 
   private validateGlobalSecondaryIndex(props: GlobalSecondaryIndexPropsV2) {
     this.validateIndexName(props.indexName);
 
     if (this.globalSecondaryIndexes.size === MAX_GSI_COUNT) {
-      throw new Error(`You may not provide more than ${MAX_GSI_COUNT} global secondary indexes`);
+      throw new ValidationError(`You may not provide more than ${MAX_GSI_COUNT} global secondary indexes`, this);
     }
 
     if (this.billingMode === BillingMode.PAY_PER_REQUEST && (props.readCapacity || props.writeCapacity)) {
-      throw new Error(`You cannot configure 'readCapacity' or 'writeCapacity' on a global secondary index when the billing mode is ${BillingMode.PAY_PER_REQUEST}`);
+      throw new ValidationError(`You cannot configure 'readCapacity' or 'writeCapacity' on a global secondary index when the billing mode is ${BillingMode.PAY_PER_REQUEST}`, this);
     }
   }
 
   private validateLocalSecondaryIndex(props: LocalSecondaryIndexProps) {
     this.validateIndexName(props.indexName);
 
     if (!this.hasSortKey) {
-      throw new Error('The table must have a sort key in order to add a local secondary index');
+      throw new ValidationError('The table must have a sort key in order to add a local secondary index', this);
     }
 
     if (this.localSecondaryIndexes.size === MAX_LSI_COUNT) {
-      throw new Error(`You may not provide more than ${MAX_LSI_COUNT} local secondary indexes`);
+      throw new ValidationError(`You may not provide more than ${MAX_LSI_COUNT} local secondary indexes`, this);
     }
   }