From 9119795793e7639d0a74d54f974ec6308dd0fca2 Mon Sep 17 00:00:00 2001
From: Lee Hannigan <29015211+LeeroyHannigan@users.noreply.github.com>
Date: Sat, 31 Oct 2026 00:45:38 +0000
Subject: [PATCH 01/14] fix(server): refuse stream ARNs outside this account,
 partition and region

DescribeStream and GetShardIterator served the caller's own stream for a
StreamArn that named another account, another partition, another region,
an upper-cased region or the service spelled DYNAMODB. Authorization
rebuilt every stream ARN with the server's partition, service and region
and the caller's account, and the stream engine resolved the stream by
table name and label, so the fields a client might get wrong were ignored
on both sides. The tag operations answered the same stream ARN with
"Invalid TableArn: Invalid ResourceArn provided as input <arn>".

Measured on DynamoDB on 2026-10-23 for an admin, a no-permissions user, a
user allowed the exact stream ARN and a user with a Deny on it. On
StreamArn, every principal gets AccessDeniedException "Access is denied"
for another account and ValidationException "Invalid StreamArn" for
aws-cn, aws-us-gov, DynamoDB, DYNAMODB, us-west-2 or US-EAST-1, so both
checks run before the IAM decision, account first. On a tag operation's
ResourceArn, another account is "Access is denied" for every principal;
the other spellings are authorized as sent (a no-permissions principal is
denied naming the ARN it sent, a principal allowed only the canonical ARN
is denied the respelled one) and then refused with "Invalid StreamArn". A
GetRecords token the service did not issue is "Invalid ShardIterator".

A stream ARN is now checked in the server before the IAM decision: on
StreamArn for its account, partition, service and region
(check_stream_arn_scope); on a tag operation's ResourceArn for its
account (check_stream_arn_account), with the ARN then authorized as sent
and the engine refusing another partition, service or region with
"Invalid StreamArn" after authorization; inside a GetRecords iterator for
all four fields, refusing the token as Invalid.

Wire tests in tests/test_stream_arn_scope.py cover the four principals,
five operations and seventeen spellings with the measured message text;
test_authz_resource_arn.py and test_cross_account_isolation.py are
updated to the measured answers.

Fixes #450
Fixes #451
---
 crates/engine/src/tagging.rs                  |  20 +
 crates/server/src/authz_resource.rs           | 182 ++++---
 .../server/src/authz_resource/stream_scope.rs | 249 +++++++++
 crates/server/src/request_helpers.rs          |  15 +-
 docs/manuals/07-upgrade-manual.md             |   6 +
 tests/test_authz_resource_arn.py              |  15 +-
 tests/test_cross_account_isolation.py         |  10 +-
 tests/test_stream_arn_scope.py                | 489 ++++++++++++++++++
 8 files changed, 902 insertions(+), 84 deletions(-)
 create mode 100644 crates/server/src/authz_resource/stream_scope.rs
 create mode 100644 tests/test_stream_arn_scope.py

diff --git a/crates/engine/src/tagging.rs b/crates/engine/src/tagging.rs
index 432d75dd4..669b386aa 100755
--- a/crates/engine/src/tagging.rs
+++ b/crates/engine/src/tagging.rs
@@ -34,6 +34,13 @@ fn tag_subresource_not_table_or_stream(resource: &str) -> bool {
     !matches!(segs.next(), None | Some("") | Some("stream"))
 }
 
+/// True for a `table/<name>/stream/<label>` resource.
+fn tag_subresource_is_stream(resource: &str) -> bool {
+    resource
+        .strip_prefix("table/")
+        .is_some_and(|tail| tail.split('/').nth(1) == Some("stream"))
+}
+
 /// Extract the table name from a `DynamoDB` table ARN, using the one shared
 /// resource parser ([`extenddb_core::arn::fields`]) so this layer splits an ARN
 /// the same way authorization and the engine stream resolver do.
@@ -60,6 +67,7 @@ fn extract_table_name_from_arn(arn: &str) -> Option<&str> {
 /// | Table ARN naming an index or other sub-resource | `ValidationException` (only table or stream is accepted) |
 /// | Account differs from the caller's | `AccessDeniedException` |
 /// | Table ARN with a different partition, service, or region | `ValidationException` (invalid `TableArn`) |
+/// | Stream ARN with a different partition, service, or region | `ValidationException` (`Invalid StreamArn`) |
 /// | Table does not exist | `ResourceNotFoundException` |
 ///
 /// Account is checked before the partition, service, and region, matching the
@@ -128,6 +136,18 @@ async fn validate_resource_arn(arn: &str, ctx: &OperationContext) -> Result<(),
     }
 
     if partition != "aws" || service != "dynamodb" || region != ctx.region.as_ref() {
+        // A stream ARN with another partition, service or region reaches this
+        // point for an authorized principal (the server authorizes a tag
+        // operation's stream ARN as sent, and refuses another account before
+        // authorization). The service answers "Invalid StreamArn" here
+        // (measured live 2026-10-23, ListTagsOfResource and TagResource for an
+        // admin and for a principal with Allow * plus a Deny on the canonical
+        // ARN). The service's table message differs (measured live).
+        if tag_subresource_is_stream(resource) {
+            return Err(DynamoDbError::ValidationException(
+                "Invalid StreamArn".to_owned(),
+            ));
+        }
         return Err(DynamoDbError::ValidationException(format!(
             "Invalid TableArn: Invalid ResourceArn provided as input {arn}"
         )));
diff --git a/crates/server/src/authz_resource.rs b/crates/server/src/authz_resource.rs
index a4439dff1..e36e7cc28 100644
--- a/crates/server/src/authz_resource.rs
+++ b/crates/server/src/authz_resource.rs
@@ -38,6 +38,20 @@
 //! evade a Deny written against the canonical ARN. Canonicalizing here closes
 //! that bypass: a Deny on the real resource always matches.
 //!
+//! A stream ARN is held to a stricter rule than canonicalization (issues #450
+//! and #451; measured live 2026-10-23, probes F2-1 and F2-2). Its account must
+//! be the caller's: another account is `AccessDeniedException` "Access is
+//! denied" before the IAM decision, on `StreamArn`, on a tag operation's
+//! `ResourceArn` and inside a `GetRecords` iterator alike
+//! ([`check_stream_arn_account`]). Its partition, service and region must be
+//! this deployment's: on `StreamArn` (DescribeStream, GetShardIterator) and in
+//! a `GetRecords` iterator another spelling is refused before the IAM decision
+//! with `Invalid StreamArn` ([`check_stream_arn_scope`]); on a tag operation's
+//! `ResourceArn` the IAM decision runs first, on the ARN as sent, and the
+//! engine refuses the spelling afterwards with the same message. So a
+//! respelled stream ARN is never served as the caller's own stream, and a
+//! stream ARN that reaches the engine spells the stream the engine reads.
+//!
 //! Fail-closed: a missing or unparseable resource field never falls back to
 //! `table/*`. It yields the field value verbatim (often empty), which an
 //! `Allow` on `*` still reaches so the engine returns its normal validation
@@ -50,6 +64,10 @@ use serde_json::Value;
 const PARTITION: &str = "aws";
 const SERVICE: &str = "dynamodb";
 
+/// Scope check for stream ARNs (issues #450 and #451).
+mod stream_scope;
+use stream_scope::{check_stream_arn_account, check_stream_arn_scope, stream_arn_in_scope};
+
 /// The item actions the service requires on the target table of a restore, in
 /// addition to the restore action itself (measured live). A Deny on any of
 /// these for the target table name blocks a restore into it.
@@ -147,21 +165,22 @@ fn backup_arn_field(input: &Value) -> String {
 /// The resource ARN a tag operation authorizes against.
 ///
 /// `validate_tag_resource_arn_shape` has already run: the value is a table ARN,
-/// a stream ARN, or a foreign-service ARN (an index, a backup, or a non-table
-/// `DynamoDB` ARN is rejected before authorization). A table or stream ARN is
-/// canonicalized to this deployment; a foreign-service ARN is left verbatim so
-/// authorization denies it, matching the service (measured, arn-1 table).
+/// a stream ARN in the caller's account, or a foreign-service ARN (an index, a
+/// backup, a non-table `DynamoDB` ARN, or a stream ARN in another account is
+/// rejected before authorization). A table ARN is canonicalized to this
+/// deployment. A stream ARN is authorized as sent: the service evaluates the
+/// IAM decision on the spelling the caller gave (a no-permissions principal's
+/// denial names `arn:aws-cn:...` as sent, and a principal allowed the exact
+/// canonical ARN is denied the `aws-cn` spelling; measured 2026-10-23, probe
+/// F2-1), and the engine refuses another partition, service or region after
+/// authorization with `Invalid StreamArn`. A foreign-service ARN is left
+/// verbatim so authorization denies it, matching the service (measured, arn-1
+/// table).
 fn tag_resource_arn(arn: &str, region: &str, account_id: &str) -> String {
     match parse_resource_identity(arn) {
-        Some(rid @ ResourceId { sub: None, .. })
-        | Some(
-            rid @ ResourceId {
-                sub: Some(Sub::Stream(_)),
-                ..
-            },
-        ) => canonical(region, account_id, &rid),
-        // A foreign-service ARN (or, defensively, an index/backup the shape
-        // check already rejected): authorization denies it.
+        Some(rid @ ResourceId { sub: None, .. }) => canonical(region, account_id, &rid),
+        // A stream ARN (authorized as sent), a foreign-service ARN, or,
+        // defensively, an index/backup the shape check already rejected.
         _ => arn.to_owned(),
     }
 }
@@ -214,7 +233,8 @@ fn arn_is_kind(arn: &str, kind: ArnKind) -> bool {
 }
 
 /// Validate ARN-bearing fields before the IAM decision, matching the service
-/// (measured live, `live-r2/arn-kinds-live.json`).
+/// (measured live, `live-r2/arn-kinds-live.json` and
+/// `arn-r3/review/rv3-2/live-matrix.json`).
 ///
 /// The two field families differ, as the service does:
 ///
@@ -222,7 +242,10 @@ fn arn_is_kind(arn: &str, kind: ArnKind) -> bool {
 ///   (DescribeBackup, DeleteBackup) are validated strictly: a value that is not
 ///   a well-formed stream (resp. backup) ARN of the correct kind, including a
 ///   table ARN, an `xrn:` ARN, or an empty partition, is refused before
-///   authorization with `Invalid StreamArn` (resp. `Invalid Backup ARN`).
+///   authorization with `Invalid StreamArn` (resp. `Invalid Backup ARN`). A
+///   well-formed stream ARN must also be in this deployment's scope
+///   ([`check_stream_arn_scope`]): another account is `AccessDeniedException`,
+///   another partition, service or region is `Invalid StreamArn`.
 /// - An export `TableArn` is validated loosely: only an UNPARSEABLE value (a
 ///   repeated `table/` segment such as `.../table/a/stream/table/b`, a bare
 ///   `table/x`, or an `xrn:` ARN) is refused before authorization, with
@@ -237,7 +260,12 @@ fn arn_is_kind(arn: &str, kind: ArnKind) -> bool {
 /// principal is denied) and the engine refuses it afterwards. Tag operations
 /// keep their own measured shape check (`validate_tag_resource_arn_shape`);
 /// `GetRecords` is handled through its iterator by [`getrecords_resource`].
-pub(crate) fn validate_operation_arns(operation: &str, input: &Value) -> Result<(), DynamoDbError> {
+pub(crate) fn validate_operation_arns(
+    operation: &str,
+    input: &Value,
+    region: &str,
+    account_id: &str,
+) -> Result<(), DynamoDbError> {
     let present = |key: &str| {
         input
             .get(key)
@@ -246,12 +274,13 @@ pub(crate) fn validate_operation_arns(operation: &str, input: &Value) -> Result<
     };
     match operation {
         "DescribeStream" | "GetShardIterator" => {
-            if let Some(arn) = present("StreamArn")
-                && !arn_is_kind(arn, ArnKind::Stream)
-            {
-                return Err(DynamoDbError::ValidationException(
-                    INVALID_STREAM_ARN_MESSAGE.to_owned(),
-                ));
+            if let Some(arn) = present("StreamArn") {
+                if !arn_is_kind(arn, ArnKind::Stream) {
+                    return Err(DynamoDbError::ValidationException(
+                        INVALID_STREAM_ARN_MESSAGE.to_owned(),
+                    ));
+                }
+                check_stream_arn_scope(arn, region, account_id)?;
             }
         }
         "DescribeBackup" | "DeleteBackup" => {
@@ -337,9 +366,16 @@ pub(crate) enum GetRecordsResource {
 ///
 /// The iterator is decoded once by the engine
 /// ([`extenddb_engine::classify_shard_iterator`]). A current token's stream ARN
-/// is canonicalized through the shared parser; a decoded stream ARN that does
-/// not parse to a stream is refused as Invalid rather than authorized verbatim,
-/// so no respelled or forged stream ARN is served.
+/// must parse to a stream and name this deployment's partition, service and
+/// region and the caller's account, or the token is refused as Invalid rather
+/// than canonicalized and served as the caller's own stream. GetShardIterator
+/// encodes the `StreamArn` it is sent and refuses one outside that scope, so
+/// every iterator issued from the canonical stream ARN passes. An iterator an
+/// earlier build issued from a respelled `StreamArn` (`aws-cn`, `US-EAST-1`,
+/// `DYNAMODB`), every iterator chained from it, and every iterator issued
+/// before a change of `server.region` are refused as Invalid. The service
+/// answers a token it did not issue with `Invalid ShardIterator` (measured
+/// 2026-10-22, `live-r2/iter-live.json`).
 pub(crate) fn getrecords_resource(
     input: &Value,
     region: &str,
@@ -356,7 +392,9 @@ pub(crate) fn getrecords_resource(
                     sub: Some(Sub::Stream(_)),
                     ..
                 },
-            ) => GetRecordsResource::Stream(canonical(region, account_id, &rid)),
+            ) if stream_arn_in_scope(&arn, region, account_id) => {
+                GetRecordsResource::Stream(canonical(region, account_id, &rid))
+            }
             _ => GetRecordsResource::Invalid,
         },
         extenddb_engine::ShardIteratorClass::Expired => GetRecordsResource::Expired,
@@ -401,23 +439,36 @@ fn backup_wildcard(region: &str, account_id: &str) -> String {
 /// as the service does (measured live). The service returns ValidationException
 /// to every principal, before the IAM decision, for an ARN that does not start
 /// with `arn:`, a DynamoDB ARN whose resource is not a table or stream, or an
-/// index ARN (tags are accepted only on a table or stream). A table or stream
-/// ARN passes; so does a foreign-service ARN (for example an S3 bucket), which
+/// index ARN (tags are accepted only on a table or stream). A table ARN passes;
+/// so does a foreign-service ARN (for example an S3 bucket), which
 /// authorization then denies. The partition, service, region, account, and
 /// existence of a table ARN are checked after authorization by the engine
 /// handler, so for those a no-permissions principal is denied first and only an
 /// authorized principal sees the shape error.
-pub(crate) fn validate_tag_resource_arn_shape(arn: &str) -> Result<(), DynamoDbError> {
+///
+/// A stream ARN's account is also checked here ([`check_stream_arn_account`]):
+/// the service answers `AccessDeniedException` "Access is denied" for a stream
+/// ARN in another account on ListTagsOfResource and TagResource, to every
+/// principal, before the IAM decision (measured 2026-10-23, probe F2-1). Its
+/// partition, service and region are not checked here: the service runs the
+/// IAM decision on the ARN as sent and refuses `aws-cn`, `DYNAMODB` or
+/// `us-west-2` afterwards with `Invalid StreamArn`, which the engine's
+/// `validate_resource_arn` answers for an authorized principal.
+pub(crate) fn validate_tag_resource_arn_shape(
+    arn: &str,
+    account_id: &str,
+) -> Result<(), DynamoDbError> {
     if !arn.starts_with("arn:") {
         return Err(DynamoDbError::ValidationException(format!(
             "One or more parameter values were invalid: ARNs must start with 'arn:': {arn}"
         )));
     }
     match parse_resource_identity(arn) {
+        Some(ResourceId { sub: None, .. }) => Ok(()),
         Some(ResourceId {
-            sub: None | Some(Sub::Stream(_)),
+            sub: Some(Sub::Stream(_)),
             ..
-        }) => Ok(()),
+        }) => check_stream_arn_account(arn, account_id),
         // A backup ARN is not a taggable resource kind (measured live, with a
         // real backup ARN and a short backup id).
         Some(ResourceId {
@@ -680,7 +731,9 @@ mod tests {
             format!("\t{arn}\r\n"),
         ] {
             for op in ["DescribeBackup", "DeleteBackup"] {
-                assert!(validate_operation_arns(op, &json!({ "BackupArn": spelled })).is_ok());
+                assert!(
+                    validate_operation_arns(op, &json!({ "BackupArn": spelled }), R, A).is_ok()
+                );
                 assert_eq!(
                     only(op, json!({ "BackupArn": spelled })),
                     arn,
@@ -761,26 +814,6 @@ mod tests {
         );
     }
 
-    // -- canonicalization closes the respelling bypass --
-
-    #[test]
-    fn respelled_partition_service_region_account_canonicalize_to_same_arn() {
-        let canonical =
-            "arn:aws:dynamodb:us-east-1:964157134968:table/T/stream/2026-10-20T16:17:40.188";
-        for respelled in [
-            "arn:aws-cn:dynamodb:us-east-1:964157134968:table/T/stream/2026-10-20T16:17:40.188",
-            "arn:aws:s3:us-east-1:964157134968:table/T/stream/2026-10-20T16:17:40.188",
-            "arn:aws:dynamodb:us-west-2:964157134968:table/T/stream/2026-10-20T16:17:40.188",
-            "arn:aws:dynamodb:us-east-1:111122223333:table/T/stream/2026-10-20T16:17:40.188",
-        ] {
-            assert_eq!(
-                only("DescribeStream", json!({ "StreamArn": respelled })),
-                canonical,
-                "respelled {respelled} must canonicalize"
-            );
-        }
-    }
-
     // -- per-operation resource derivation (matches live DynamoDB) --
 
     #[test]
@@ -968,7 +1001,7 @@ mod tests {
         // Both measured live.
         let index = "arn:aws:dynamodb:us-east-1:964157134968:table/bb/index/gsi1";
         assert!(matches!(
-            validate_tag_resource_arn_shape(index),
+            validate_tag_resource_arn_shape(index, A),
             Err(DynamoDbError::ValidationException(ref m))
                 if m.contains("only table or stream is accepted") && m.contains(index)
         ));
@@ -978,7 +1011,7 @@ mod tests {
         ] {
             assert!(
                 matches!(
-                    validate_tag_resource_arn_shape(backup),
+                    validate_tag_resource_arn_shape(backup, A),
                     Err(DynamoDbError::ValidationException(ref m))
                         if m == &format!(
                             "One or more parameter values were invalid: Provided Arn is not a \
@@ -990,12 +1023,13 @@ mod tests {
         }
         // A table ARN and a stream ARN pass the shape check.
         assert!(
-            validate_tag_resource_arn_shape("arn:aws:dynamodb:us-east-1:964157134968:table/bb")
+            validate_tag_resource_arn_shape("arn:aws:dynamodb:us-east-1:964157134968:table/bb", A)
                 .is_ok()
         );
         assert!(
             validate_tag_resource_arn_shape(
-                "arn:aws:dynamodb:us-east-1:964157134968:table/bb/stream/2026-10-20T16:17:40.188"
+                "arn:aws:dynamodb:us-east-1:964157134968:table/bb/stream/2026-10-20T16:17:40.188",
+                A
             )
             .is_ok()
         );
@@ -1005,14 +1039,14 @@ mod tests {
     fn tag_resource_arn_shape_matches_service_ordering() {
         // Measured live. ValidationException before authorization, every
         // principal:
-        let not_arn = validate_tag_resource_arn_shape("banana");
+        let not_arn = validate_tag_resource_arn_shape("banana", A);
         assert!(matches!(
             not_arn,
             Err(DynamoDbError::ValidationException(ref m))
                 if m.contains("ARNs must start with 'arn:': banana")
         ));
         let bad_type =
-            validate_tag_resource_arn_shape("arn:aws:dynamodb:us-east-1:964157134968:banana/x");
+            validate_tag_resource_arn_shape("arn:aws:dynamodb:us-east-1:964157134968:banana/x", A);
         assert!(matches!(
             bad_type,
             Err(DynamoDbError::ValidationException(ref m))
@@ -1020,16 +1054,20 @@ mod tests {
         ));
         // A foreign-service ARN whose resource is not a table passes the shape
         // check and is left to authorization (which denies it).
-        assert!(validate_tag_resource_arn_shape("arn:aws:s3:::mybucket").is_ok());
+        assert!(validate_tag_resource_arn_shape("arn:aws:s3:::mybucket", A).is_ok());
         // A table ARN whose partition, service, or region is this deployment's
         // or not passes the shape check; the engine handler validates those
         // fields after authorization.
         assert!(
-            validate_tag_resource_arn_shape("arn:aws-cn:dynamodb:us-east-1:964157134968:table/bb")
-                .is_ok()
+            validate_tag_resource_arn_shape(
+                "arn:aws-cn:dynamodb:us-east-1:964157134968:table/bb",
+                A
+            )
+            .is_ok()
         );
         assert!(
-            validate_tag_resource_arn_shape("arn:aws:s3:us-east-1:964157134968:table/bb").is_ok()
+            validate_tag_resource_arn_shape("arn:aws:s3:us-east-1:964157134968:table/bb", A)
+                .is_ok()
         );
     }
 
@@ -1163,14 +1201,14 @@ mod tests {
         let a1 = "arn:aws:dynamodb:us-east-1:1:table/allowed/stream/table/secret";
         assert!(arn::parse(a1).is_none());
         assert!(matches!(
-            validate_operation_arns("ExportTableToPointInTime", &json!({ "TableArn": a1 })),
+            validate_operation_arns("ExportTableToPointInTime", &json!({ "TableArn": a1 }), R, A),
             Err(DynamoDbError::ValidationException(ref m)) if m == INVALID_EXPORT_TABLE_ARN_MESSAGE
         ));
     }
 
     #[test]
     fn validate_operation_arns_matches_measured_live_behaviour() {
-        let err_msg = |op: &str, input: Value| match validate_operation_arns(op, &input) {
+        let err_msg = |op: &str, input: Value| match validate_operation_arns(op, &input, R, A) {
             Err(DynamoDbError::ValidationException(m)) => Some(m),
             Ok(()) => None,
             other => panic!("unexpected {other:?}"),
@@ -1221,10 +1259,11 @@ mod tests {
                 );
             }
         }
+        // A stream ARN in this deployment and the caller's account passes.
         assert_eq!(
             err_msg(
                 "DescribeStream",
-                json!({ "StreamArn": "arn:aws:dynamodb:us-east-1:1:table/t/stream/2026-10-20T16:17:40.188" })
+                json!({ "StreamArn": format!("arn:aws:dynamodb:{R}:{A}:table/t/stream/2026-10-20T16:17:40.188") })
             ),
             None
         );
@@ -1288,8 +1327,12 @@ mod tests {
 
     #[test]
     fn getrecords_resource_classifies_and_canonicalizes() {
-        // A current token authorizes against its canonical stream ARN.
-        let stream = "arn:aws:dynamodb:us-east-1:1:table/T/stream/2026-10-20T16:17:40.188";
+        // A current token issued by this server authorizes against the stream
+        // ARN it carries (a token naming any other account, partition, service
+        // or region is Invalid; see
+        // `getrecords_iterator_with_respelled_stream_arn_is_invalid`).
+        let stream =
+            "arn:aws:dynamodb:us-east-1:964157134968:table/T/stream/2026-10-20T16:17:40.188";
         let tok = extenddb_engine::encode_shard_iterator(
             "shardId-1",
             "AFTER_SEQUENCE_NUMBER",
@@ -1298,10 +1341,7 @@ mod tests {
             stream,
         );
         match getrecords_resource(&json!({ "ShardIterator": tok }), R, A) {
-            GetRecordsResource::Stream(arn) => assert_eq!(
-                arn,
-                "arn:aws:dynamodb:us-east-1:964157134968:table/T/stream/2026-10-20T16:17:40.188"
-            ),
+            GetRecordsResource::Stream(arn) => assert_eq!(arn, stream),
             _ => panic!("expected Stream"),
         }
         // A token that carries no stream ARN but a parseable timestamp is the
diff --git a/crates/server/src/authz_resource/stream_scope.rs b/crates/server/src/authz_resource/stream_scope.rs
new file mode 100644
index 000000000..ae4a73e2e
--- /dev/null
+++ b/crates/server/src/authz_resource/stream_scope.rs
@@ -0,0 +1,249 @@
+// Copyright 2026 ExtendDB contributors
+// SPDX-License-Identifier: Apache-2.0
+
+//! Scope check for stream ARNs (issues #450 and #451): the account must be the
+//! caller's, and the partition, service and region this deployment's. See the
+//! parent module docs for where each check runs relative to the IAM decision.
+
+use extenddb_core::error::DynamoDbError;
+
+use super::{INVALID_STREAM_ARN_MESSAGE, PARTITION, SERVICE};
+
+/// Refuse a stream ARN whose account is not the caller's with
+/// `AccessDeniedException` "Access is denied". The service answers this before
+/// the IAM decision, for every principal, on `StreamArn` (DescribeStream,
+/// GetShardIterator) and on a tag operation's `ResourceArn` alike, and before
+/// it looks at the partition, region or label (measured live 2026-10-23,
+/// probe F2-1: another 12-digit account, `abc`, and another account combined
+/// with `aws-cn`, `us-west-2` or an unknown label).
+pub(super) fn check_stream_arn_account(arn: &str, account_id: &str) -> Result<(), DynamoDbError> {
+    let Some(f) = extenddb_core::arn::fields(arn) else {
+        return Err(DynamoDbError::ValidationException(
+            INVALID_STREAM_ARN_MESSAGE.to_owned(),
+        ));
+    };
+    if f.account != account_id {
+        return Err(DynamoDbError::AccessDeniedException(
+            "Access is denied".to_owned(),
+        ));
+    }
+    Ok(())
+}
+
+/// Refuse a well-formed `StreamArn` that names a stream outside this
+/// deployment's scope, before the IAM decision, as the service does for
+/// DescribeStream and GetShardIterator (measured live 2026-10-23, probe F2-1,
+/// identical for an admin, a no-permissions user, a user allowed the exact
+/// stream ARN and a user with a Deny on it):
+///
+/// - an account other than the caller's: `AccessDeniedException`
+///   ([`check_stream_arn_account`]), checked first;
+/// - a partition other than `aws` (`aws-cn`, `aws-us-gov`), a service other
+///   than `dynamodb` (`DynamoDB`, `DYNAMODB`), or a region other than this
+///   server's (`us-west-2`, `US-EAST-1`): `ValidationException`
+///   `Invalid StreamArn`.
+///
+/// The stream engine resolves a stream by table name and label within the
+/// caller's account, so a stream ARN that passes here names exactly the stream
+/// the engine reads, and authorization evaluates that same ARN. Before this
+/// check existed, a respelled ARN was canonicalized for authorization and then
+/// served as the caller's own stream (issues #450 and #451).
+///
+/// A tag operation's `ResourceArn` does not take this check: the service runs
+/// the IAM decision on the ARN as sent and refuses the partition, service and
+/// region after it (`validate_resource_arn` in the engine answers
+/// `Invalid StreamArn` there).
+pub(super) fn check_stream_arn_scope(
+    arn: &str,
+    region: &str,
+    account_id: &str,
+) -> Result<(), DynamoDbError> {
+    check_stream_arn_account(arn, account_id)?;
+    let Some(f) = extenddb_core::arn::fields(arn) else {
+        return Err(DynamoDbError::ValidationException(
+            INVALID_STREAM_ARN_MESSAGE.to_owned(),
+        ));
+    };
+    if f.partition != PARTITION || f.service != SERVICE || f.region != region {
+        return Err(DynamoDbError::ValidationException(
+            INVALID_STREAM_ARN_MESSAGE.to_owned(),
+        ));
+    }
+    Ok(())
+}
+
+/// True when every field of this stream ARN is this deployment's and the
+/// caller's. GetShardIterator refuses a `StreamArn` for which this is false, so
+/// a shard iterator carrying one was hand-built, or issued by an earlier build
+/// or under another `server.region` ([`super::getrecords_resource`]).
+pub(super) fn stream_arn_in_scope(arn: &str, region: &str, account_id: &str) -> bool {
+    check_stream_arn_scope(arn, region, account_id).is_ok()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::super::{
+        GetRecordsResource, authz_targets, getrecords_resource, validate_operation_arns,
+        validate_tag_resource_arn_shape,
+    };
+    use super::*;
+    use serde_json::{Value, json};
+
+    const R: &str = "us-east-1";
+    const A: &str = "964157134968";
+
+    const STREAM: &str =
+        "arn:aws:dynamodb:us-east-1:964157134968:table/T/stream/2026-10-20T16:17:40.188";
+
+    fn only(op: &str, input: Value) -> String {
+        let t = authz_targets(op, &input, R, A);
+        assert_eq!(t.len(), 1, "expected one target for {op}: {t:?}");
+        t[0].1.clone()
+    }
+
+    fn stream_arn_check(op: &str, arn: &str) -> Result<(), DynamoDbError> {
+        validate_operation_arns(op, &json!({ "StreamArn": arn }), R, A)
+    }
+
+    fn assert_invalid_stream_arn(r: Result<(), DynamoDbError>, what: &str, arn: &str) {
+        match r {
+            Err(DynamoDbError::ValidationException(m)) => {
+                assert_eq!(m, "Invalid StreamArn", "{what} {arn}");
+            }
+            other => panic!("{what} {arn}: expected Invalid StreamArn, got {other:?}"),
+        }
+    }
+
+    fn assert_access_denied(r: Result<(), DynamoDbError>, what: &str, arn: &str) {
+        match r {
+            Err(DynamoDbError::AccessDeniedException(m)) => {
+                assert_eq!(m, "Access is denied", "{what} {arn}");
+            }
+            other => panic!("{what} {arn}: expected Access is denied, got {other:?}"),
+        }
+    }
+
+    fn respellings() -> [String; 7] {
+        [
+            STREAM.replace("arn:aws:", "arn:aws-cn:"),
+            STREAM.replace("arn:aws:", "arn:aws-us-gov:"),
+            STREAM.replace(":dynamodb:", ":DYNAMODB:"),
+            STREAM.replace(":dynamodb:", ":DynamoDB:"),
+            STREAM.replace(":dynamodb:", ":s3:"),
+            STREAM.replace("us-east-1", "us-west-2"),
+            STREAM.replace("us-east-1", "US-EAST-1"),
+        ]
+    }
+
+    /// The service answers a stream ARN in another account with
+    /// AccessDeniedException "Access is denied" before the IAM decision, on
+    /// StreamArn and on a tag ResourceArn (measured 2026-10-23).
+    #[test]
+    fn stream_arn_in_another_account_is_denied_before_authz() {
+        for respelled in [
+            STREAM.replace(A, "111111111111"),
+            STREAM.replace(A, "111122223333"),
+            STREAM.replace(A, "abc"),
+        ] {
+            for op in ["DescribeStream", "GetShardIterator"] {
+                assert_access_denied(stream_arn_check(op, &respelled), op, &respelled);
+            }
+            assert_access_denied(
+                validate_tag_resource_arn_shape(&respelled, A),
+                "tag",
+                &respelled,
+            );
+        }
+        // An empty account is "Invalid StreamArn" on StreamArn (the kind check
+        // requires every field) and "Access is denied" on a tag ResourceArn.
+        let empty = STREAM.replace(A, "");
+        for op in ["DescribeStream", "GetShardIterator"] {
+            assert_invalid_stream_arn(stream_arn_check(op, &empty), op, &empty);
+        }
+        assert_access_denied(validate_tag_resource_arn_shape(&empty, A), "tag", &empty);
+    }
+
+    /// The service answers another partition, region or service spelling of a
+    /// StreamArn with ValidationException "Invalid StreamArn" before the IAM
+    /// decision (measured 2026-10-23 for aws-cn, aws-us-gov, DynamoDB,
+    /// DYNAMODB, us-west-2 and US-EAST-1). On a tag ResourceArn the same
+    /// spellings pass the pre-authorization check and are authorized as sent;
+    /// the engine refuses them after the IAM decision.
+    #[test]
+    fn stream_arn_with_other_partition_region_or_service_is_invalid() {
+        for respelled in &respellings() {
+            for op in ["DescribeStream", "GetShardIterator"] {
+                assert_invalid_stream_arn(stream_arn_check(op, respelled), op, respelled);
+            }
+            assert!(
+                validate_tag_resource_arn_shape(respelled, A).is_ok(),
+                "tag {respelled}"
+            );
+            assert_eq!(
+                only("TagResource", json!({ "ResourceArn": respelled })),
+                *respelled,
+                "a tag ResourceArn is authorized as sent"
+            );
+        }
+        // The canonical spelling passes both checks and authorizes verbatim.
+        assert!(stream_arn_check("DescribeStream", STREAM).is_ok());
+        assert!(validate_tag_resource_arn_shape(STREAM, A).is_ok());
+        assert_eq!(
+            only("DescribeStream", json!({ "StreamArn": STREAM })),
+            STREAM
+        );
+        assert_eq!(
+            only("TagResource", json!({ "ResourceArn": STREAM })),
+            STREAM
+        );
+    }
+
+    /// Account is checked before the partition, service and region (measured
+    /// 2026-10-23: another account combined with aws-cn or us-west-2 is
+    /// "Access is denied" on every operation).
+    #[test]
+    fn stream_arn_account_is_checked_before_partition() {
+        for both in [
+            STREAM
+                .replace("arn:aws:", "arn:aws-cn:")
+                .replace(A, "111111111111"),
+            STREAM
+                .replace("us-east-1", "us-west-2")
+                .replace(A, "111111111111"),
+        ] {
+            for op in ["DescribeStream", "GetShardIterator"] {
+                assert_access_denied(stream_arn_check(op, &both), op, &both);
+            }
+            assert_access_denied(validate_tag_resource_arn_shape(&both, A), "tag", &both);
+        }
+    }
+
+    /// A GetRecords iterator carrying a stream ARN outside this deployment's
+    /// scope is Invalid, never canonicalized. GetShardIterator issues no such
+    /// iterator.
+    #[test]
+    fn getrecords_iterator_with_respelled_stream_arn_is_invalid() {
+        let token = |arn: &str| {
+            json!({ "ShardIterator": extenddb_engine::encode_shard_iterator(
+                "shardId-1", "AFTER_SEQUENCE_NUMBER", "", 1_000, arn) })
+        };
+        for respelled in [
+            STREAM.replace(A, "111111111111"),
+            STREAM.replace("arn:aws:", "arn:aws-cn:"),
+            STREAM.replace(":dynamodb:", ":DYNAMODB:"),
+            STREAM.replace("us-east-1", "us-west-2"),
+        ] {
+            assert!(
+                matches!(
+                    getrecords_resource(&token(&respelled), R, A),
+                    GetRecordsResource::Invalid
+                ),
+                "{respelled}"
+            );
+        }
+        match getrecords_resource(&token(STREAM), R, A) {
+            GetRecordsResource::Stream(arn) => assert_eq!(arn, STREAM),
+            _ => panic!("canonical iterator must authorize its stream"),
+        }
+    }
+}
diff --git a/crates/server/src/request_helpers.rs b/crates/server/src/request_helpers.rs
index 9ca4d7dce..2a0f00a93 100755
--- a/crates/server/src/request_helpers.rs
+++ b/crates/server/src/request_helpers.rs
@@ -189,15 +189,19 @@ pub(crate) async fn authorize_request(
     // Tag operations validate the ResourceArn shape before the IAM decision, as
     // the service does: an index ARN (tags are accepted only on a table or
     // stream) is rejected with ValidationException for every principal, before
-    // authorization. A table or stream ARN passes; its account, region, and
-    // existence are checked after authorization by the engine tag handler.
+    // authorization. A table ARN passes; its account, region, and existence
+    // are checked after authorization by the engine tag handler. A stream ARN
+    // must name the caller's account here, before authorization, as the
+    // service does (AccessDeniedException "Access is denied" for every
+    // principal, #450); its partition, service and region are checked by the
+    // engine after authorization, which runs on the ARN as sent (#451).
     if matches!(
         operation,
         "TagResource" | "UntagResource" | "ListTagsOfResource"
     ) && let Some(arn) = input.get("ResourceArn").and_then(Value::as_str)
         && !arn.is_empty()
     {
-        authz_resource::validate_tag_resource_arn_shape(arn)?;
+        authz_resource::validate_tag_resource_arn_shape(arn, account_id)?;
     }
 
     // Every other ARN-bearing field (StreamArn, BackupArn, the export TableArn,
@@ -205,7 +209,10 @@ pub(crate) async fn authorize_request(
     // takes, or the request is refused with ValidationException before the IAM
     // decision. Without this, an ARN the engine resolves one way and
     // authorization reads another lets a Deny on the real resource be bypassed.
-    authz_resource::validate_operation_arns(operation, input)?;
+    // A StreamArn must also be in this deployment's scope (partition, service,
+    // region) and the caller's account, so the stream authorized is the stream
+    // the engine reads and a respelled ARN is never served (#450, #451).
+    authz_resource::validate_operation_arns(operation, input, &state.region, account_id)?;
 
     // GetRecords carries its resource only inside the opaque shard iterator, not
     // in a request body field. Decode the iterator for the stream ARN and
diff --git a/docs/manuals/07-upgrade-manual.md b/docs/manuals/07-upgrade-manual.md
index f4451a0f5..93141a232 100755
--- a/docs/manuals/07-upgrade-manual.md
+++ b/docs/manuals/07-upgrade-manual.md
@@ -667,6 +667,12 @@ No catalog migration is required. Before upgrading a deployment that restricts t
 
 ---
 
+### Streams: a `StreamArn` with another partition is refused
+
+DescribeStream and GetShardIterator now refuse a client-built `StreamArn` with the `arn:aws-cn:` or `arn:aws-us-gov:` partition with `ValidationException` "Invalid StreamArn", also on a deployment whose `server.region` is a China or GovCloud region. The server issues every stream ARN as `arn:aws:`, so a `StreamArn` taken from DescribeTable or ListStreams is not affected. No catalog migration is required.
+
+---
+
 ## License
 
 Copyright 2026 ExtendDB contributors. Licensed under the Apache License, Version 2.0.
diff --git a/tests/test_authz_resource_arn.py b/tests/test_authz_resource_arn.py
index 3d4accb65..b50ab1b3c 100644
--- a/tests/test_authz_resource_arn.py
+++ b/tests/test_authz_resource_arn.py
@@ -570,13 +570,18 @@ def test_import_deny_new_table_blocks(self, table):
     # -- fail closed: a respelled ARN cannot evade a Deny on the canonical ARN --
 
     def test_respelled_stream_arn_cannot_bypass_deny(self, table):
-        """A Deny on the canonical stream ARN must also block a request that
-        respells the partition. ExtendDB resolves the stream in this account
-        regardless of the ARN's partition, so authorizing the respelled string
-        verbatim would bypass the Deny."""
+        """A principal with a Deny on the canonical stream ARN gets no stream
+        back for a request that respells the partition. The service refuses the
+        respelled ARN before the IAM decision with ValidationException "Invalid
+        StreamArn" (measured 2026-10-22), so ExtendDB does the same instead of
+        canonicalizing it; the fuller matrix is in test_stream_arn_scope.py."""
         respelled = table["stream_arn"].replace("arn:aws:", "arn:aws-cn:")
         s = self._ddb(_allow_all_deny("DescribeStream", table["stream_arn"]), "dynamodbstreams")
-        self._assert_denied(lambda: s.describe_stream(StreamArn=respelled))
+        with pytest.raises(ClientError) as exc:
+            s.describe_stream(StreamArn=respelled)
+        err = exc.value.response["Error"]
+        assert err["Code"] == "ValidationException", err
+        assert err.get("Message") == "Invalid StreamArn", err
 
     def test_table_arn_in_tablename_deny_blocks(self, table):
         """A Deny on the table ARN blocks GetItem whether TableName is the bare
diff --git a/tests/test_cross_account_isolation.py b/tests/test_cross_account_isolation.py
index cb88bc3d6..6b5d98058 100755
--- a/tests/test_cross_account_isolation.py
+++ b/tests/test_cross_account_isolation.py
@@ -519,16 +519,18 @@ def old_format(shard_id: str) -> str:
         assert get_records_error(old_format(missing_shard)) == err
 
         # A token in the current format that names account A's stream ARN.
-        # Authorization pins the stream ARN to account B, and the engine looks
-        # the stream up in account B, where it does not exist, so the request
-        # fails the same way for a real and a made-up shard.
+        # GetShardIterator refuses a StreamArn in another account, so account B
+        # is never issued a token naming A's stream. This one is refused as an
+        # invalid iterator before authorization, the same way for a real and a
+        # made-up shard, and the stream ARN it carries is never rewritten to
+        # account B.
         def current_format(shard_id: str) -> str:
             return base64.b64encode(
                 f"{shard_id}|AFTER_SEQUENCE_NUMBER||{int(time.time())}|{arn}".encode()
             ).decode()
 
         err = get_records_error(current_format(target_shard))
-        assert err["Code"] == "ResourceNotFoundException", err
+        assert err == {"Code": "ValidationException", "Message": "Invalid ShardIterator"}, err
         assert get_records_error(current_format(missing_shard)) == err
 
         # An iterator that does not decode gets DynamoDB's verbatim answer.
diff --git a/tests/test_stream_arn_scope.py b/tests/test_stream_arn_scope.py
new file mode 100644
index 000000000..a5b91a8a6
--- /dev/null
+++ b/tests/test_stream_arn_scope.py
@@ -0,0 +1,489 @@
+# SPDX-License-Identifier: Apache-2.0
+
+"""Stream ARN scope: account, partition, region and service (issues #450, #451).
+
+A StreamArn (DescribeStream, GetShardIterator), a stream ARN in a tag
+operation's ResourceArn, and the stream ARN inside a GetRecords iterator must
+name the caller's account and this deployment's partition, service and region.
+Before this fix ExtendDB resolved a stream by table name and label only, so a
+StreamArn in another account, partition or region, or with an upper-cased
+service or region, was served as the caller's own stream.
+
+Every expected answer below was measured against live DynamoDB on 2026-10-23
+(12:22 to 12:27 UTC, probes F2-1 and F2-2; UntagResource and the
+GetShardIterator unknown-label recheck in probe W1-1) for four principals: an
+admin (Allow dynamodb:* on *), a user with no stream permissions, a user
+allowed exactly the canonical stream ARN, and a user with Allow * plus a Deny
+on the canonical stream ARN.
+
+StreamArn (DescribeStream, GetShardIterator), the same for every principal, so
+before the IAM decision:
+
+  | spelling                                          | answer                              |
+  |---------------------------------------------------|-------------------------------------|
+  | another account (111111111111, abc), alone or with | AccessDeniedException               |
+  |   aws-cn, us-west-2 or an unknown label            |   "Access is denied"                |
+  | empty account; aws-cn; aws-us-gov; DynamoDB;       | ValidationException                 |
+  |   DYNAMODB; us-west-2; US-EAST-1; an extra field;  |   "Invalid StreamArn"               |
+  |   a missing region field; a trailing slash         |                                     |
+  | a label the table never had                        | IAM decision first (noperm, exact   |
+  |                                                    |   denied); then ResourceNotFound    |
+
+ResourceArn (ListTagsOfResource, TagResource, UntagResource):
+
+  | spelling                                          | answer                              |
+  |---------------------------------------------------|-------------------------------------|
+  | another account, abc, empty account               | AccessDeniedException               |
+  |                                                    |   "Access is denied", every principal |
+  | an extra field; a trailing slash                   | ValidationException "One or more    |
+  |                                                    |   parameter values were invalid:    |
+  |                                                    |   Provided Arn is not a DynamoDB    |
+  |                                                    |   resource arn: <arn>", every       |
+  |                                                    |   principal                         |
+  | aws-cn; aws-us-gov; DynamoDB; DYNAMODB; us-west-2; | IAM decision first, on the ARN as   |
+  |   US-EAST-1                                        |   sent (noperm and exact denied,    |
+  |                                                    |   naming that ARN); then            |
+  |                                                    |   ValidationException               |
+  |                                                    |   "Invalid StreamArn"               |
+  | a label the table never had                        | IAM decision first; then            |
+  |                                                    |   ResourceNotFoundException         |
+  |                                                    |   "Requested resource not found:    |
+  |                                                    |   ResourceArn: <arn> not found"     |
+
+A GetRecords token the service did not issue is ValidationException "Invalid
+ShardIterator" whatever stream ARN it carries.
+
+Prerequisites:
+  - extenddb running with `auth.provider = "builtin"` on EXTENDDB_TEST_ENDPOINT
+  - Admin credentials in EXTENDDB_ADMIN_USER / EXTENDDB_ADMIN_PASSWORD
+"""
+
+from __future__ import annotations
+
+import base64
+import os
+import time
+import uuid
+from typing import Any, Callable
+
+import boto3
+import pytest
+from botocore.config import Config as BotoConfig
+from botocore.exceptions import ClientError
+
+from conftest import wait_for_active
+from management_helpers import ManagementClient
+
+INVALID_STREAM_ARN = "Invalid StreamArn"
+ACCESS_IS_DENIED = "Access is denied"
+OTHER_ACCOUNT = "111111111111"
+
+STREAM_OPS = ("DescribeStream", "GetShardIterator")
+TAG_OPS = ("ListTagsOfResource", "TagResource", "UntagResource")
+
+
+def _require_auth_env() -> tuple[str, str, str]:
+    endpoint = os.environ.get("EXTENDDB_TEST_ENDPOINT", "").strip()
+    admin_user = os.environ.get("EXTENDDB_ADMIN_USER", "").strip()
+    admin_pass = os.environ.get("EXTENDDB_ADMIN_PASSWORD", "").strip()
+    if not endpoint or not admin_user or not admin_pass:
+        pytest.fail(
+            "MISCONFIGURED: stream ARN scope tests require EXTENDDB_TEST_ENDPOINT, "
+            "EXTENDDB_ADMIN_USER, and EXTENDDB_ADMIN_PASSWORD."
+        )
+    return endpoint, admin_user, admin_pass
+
+
+def _client(endpoint: str, ak: str, sk: str, region: str, service: str) -> Any:
+    kwargs: dict = dict(
+        service_name=service,
+        endpoint_url=endpoint,
+        aws_access_key_id=ak,
+        aws_secret_access_key=sk,
+        region_name=region,
+        config=BotoConfig(retries={"max_attempts": 0}),
+    )
+    if endpoint.startswith("https://"):
+        kwargs["verify"] = False
+    return boto3.client(**kwargs)
+
+
+ALLOW_ALL = {
+    "Version": "2012-10-17",
+    "Statement": [{"Effect": "Allow", "Action": "dynamodb:*", "Resource": "*"}],
+}
+NO_PERMISSIONS = {
+    "Version": "2012-10-17",
+    "Statement": [{"Effect": "Allow", "Action": "dynamodb:ListTables", "Resource": "*"}],
+}
+
+
+def _allow_only(resource: str) -> dict:
+    return {
+        "Version": "2012-10-17",
+        "Statement": [{"Effect": "Allow", "Action": "dynamodb:*", "Resource": resource}],
+    }
+
+
+def _allow_all_deny(action: str, resource: str) -> dict:
+    return {
+        "Version": "2012-10-17",
+        "Statement": [
+            {"Effect": "Allow", "Action": "dynamodb:*", "Resource": "*"},
+            {"Effect": "Deny", "Action": f"dynamodb:{action}", "Resource": resource},
+        ],
+    }
+
+
+@pytest.fixture(scope="module")
+def auth_env():
+    return _require_auth_env()
+
+
+@pytest.fixture(scope="module")
+def mgmt(auth_env) -> ManagementClient:
+    endpoint, admin_user, admin_pass = auth_env
+    return ManagementClient(endpoint, admin_user, admin_pass)
+
+
+@pytest.fixture(scope="module")
+def region() -> str:
+    return os.environ.get("AWS_DEFAULT_REGION", "us-east-1")
+
+
+@pytest.fixture(scope="module")
+def account_id(mgmt) -> str:
+    acct = f"{uuid.uuid4().int % 10**12:012d}"
+    resp = mgmt.create_account(acct, f"streamscope-{acct}")
+    assert resp.status_code == 201, resp.text
+    yield acct
+    mgmt.delete_account(acct)
+
+
+def _user_with_policy(mgmt: ManagementClient, account_id: str, policy: dict) -> tuple[str, str, str]:
+    user = f"u{uuid.uuid4().hex[:10]}"
+    assert mgmt.create_user(account_id, user, "TestPass123!").status_code == 201
+    assert mgmt.put_user_policy(account_id, user, "p", policy).status_code == 204
+    resp = mgmt.create_access_key(account_id, user)
+    assert resp.status_code == 201, resp.text
+    creds = resp.json()
+    return user, creds["access_key_id"], creds["secret_access_key"]
+
+
+@pytest.fixture(scope="module")
+def table(auth_env, mgmt, account_id, region):
+    """A table with a stream and one item. Returns its ARNs and a shard id."""
+    endpoint = auth_env[0]
+    _, ak, sk = _user_with_policy(mgmt, account_id, ALLOW_ALL)
+    ddb = _client(endpoint, ak, sk, region, "dynamodb")
+    streams = _client(endpoint, ak, sk, region, "dynamodbstreams")
+    name = f"s{uuid.uuid4().hex[:8]}"
+    ddb.create_table(
+        TableName=name,
+        AttributeDefinitions=[{"AttributeName": "pk", "AttributeType": "S"}],
+        KeySchema=[{"AttributeName": "pk", "KeyType": "HASH"}],
+        BillingMode="PAY_PER_REQUEST",
+        StreamSpecification={"StreamEnabled": True, "StreamViewType": "NEW_AND_OLD_IMAGES"},
+    )
+    wait_for_active(ddb, name)
+    ddb.put_item(TableName=name, Item={"pk": {"S": "p1"}})
+    desc = ddb.describe_table(TableName=name)["Table"]
+    stream_arn = desc["LatestStreamArn"]
+    shard_id = streams.describe_stream(StreamArn=stream_arn)["StreamDescription"]["Shards"][0]["ShardId"]
+    return {
+        "name": name,
+        "table_arn": desc["TableArn"],
+        "stream_arn": stream_arn,
+        "shard_id": shard_id,
+    }
+
+
+def _variants(stream_arn: str, region: str, account_id: str) -> dict[str, str]:
+    """The spellings measured in probes F2-1 and W1-1, keyed by their names."""
+    other_region = "us-west-2" if region != "us-west-2" else "us-east-1"
+    table_arn = stream_arn.split("/stream/")[0]
+    v = {
+        "account_other": stream_arn.replace(f":{account_id}:", f":{OTHER_ACCOUNT}:", 1),
+        "account_empty": stream_arn.replace(f":{account_id}:", "::", 1),
+        "account_nonnumeric": stream_arn.replace(f":{account_id}:", ":abc:", 1),
+        "partition_aws_cn": stream_arn.replace("arn:aws:", "arn:aws-cn:", 1),
+        "partition_aws_us_gov": stream_arn.replace("arn:aws:", "arn:aws-us-gov:", 1),
+        "service_DynamoDB": stream_arn.replace(":dynamodb:", ":DynamoDB:", 1),
+        "service_DYNAMODB": stream_arn.replace(":dynamodb:", ":DYNAMODB:", 1),
+        "region_other": stream_arn.replace(f":{region}:", f":{other_region}:", 1),
+        "region_upper": stream_arn.replace(f":{region}:", f":{region.upper()}:", 1),
+        "field_extra": stream_arn.replace(f":{account_id}:", f":{account_id}:x:", 1),
+        "field_missing_region": stream_arn.replace(f":{region}:", ":", 1),
+        "trailing_slash": stream_arn + "/",
+        "label_unknown": table_arn + "/stream/2000-01-01T00:00:00.000",
+    }
+    v["account_other_and_aws_cn"] = v["account_other"].replace("arn:aws:", "arn:aws-cn:", 1)
+    v["account_other_and_label_unknown"] = v["label_unknown"].replace(
+        f":{account_id}:", f":{OTHER_ACCOUNT}:", 1)
+    v["account_other_and_region_other"] = v["account_other"].replace(
+        f":{region}:", f":{other_region}:", 1)
+    return v
+
+
+ACCOUNT_VARIANTS = (
+    "account_other", "account_nonnumeric", "account_other_and_aws_cn",
+    "account_other_and_label_unknown", "account_other_and_region_other",
+)
+RESPELLINGS = (
+    "partition_aws_cn", "partition_aws_us_gov", "service_DynamoDB",
+    "service_DYNAMODB", "region_other", "region_upper",
+)
+MALFORMED = ("field_extra", "trailing_slash")
+
+
+def _not_dynamodb_resource(arn: str) -> str:
+    return (
+        "One or more parameter values were invalid: "
+        f"Provided Arn is not a DynamoDB resource arn: {arn}"
+    )
+
+
+def _iam_denied(account_id: str, user: str, op: str, arn: str) -> str:
+    return (
+        f"User: arn:aws:iam::{account_id}:user/{user} is not authorized to perform: "
+        f"dynamodb:{op} on resource: {arn} because no identity-based policy allows "
+        f"the dynamodb:{op} action"
+    )
+
+
+class _Principal:
+    def __init__(self, endpoint: str, region: str, account_id: str, user: str, ak: str, sk: str):
+        self.user = user
+        self.account_id = account_id
+        self.ddb = _client(endpoint, ak, sk, region, "dynamodb")
+        self.streams = _client(endpoint, ak, sk, region, "dynamodbstreams")
+
+    def call(self, op: str, arn: str, shard_id: str) -> Callable[[], Any]:
+        return {
+            "DescribeStream": lambda: self.streams.describe_stream(StreamArn=arn),
+            "GetShardIterator": lambda: self.streams.get_shard_iterator(
+                StreamArn=arn, ShardId=shard_id, ShardIteratorType="TRIM_HORIZON"),
+            "ListTagsOfResource": lambda: self.ddb.list_tags_of_resource(ResourceArn=arn),
+            "TagResource": lambda: self.ddb.tag_resource(
+                ResourceArn=arn, Tags=[{"Key": "k", "Value": "v"}]),
+            "UntagResource": lambda: self.ddb.untag_resource(ResourceArn=arn, TagKeys=["k"]),
+        }[op]
+
+    def error(self, op: str, arn: str, shard_id: str) -> dict:
+        with pytest.raises(ClientError) as exc:
+            self.call(op, arn, shard_id)()
+        return exc.value.response["Error"]
+
+    def iam_denied(self, op: str, arn: str) -> str:
+        return _iam_denied(self.account_id, self.user, op, arn)
+
+
+class TestStreamArnScope:
+    @pytest.fixture(autouse=True)
+    def setup(self, auth_env, mgmt, account_id, region, table):
+        self.endpoint = auth_env[0]
+        self.mgmt = mgmt
+        self.account_id = account_id
+        self.region = region
+        self.table = table
+        self.shard_id = table["shard_id"]
+        self.variants = _variants(table["stream_arn"], region, account_id)
+
+    def _principal(self, policy: dict) -> _Principal:
+        user, ak, sk = _user_with_policy(self.mgmt, self.account_id, policy)
+        return _Principal(self.endpoint, self.region, self.account_id, user, ak, sk)
+
+    def _principals(self) -> dict[str, _Principal]:
+        """The four principals every case was measured as."""
+        canonical = self.table["stream_arn"]
+        return {
+            "admin": self._principal(ALLOW_ALL),
+            "noperm": self._principal(NO_PERMISSIONS),
+            "exact": self._principal(_allow_only(canonical)),
+            "deny": self._principal(_allow_all_deny("*", canonical)),
+        }
+
+    @staticmethod
+    def _assert_err(err: dict, code: str, message: str | None, ctx: tuple) -> None:
+        assert err["Code"] == code, (*ctx, err)
+        if message is not None:
+            assert err.get("Message") == message, (*ctx, err)
+
+    # -- #450: another account is AccessDeniedException ----------------------
+
+    def test_stream_arn_in_another_account_is_denied(self):
+        """Another 12-digit account, `abc`, and another account combined with
+        aws-cn, us-west-2 or an unknown label: AccessDeniedException "Access is
+        denied" on all five operations, for every principal, so before the IAM
+        decision and before the partition, region or label is looked at."""
+        for who, p in self._principals().items():
+            for label in ACCOUNT_VARIANTS:
+                arn = self.variants[label]
+                for op in STREAM_OPS + TAG_OPS:
+                    err = p.error(op, arn, self.shard_id)
+                    self._assert_err(err, "AccessDeniedException", ACCESS_IS_DENIED, (who, label, op))
+
+    def test_empty_account_and_missing_region(self):
+        """An empty account field is "Invalid StreamArn" on StreamArn and
+        "Access is denied" on a tag ResourceArn, for every principal. A missing
+        region field is "Invalid StreamArn" on StreamArn for every principal.
+        (On a tag ResourceArn the service answers a missing region field with
+        "Access is denied"; ExtendDB reads the shifted fields as a malformed
+        resource first. That ordering is pre-existing and outside this fix, so
+        it is not asserted here.)"""
+        principals = self._principals()
+        for label in ("account_empty", "field_missing_region"):
+            arn = self.variants[label]
+            for who, p in principals.items():
+                for op in STREAM_OPS:
+                    err = p.error(op, arn, self.shard_id)
+                    self._assert_err(err, "ValidationException", INVALID_STREAM_ARN, (who, label, op))
+        arn = self.variants["account_empty"]
+        for who, p in principals.items():
+            for op in TAG_OPS:
+                err = p.error(op, arn, self.shard_id)
+                self._assert_err(err, "AccessDeniedException", ACCESS_IS_DENIED, (who, "account_empty", op))
+
+    # -- #451: another partition, region or service ---------------------------
+
+    def test_respelled_stream_arn_on_stream_operations_is_invalid(self):
+        """aws-cn, aws-us-gov, DynamoDB, DYNAMODB, us-west-2 and US-EAST-1 in
+        StreamArn: ValidationException "Invalid StreamArn" for every principal,
+        so before the IAM decision."""
+        for who, p in self._principals().items():
+            for label in RESPELLINGS:
+                arn = self.variants[label]
+                for op in STREAM_OPS:
+                    err = p.error(op, arn, self.shard_id)
+                    self._assert_err(err, "ValidationException", INVALID_STREAM_ARN, (who, label, op))
+
+    def test_respelled_stream_arn_on_tag_operations(self):
+        """The same six spellings in a tag ResourceArn: the IAM decision runs
+        first, on the ARN as sent. A no-permissions principal and a principal
+        allowed only the canonical ARN are denied with a message naming the
+        spelling they sent; the admin, and a principal with Allow * plus a Deny
+        on the canonical ARN (which the respelled ARN does not match), get
+        ValidationException "Invalid StreamArn"."""
+        principals = self._principals()
+        for label in RESPELLINGS:
+            arn = self.variants[label]
+            for op in TAG_OPS:
+                for who in ("admin", "deny"):
+                    err = principals[who].error(op, arn, self.shard_id)
+                    self._assert_err(err, "ValidationException", INVALID_STREAM_ARN, (who, label, op))
+                for who in ("noperm", "exact"):
+                    p = principals[who]
+                    err = p.error(op, arn, self.shard_id)
+                    self._assert_err(err, "AccessDeniedException", p.iam_denied(op, arn), (who, label, op))
+
+    def test_malformed_stream_arn(self):
+        """An extra field and a trailing slash: "Invalid StreamArn" on
+        StreamArn; "Provided Arn is not a DynamoDB resource arn: <arn>" on a tag
+        ResourceArn. Every principal, so before the IAM decision."""
+        for who, p in self._principals().items():
+            for label in MALFORMED:
+                arn = self.variants[label]
+                for op in STREAM_OPS:
+                    err = p.error(op, arn, self.shard_id)
+                    self._assert_err(err, "ValidationException", INVALID_STREAM_ARN, (who, label, op))
+                for op in TAG_OPS:
+                    err = p.error(op, arn, self.shard_id)
+                    self._assert_err(
+                        err, "ValidationException", _not_dynamodb_resource(arn), (who, label, op))
+
+    # -- positive control and the Deny on the canonical ARN -------------------
+
+    def test_canonical_stream_arn(self):
+        """The ARN the server issued: served to the admin and to the principal
+        allowed exactly that ARN on all five operations; the no-permissions
+        principal gets the IAM denial naming it; the Deny principal gets the
+        explicit-deny message."""
+        p = self._principals()
+        arn = self.table["stream_arn"]
+        for who in ("admin", "exact"):
+            for op in STREAM_OPS + TAG_OPS:
+                p[who].call(op, arn, self.shard_id)()
+        for op in STREAM_OPS + TAG_OPS:
+            err = p["noperm"].error(op, arn, self.shard_id)
+            self._assert_err(err, "AccessDeniedException", p["noperm"].iam_denied(op, arn), ("noperm", op))
+            err = p["deny"].error(op, arn, self.shard_id)
+            expected = (
+                f"User: arn:aws:iam::{self.account_id}:user/{p['deny'].user} is not authorized "
+                f"to perform: dynamodb:{op} on resource: {arn} with an explicit deny in an "
+                "identity-based policy"
+            )
+            self._assert_err(err, "AccessDeniedException", expected, ("deny", op))
+
+    def test_deny_on_real_stream_arn_is_not_evaded_by_respelling(self):
+        """A principal with Allow * and a per-operation Deny on the canonical
+        stream ARN gets no stream back for any spelling: another account is
+        "Access is denied", the six respellings are "Invalid StreamArn", on
+        every operation."""
+        canonical = self.table["stream_arn"]
+        for op in STREAM_OPS + TAG_OPS:
+            p = self._principal(_allow_all_deny(op, canonical))
+            err = p.error(op, canonical, self.shard_id)
+            self._assert_err(err, "AccessDeniedException", None, ("canonical", op))
+            for label in ACCOUNT_VARIANTS:
+                err = p.error(op, self.variants[label], self.shard_id)
+                self._assert_err(err, "AccessDeniedException", ACCESS_IS_DENIED, (label, op))
+            for label in RESPELLINGS:
+                err = p.error(op, self.variants[label], self.shard_id)
+                self._assert_err(err, "ValidationException", INVALID_STREAM_ARN, (label, op))
+
+    # -- GetRecords: a token the server did not issue -------------------------
+
+    def test_getrecords_iterator_with_respelled_stream_arn_is_invalid(self):
+        """A shard iterator is base64 of `shard|type|seq|ts|stream_arn`. A token
+        carrying a stream ARN the server did not issue (another account, aws-cn,
+        us-west-2, DYNAMODB) was canonicalized and served before; it is now
+        ValidationException "Invalid ShardIterator", the service's answer to a
+        token it did not issue, for an admin and for a no-permissions principal
+        alike."""
+        now = int(time.time())
+
+        def token(arn: str) -> str:
+            return base64.standard_b64encode(
+                f"{self.shard_id}|AFTER_SEQUENCE_NUMBER||{now}|{arn}".encode()
+            ).decode()
+
+        admin = self._principal(ALLOW_ALL)
+        noperm = self._principal(NO_PERMISSIONS)
+        # Control: the same token shape with the issued ARN reads the stream.
+        admin.streams.get_records(ShardIterator=token(self.table["stream_arn"]), Limit=10)
+        for label in ("account_other", "partition_aws_cn", "region_other", "service_DYNAMODB"):
+            for who, p in (("admin", admin), ("noperm", noperm)):
+                with pytest.raises(ClientError) as exc:
+                    p.streams.get_records(ShardIterator=token(self.variants[label]), Limit=10)
+                err = exc.value.response["Error"]
+                assert err == {"Code": "ValidationException", "Message": "Invalid ShardIterator"}, (
+                    who, label, err)
+
+    # -- a label the table never had ------------------------------------------
+
+    def test_unknown_label(self):
+        """IAM decision first (noperm and exact are denied naming the ARN) on all
+        five operations, then ResourceNotFoundException for the admin and the
+        Deny principal (whose Deny names another label). DescribeStream:
+        "Requested resource not found: Stream: <arn> not found" with no trailing
+        period (#451). GetShardIterator: "Requested resource not found: Stream
+        does not exist". Both sentences are the service's (measured 2026-10-23).
+        (The tag operations answer "Requested resource not found: ResourceArn:
+        <arn> not found" on the service; ExtendDB checks only that the table
+        exists, which is pre-existing and outside this fix, so the authorized
+        principals are not asserted on them here.)"""
+        p = self._principals()
+        arn = self.variants["label_unknown"]
+        for op in STREAM_OPS + TAG_OPS:
+            for who in ("noperm", "exact"):
+                err = p[who].error(op, arn, self.shard_id)
+                self._assert_err(err, "AccessDeniedException", p[who].iam_denied(op, arn), (who, op))
+        for op in STREAM_OPS:
+            for who in ("admin", "deny"):
+                err = p[who].error(op, arn, self.shard_id)
+                expected = (
+                    f"Requested resource not found: Stream: {arn} not found"
+                    if op == "DescribeStream"
+                    else "Requested resource not found: Stream does not exist"
+                )
+                self._assert_err(err, "ResourceNotFoundException", expected, (who, op))

From 6b2ac62f798618ff691b0c7055efd28dd8109a30 Mon Sep 17 00:00:00 2001
From: Lee Hannigan <29015211+LeeroyHannigan@users.noreply.github.com>
Date: Sat, 31 Oct 2026 00:45:38 +0000
Subject: [PATCH 02/14] test(streams): say why the hand-built iterator control
 is served

The control in test_getrecords_iterator_with_respelled_stream_arn_is_invalid
reads the stream with a hand-built token carrying the issued ARN. The service
refuses every token it did not issue, so the comment now states that the
control passes only because ExtendDB iterators carry no signature, a gap
that exists on main.
---
 tests/test_stream_arn_scope.py | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/tests/test_stream_arn_scope.py b/tests/test_stream_arn_scope.py
index a5b91a8a6..f08cca526 100644
--- a/tests/test_stream_arn_scope.py
+++ b/tests/test_stream_arn_scope.py
@@ -449,7 +449,12 @@ def token(arn: str) -> str:
 
         admin = self._principal(ALLOW_ALL)
         noperm = self._principal(NO_PERMISSIONS)
-        # Control: the same token shape with the issued ARN reads the stream.
+        # Control for this test only: the same hand-built token with the issued
+        # stream ARN reads the stream, so the refusals below come from the
+        # respelled ARN and not from the token shape. This is not parity: the
+        # service answers "Invalid ShardIterator" to every token it did not
+        # issue, including this one (measured 2026-10-23), while ExtendDB serves
+        # it because its iterators carry no signature. That gap exists on main.
         admin.streams.get_records(ShardIterator=token(self.table["stream_arn"]), Limit=10)
         for label in ("account_other", "partition_aws_cn", "region_other", "service_DYNAMODB"):
             for who, p in (("admin", admin), ("noperm", noperm)):

From 8c8145f3cf52f35f52d8d169ed11e8cdf5d7e20f Mon Sep 17 00:00:00 2001
From: Lee Hannigan <29015211+LeeroyHannigan@users.noreply.github.com>
Date: Sat, 31 Oct 2026 00:45:38 +0000
Subject: [PATCH 03/14] test(streams): expect the measured answer for a
 StreamArn in another account

tests/python/test_streams.py::test_describe_stream_invalid_arn sent a
StreamArn in account 000000000000 and accepted ResourceNotFoundException or
ValidationException. With this change the server refuses another account
before the IAM decision with AccessDeniedException "Access is denied", the
service's answer measured on 2026-10-23, so the test now asserts that code
and message.
---
 tests/python/test_streams.py | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/tests/python/test_streams.py b/tests/python/test_streams.py
index 4ce98acf1..7f055eeda 100755
--- a/tests/python/test_streams.py
+++ b/tests/python/test_streams.py
@@ -165,14 +165,15 @@ def test_describe_stream_basic(self, dynamodb_client, streams_client):
             wait_for_deleted(dynamodb_client, name)
 
     def test_describe_stream_invalid_arn(self, streams_client):
-        """DescribeStream with invalid ARN fails."""
+        """DescribeStream with a StreamArn in another account (000000000000) is
+        refused before the IAM decision with AccessDeniedException "Access is
+        denied", as the service answers (measured 2026-10-23, issue #450). A
+        missing stream in the caller's own account is covered in
+        tests/test_stream_arn_scope.py."""
         with pytest.raises(ClientError) as exc:
             streams_client.describe_stream(StreamArn="arn:aws:dynamodb:us-east-1:000000000000:table/nonexistent/stream/2026-01-01T00:00:00.000")
-        # Could be ResourceNotFoundException or ValidationException
-        assert exc.value.response["Error"]["Code"] in (
-            "ResourceNotFoundException",
-            "ValidationException",
-        )
+        assert exc.value.response["Error"]["Code"] == "AccessDeniedException"
+        assert exc.value.response["Error"]["Message"] == "Access is denied"
 
 
 def _arn_with_another_label(stream_arn: str) -> str:

From 2221d2edd8fa4e7f4662adf38916e6633f35a572 Mon Sep 17 00:00:00 2001
From: Lee Hannigan <29015211+LeeroyHannigan@users.noreply.github.com>
Date: Sat, 31 Oct 2026 00:45:38 +0000
Subject: [PATCH 04/14] test(server): keep the checked ARN's error text out of
 test failure messages

Three test helpers printed the error returned by the stream ARN checks in
their panic messages, and that text carries the account id from the ARN.
They now name the error variant only.
---
 crates/server/src/authz_resource.rs           |  4 +++-
 .../server/src/authz_resource/stream_scope.rs | 21 +++++++++++++++++--
 2 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/crates/server/src/authz_resource.rs b/crates/server/src/authz_resource.rs
index e36e7cc28..d942387db 100644
--- a/crates/server/src/authz_resource.rs
+++ b/crates/server/src/authz_resource.rs
@@ -1211,7 +1211,9 @@ mod tests {
         let err_msg = |op: &str, input: Value| match validate_operation_arns(op, &input, R, A) {
             Err(DynamoDbError::ValidationException(m)) => Some(m),
             Ok(()) => None,
-            other => panic!("unexpected {other:?}"),
+            // The error's text is not printed: it carries the account id
+            // from the checked ARN.
+            Err(_) => panic!("unexpected non-validation error for {op}"),
         };
 
         // Export: only an UNPARSEABLE TableArn is refused before authz, with the
diff --git a/crates/server/src/authz_resource/stream_scope.rs b/crates/server/src/authz_resource/stream_scope.rs
index ae4a73e2e..7222e04cb 100644
--- a/crates/server/src/authz_resource/stream_scope.rs
+++ b/crates/server/src/authz_resource/stream_scope.rs
@@ -105,12 +105,26 @@ mod tests {
         validate_operation_arns(op, &json!({ "StreamArn": arn }), R, A)
     }
 
+    /// Names the result's variant for a failure message without printing the
+    /// error's text, which carries the account id from the checked ARN.
+    fn variant(r: &Result<(), DynamoDbError>) -> &'static str {
+        match r {
+            Ok(()) => "Ok",
+            Err(DynamoDbError::ValidationException(_)) => "ValidationException",
+            Err(DynamoDbError::AccessDeniedException(_)) => "AccessDeniedException",
+            Err(_) => "another error",
+        }
+    }
+
     fn assert_invalid_stream_arn(r: Result<(), DynamoDbError>, what: &str, arn: &str) {
         match r {
             Err(DynamoDbError::ValidationException(m)) => {
                 assert_eq!(m, "Invalid StreamArn", "{what} {arn}");
             }
-            other => panic!("{what} {arn}: expected Invalid StreamArn, got {other:?}"),
+            other => panic!(
+                "{what} {arn}: expected Invalid StreamArn, got {}",
+                variant(&other)
+            ),
         }
     }
 
@@ -119,7 +133,10 @@ mod tests {
             Err(DynamoDbError::AccessDeniedException(m)) => {
                 assert_eq!(m, "Access is denied", "{what} {arn}");
             }
-            other => panic!("{what} {arn}: expected Access is denied, got {other:?}"),
+            other => panic!(
+                "{what} {arn}: expected Access is denied, got {}",
+                variant(&other)
+            ),
         }
     }
 

From 30f3c1928143d170e371fe3bb5012260216669a5 Mon Sep 17 00:00:00 2001
From: Lee Hannigan <29015211+LeeroyHannigan@users.noreply.github.com>
Date: Wed, 28 Oct 2026 21:22:32 +0000
Subject: [PATCH 05/14] fix(server): run stream ARN checks before the dev-mode
 return

authorize_request returned for a dev-mode server before the tag
ResourceArn shape check, validate_operation_arns and the GetRecords
iterator classification. A dev-mode build therefore served a StreamArn
naming another account or partition, and a GetRecords token naming
another account, as the caller's own stream.

The service applies these checks to every principal before the IAM
decision. They now run ahead of the dev-mode return, and dev mode skips
only check_authorization. Each check reads the request body, the
configured region and the caller's account, with no lock, await or
storage access.

tests/test_dev_mode_authorization.py, which run-integration-dev-mode
runs, sends DescribeStream and GetShardIterator with an aws-cn StreamArn
(Invalid StreamArn) and with account 111111111111 (Access is denied),
and GetRecords with a hand-built token naming account 111111111111
(Invalid ShardIterator) and with a token in the pre-upgrade shape (Shard
iterator has expired). A dev-mode build of the previous head answered
200 to all six.
---
 crates/engine/src/streams.rs         |   5 +-
 crates/server/src/request_helpers.rs | 131 +++++++++++++++------------
 tests/test_dev_mode_authorization.py |  97 ++++++++++++++++++++
 3 files changed, 172 insertions(+), 61 deletions(-)

diff --git a/crates/engine/src/streams.rs b/crates/engine/src/streams.rs
index c8ba419bc..e57328de0 100755
--- a/crates/engine/src/streams.rs
+++ b/crates/engine/src/streams.rs
@@ -314,8 +314,9 @@ pub async fn handle_get_records(
     // Cassandra after reading the table. A forged token that pairs an
     // authorized stream ARN with another stream's shard id reads nothing and
     // gets the "stream does not exist" answer. A token with no stream ARN gets
-    // the answer the authorization layer gives it (`classify_shard_iterator`);
-    // the layer is skipped in developer mode, so the engine answers the same.
+    // the answer the authorization layer gives it (`classify_shard_iterator`)
+    // in every build, developer mode included; the engine answers the same for
+    // a caller that reaches it without the layer.
     let Some(stream_arn) = it.stream_arn.as_deref() else {
         return Err(no_stream_arn_error(&it));
     };
diff --git a/crates/server/src/request_helpers.rs b/crates/server/src/request_helpers.rs
index 2a0f00a93..188c466f4 100755
--- a/crates/server/src/request_helpers.rs
+++ b/crates/server/src/request_helpers.rs
@@ -137,6 +137,73 @@ pub(crate) async fn authorize_request(
         }
     }
 
+    // The checks from here to the dev-mode return are input validation, not the
+    // IAM decision. The service applies them to every principal, so they run in
+    // dev mode too, and a dev-mode server refuses the same malformed,
+    // out-of-scope and unissued resources as any other build (#450, #451).
+    //
+    // Tag operations validate the ResourceArn shape before the IAM decision, as
+    // the service does: an index ARN (tags are accepted only on a table or
+    // stream) is rejected with ValidationException for every principal, before
+    // authorization. A table ARN passes; its account, region, and existence
+    // are checked after authorization by the engine tag handler. A stream ARN
+    // must name the caller's account here, before authorization, as the
+    // service does (AccessDeniedException "Access is denied" for every
+    // principal, #450); its partition, service and region are checked by the
+    // engine after authorization, which runs on the ARN as sent (#451).
+    if matches!(
+        operation,
+        "TagResource" | "UntagResource" | "ListTagsOfResource"
+    ) && let Some(arn) = input.get("ResourceArn").and_then(Value::as_str)
+        && !arn.is_empty()
+    {
+        authz_resource::validate_tag_resource_arn_shape(arn, account_id)?;
+    }
+
+    // A StreamArn (DescribeStream, GetShardIterator) or BackupArn
+    // (DescribeBackup, DeleteBackup) that is not a well-formed ARN of that kind,
+    // and an export TableArn that does not parse, are refused with
+    // ValidationException before the IAM decision. Without this, an ARN the
+    // engine resolves one way and authorization reads another lets a Deny on
+    // the real resource be bypassed. A StreamArn must also be in this
+    // deployment's scope (partition, service, region) and the caller's account,
+    // so the stream authorized is the stream the engine reads and a respelled
+    // ARN is never served (#450, #451). A restore's source ARN, and an export
+    // TableArn of another kind, are refused by the engine after the IAM
+    // decision.
+    authz_resource::validate_operation_arns(operation, input, &state.region, account_id)?;
+
+    // GetRecords carries its resource only inside the opaque shard iterator, not
+    // in a request body field, so the iterator is decoded here for the stream
+    // ARN the IAM decision below authorizes against.
+    //
+    // A token that does not decode, or decodes to neither a current token nor
+    // the pre-upgrade shape, is rejected with ValidationException "Invalid
+    // ShardIterator" before authorization. A pre-upgrade token (the four
+    // pre-stream-ARN fields with a parseable timestamp) is answered with
+    // ExpiredIteratorException before authorization, so a consumer reading
+    // across the upgrade renews its iterator instead of failing on the
+    // non-retryable "Invalid ShardIterator". The service answers an iterator it
+    // did not issue the same way whatever the caller's policy (measured
+    // 2026-10-20).
+    let getrecords_stream = if operation == "GetRecords" {
+        match authz_resource::getrecords_resource(input, &state.region, account_id) {
+            authz_resource::GetRecordsResource::Stream(arn) => Some(arn),
+            authz_resource::GetRecordsResource::Expired => {
+                return Err(DynamoDbError::ExpiredIteratorException(
+                    extenddb_engine::SHARD_ITERATOR_EXPIRED_MESSAGE.to_owned(),
+                ));
+            }
+            authz_resource::GetRecordsResource::Invalid => {
+                return Err(DynamoDbError::ValidationException(
+                    "Invalid ShardIterator".to_owned(),
+                ));
+            }
+        }
+    } else {
+        None
+    };
+
     // Developer mode opens authorization for the authenticated caller. SigV4
     // verification already ran upstream, so the request is authenticated; only
     // the IAM policy decision is skipped. The key info is still returned so the
@@ -186,65 +253,11 @@ pub(crate) async fn authorize_request(
         return Ok(authorized_key_info);
     }
 
-    // Tag operations validate the ResourceArn shape before the IAM decision, as
-    // the service does: an index ARN (tags are accepted only on a table or
-    // stream) is rejected with ValidationException for every principal, before
-    // authorization. A table ARN passes; its account, region, and existence
-    // are checked after authorization by the engine tag handler. A stream ARN
-    // must name the caller's account here, before authorization, as the
-    // service does (AccessDeniedException "Access is denied" for every
-    // principal, #450); its partition, service and region are checked by the
-    // engine after authorization, which runs on the ARN as sent (#451).
-    if matches!(
-        operation,
-        "TagResource" | "UntagResource" | "ListTagsOfResource"
-    ) && let Some(arn) = input.get("ResourceArn").and_then(Value::as_str)
-        && !arn.is_empty()
-    {
-        authz_resource::validate_tag_resource_arn_shape(arn, account_id)?;
-    }
-
-    // Every other ARN-bearing field (StreamArn, BackupArn, the export TableArn,
-    // a restore SourceTableArn) must parse to the resource kind the operation
-    // takes, or the request is refused with ValidationException before the IAM
-    // decision. Without this, an ARN the engine resolves one way and
-    // authorization reads another lets a Deny on the real resource be bypassed.
-    // A StreamArn must also be in this deployment's scope (partition, service,
-    // region) and the caller's account, so the stream authorized is the stream
-    // the engine reads and a respelled ARN is never served (#450, #451).
-    authz_resource::validate_operation_arns(operation, input, &state.region, account_id)?;
-
-    // GetRecords carries its resource only inside the opaque shard iterator, not
-    // in a request body field. Decode the iterator for the stream ARN and
-    // authorize against that specific stream, as the service does. The storage
-    // read resolves the shard against that stream as part of the read, so a
-    // token that names an allowed stream but a different stream's shard reads
-    // nothing.
-    //
-    // A token that does not decode, or decodes to neither a current token nor
-    // the pre-upgrade shape, is rejected with ValidationException "Invalid
-    // ShardIterator" before authorization. A pre-upgrade token (the four
-    // pre-stream-ARN fields with a parseable timestamp) is answered with
-    // ExpiredIteratorException before authorization, so a consumer reading
-    // across the upgrade renews its iterator instead of failing on the
-    // non-retryable "Invalid ShardIterator". The service answers an iterator it
-    // did not issue the same way whatever the caller's policy (measured
-    // 2026-10-20).
-    if operation == "GetRecords" {
-        let resource_arn =
-            match authz_resource::getrecords_resource(input, &state.region, account_id) {
-                authz_resource::GetRecordsResource::Stream(arn) => arn,
-                authz_resource::GetRecordsResource::Expired => {
-                    return Err(DynamoDbError::ExpiredIteratorException(
-                        extenddb_engine::SHARD_ITERATOR_EXPIRED_MESSAGE.to_owned(),
-                    ));
-                }
-                authz_resource::GetRecordsResource::Invalid => {
-                    return Err(DynamoDbError::ValidationException(
-                        "Invalid ShardIterator".to_owned(),
-                    ));
-                }
-            };
+    // GetRecords is authorized against the specific stream its iterator names,
+    // as the service does. The storage read resolves the shard against that
+    // stream as part of the read, so a token that names an allowed stream but a
+    // different stream's shard reads nothing.
+    if let Some(resource_arn) = getrecords_stream {
         authorization::check_authorization(
             state.authz_cache.as_ref(),
             identity,
diff --git a/tests/test_dev_mode_authorization.py b/tests/test_dev_mode_authorization.py
index 354fffff8..bc1c6a38b 100644
--- a/tests/test_dev_mode_authorization.py
+++ b/tests/test_dev_mode_authorization.py
@@ -15,6 +15,11 @@
 `BatchGetItem`, `BatchWriteItem`, `TransactGetItems` and `TransactWriteItems`
 failed while every single-item operation succeeded.
 
+Dev mode skips only the IAM decision. The input checks the service applies to
+every principal before that decision still run, so the stream ARN scope
+refusals of `tests/test_stream_arn_scope.py` (#450, #451) are asserted here
+against the dev-mode server too.
+
 These require a server built and started in dev mode, so they are gated on
 EXTENDDB_TEST_DEV_MODE and excluded from the backend-agnostic suite, which runs
 against a production-mode server where these operations are correctly denied.
@@ -22,9 +27,13 @@
 
 from __future__ import annotations
 
+import base64
 import os
+import time
 
+import boto3
 import pytest
+from botocore.config import Config as BotoConfig
 from botocore.exceptions import ClientError
 
 from conftest import wait_for_active
@@ -159,3 +168,91 @@ def test_transact_get_items_is_not_denied(self, dynamodb_client, dev_table):
             ),
         )
         assert resp["Responses"][0]["Item"]["pk"]["S"] == "tg1"
+
+
+OTHER_ACCOUNT = "111111111111"
+
+
+def _error(call, *args) -> dict:
+    with pytest.raises(ClientError) as exc:
+        call(*args)
+    return exc.value.response["Error"]
+
+
+@pytest.fixture()
+def stream_table(dynamodb_client, endpoint_url, unique_table_name):
+    """A table with a stream and one record. Returns the issued stream ARN, a
+    shard id and a streams client with retries off."""
+    dynamodb_client.create_table(
+        TableName=unique_table_name,
+        KeySchema=[{"AttributeName": "pk", "KeyType": "HASH"}],
+        AttributeDefinitions=[{"AttributeName": "pk", "AttributeType": "S"}],
+        BillingMode="PAY_PER_REQUEST",
+        StreamSpecification={"StreamEnabled": True, "StreamViewType": "NEW_IMAGE"},
+    )
+    wait_for_active(dynamodb_client, unique_table_name)
+    dynamodb_client.put_item(TableName=unique_table_name, Item={"pk": {"S": "s1"}})
+    streams = boto3.client(
+        "dynamodbstreams",
+        endpoint_url=endpoint_url,
+        region_name=os.environ.get("AWS_DEFAULT_REGION", "us-east-1"),
+        config=BotoConfig(retries={"max_attempts": 0}),
+    )
+    arn = dynamodb_client.describe_table(TableName=unique_table_name)["Table"]["LatestStreamArn"]
+    shard_id = streams.describe_stream(StreamArn=arn)["StreamDescription"]["Shards"][0]["ShardId"]
+    yield arn, shard_id, streams
+    try:
+        dynamodb_client.delete_table(TableName=unique_table_name)
+    except ClientError:
+        pass
+
+
+class TestDevModeKeepsStreamArnScope:
+    """The stream ARN refusals run before the dev-mode return (#450, #451).
+    The expected answers are the service's, measured 2026-10-23 and tabled in
+    the module docstring of tests/test_stream_arn_scope.py."""
+
+    def test_stream_arn_outside_scope_is_refused(self, stream_table):
+        arn, shard_id, streams = stream_table
+        account = arn.split(":")[4]
+        cases = (
+            (arn.replace("arn:aws:", "arn:aws-cn:", 1),
+             "ValidationException", "Invalid StreamArn"),
+            (arn.replace(f":{account}:", f":{OTHER_ACCOUNT}:", 1),
+             "AccessDeniedException", "Access is denied"),
+        )
+        calls = {
+            "DescribeStream": lambda a: streams.describe_stream(StreamArn=a),
+            "GetShardIterator": lambda a: streams.get_shard_iterator(
+                StreamArn=a, ShardId=shard_id, ShardIteratorType="TRIM_HORIZON"),
+        }
+        for sent, code, message in cases:
+            for op, call in calls.items():
+                err = _error(call, sent)
+                assert (err["Code"], err.get("Message")) == (code, message), (op, sent, err)
+
+    def test_getrecords_token_not_issued_here_is_refused(self, stream_table):
+        """A token is base64 of `shard|type|seq|ts|stream_arn`. One naming
+        another account is "Invalid ShardIterator"; GetShardIterator issues no
+        such token. A token in the pre-upgrade shape (four fields, no stream
+        ARN) is answered "Shard iterator has expired", as in every other build."""
+        arn, shard_id, streams = stream_table
+        account = arn.split(":")[4]
+        now = int(time.time())
+
+        def token(*fields: str) -> str:
+            return base64.standard_b64encode("|".join(fields).encode()).decode()
+
+        def read(t: str):
+            return streams.get_records(ShardIterator=t, Limit=10)
+
+        # Control: the same hand-built shape with the issued ARN is served, so
+        # the refusals below come from the ARN and the shape, not the encoding.
+        read(token(shard_id, "AFTER_SEQUENCE_NUMBER", "", str(now), arn))
+        foreign = arn.replace(f":{account}:", f":{OTHER_ACCOUNT}:", 1)
+        err = _error(read, token(shard_id, "AFTER_SEQUENCE_NUMBER", "", str(now), foreign))
+        assert err == {"Code": "ValidationException", "Message": "Invalid ShardIterator"}, err
+        err = _error(read, token(shard_id, "AFTER_SEQUENCE_NUMBER", "", str(now)))
+        assert err == {
+            "Code": "ExpiredIteratorException", "Message": "Shard iterator has expired"
+        }, err

From c35a7725d8136c1f479bb69d66db37a80c3381dc Mon Sep 17 00:00:00 2001
From: Lee Hannigan <29015211+LeeroyHannigan@users.noreply.github.com>
Date: Wed, 28 Oct 2026 21:31:36 +0000
Subject: [PATCH 06/14] fix(server): check a StreamArn's account before its
 region

The service checks a StreamArn's partition shape, then the account, then
the region (measured on DescribeStream on 2026-10-28). With the region
field empty and another account it answers AccessDeniedException "Access
is denied". ExtendDB answered "Invalid StreamArn" there, because
arn_is_kind required every field to be non-empty before
check_stream_arn_scope compared the account.

check_stream_arn_scope now holds the whole StreamArn check: a stream
resource with a non-empty partition, service and account, then the
caller's account, then the partition, service and region values, where
an empty region is a region other than the server's. arn_is_kind had
only the backup caller left and becomes arn_is_backup.

The seven measured cells are a unit-test table beside respellings() in
stream_scope.rs and wire rows in tests/test_stream_arn_scope.py, whose
module docstring records the measurement. With the previous order the
row for another account with an empty region fails.
---
 crates/server/src/authz_resource.rs           | 56 +++--------
 .../server/src/authz_resource/stream_scope.rs | 98 +++++++++++++++----
 tests/test_stream_arn_scope.py                | 44 ++++++++-
 3 files changed, 136 insertions(+), 62 deletions(-)

diff --git a/crates/server/src/authz_resource.rs b/crates/server/src/authz_resource.rs
index d942387db..522f1b7d0 100644
--- a/crates/server/src/authz_resource.rs
+++ b/crates/server/src/authz_resource.rs
@@ -185,15 +185,6 @@ fn tag_resource_arn(arn: &str, region: &str, account_id: &str) -> String {
     }
 }
 
-/// The resource kind a strictly validated ARN-bearing request field must name.
-/// Only stream and backup fields are validated before authorization; an export
-/// `TableArn` is checked only for parseability (see `validate_operation_arns`).
-#[derive(Clone, Copy)]
-enum ArnKind {
-    Stream,
-    Backup,
-}
-
 /// Messages DynamoDB returns, before the IAM decision, for a request field
 /// whose ARN is not a valid resource ARN of the kind the field requires
 /// (measured live, `live-r2/arn-kinds-live.json`).
@@ -202,11 +193,11 @@ const INVALID_BACKUP_ARN_MESSAGE: &str = "Invalid Backup ARN";
 const INVALID_EXPORT_TABLE_ARN_MESSAGE: &str =
     "One or more parameter values were invalid: tableArn is not a valid ARN";
 
-/// True when `arn` is a well-formed DynamoDB resource ARN of `kind`: it parses
-/// to that kind and its partition, service, region, and account are all
-/// non-empty. The field checks catch an empty-partition ARN
-/// (`arn::dynamodb:...`), which the service rejects with `Invalid StreamArn`.
-fn arn_is_kind(arn: &str, kind: ArnKind) -> bool {
+/// True when `arn` is a well-formed DynamoDB backup ARN: it parses to a backup
+/// and its partition, service, region, and account are all non-empty. A
+/// `StreamArn` takes [`check_stream_arn_scope`] instead, which runs the account
+/// check between its field checks in the order the service does.
+fn arn_is_backup(arn: &str) -> bool {
     let Some(f) = extenddb_core::arn::fields(arn) else {
         return false;
     };
@@ -215,20 +206,11 @@ fn arn_is_kind(arn: &str, kind: ArnKind) -> bool {
         return false;
     }
     matches!(
-        (parse_resource_identity(arn), kind),
-        (
-            Some(ResourceId {
-                sub: Some(Sub::Stream(_)),
-                ..
-            }),
-            ArnKind::Stream
-        ) | (
-            Some(ResourceId {
-                sub: Some(Sub::Backup(_)),
-                ..
-            }),
-            ArnKind::Backup
-        )
+        parse_resource_identity(arn),
+        Some(ResourceId {
+            sub: Some(Sub::Backup(_)),
+            ..
+        })
     )
 }
 
@@ -243,9 +225,11 @@ fn arn_is_kind(arn: &str, kind: ArnKind) -> bool {
 ///   a well-formed stream (resp. backup) ARN of the correct kind, including a
 ///   table ARN, an `xrn:` ARN, or an empty partition, is refused before
 ///   authorization with `Invalid StreamArn` (resp. `Invalid Backup ARN`). A
-///   well-formed stream ARN must also be in this deployment's scope
-///   ([`check_stream_arn_scope`]): another account is `AccessDeniedException`,
-///   another partition, service or region is `Invalid StreamArn`.
+///   stream ARN is checked by [`check_stream_arn_scope`] in the service's
+///   order: its shape, then the account (another account is
+///   `AccessDeniedException` whatever the region field holds), then the
+///   partition, service and region values (another value, or an empty region,
+///   is `Invalid StreamArn`).
 /// - An export `TableArn` is validated loosely: only an UNPARSEABLE value (a
 ///   repeated `table/` segment such as `.../table/a/stream/table/b`, a bare
 ///   `table/x`, or an `xrn:` ARN) is refused before authorization, with
@@ -275,20 +259,12 @@ pub(crate) fn validate_operation_arns(
     match operation {
         "DescribeStream" | "GetShardIterator" => {
             if let Some(arn) = present("StreamArn") {
-                if !arn_is_kind(arn, ArnKind::Stream) {
-                    return Err(DynamoDbError::ValidationException(
-                        INVALID_STREAM_ARN_MESSAGE.to_owned(),
-                    ));
-                }
                 check_stream_arn_scope(arn, region, account_id)?;
             }
         }
         "DescribeBackup" | "DeleteBackup" => {
             if let Some(arn) = present("BackupArn")
-                && !arn_is_kind(
-                    extenddb_core::backup_format::trim_backup_arn(arn),
-                    ArnKind::Backup,
-                )
+                && !arn_is_backup(extenddb_core::backup_format::trim_backup_arn(arn))
             {
                 return Err(DynamoDbError::ValidationException(
                     INVALID_BACKUP_ARN_MESSAGE.to_owned(),
diff --git a/crates/server/src/authz_resource/stream_scope.rs b/crates/server/src/authz_resource/stream_scope.rs
index 7222e04cb..e49208ce5 100644
--- a/crates/server/src/authz_resource/stream_scope.rs
+++ b/crates/server/src/authz_resource/stream_scope.rs
@@ -7,15 +7,18 @@
 
 use extenddb_core::error::DynamoDbError;
 
-use super::{INVALID_STREAM_ARN_MESSAGE, PARTITION, SERVICE};
+use super::{
+    INVALID_STREAM_ARN_MESSAGE, PARTITION, ResourceId, SERVICE, Sub, parse_resource_identity,
+};
 
 /// Refuse a stream ARN whose account is not the caller's with
 /// `AccessDeniedException` "Access is denied". The service answers this before
 /// the IAM decision, for every principal, on `StreamArn` (DescribeStream,
 /// GetShardIterator) and on a tag operation's `ResourceArn` alike, and before
-/// it looks at the partition, region or label (measured live 2026-10-23,
+/// it compares the partition, region or label (measured live 2026-10-23,
 /// probe F2-1: another 12-digit account, `abc`, and another account combined
-/// with `aws-cn`, `us-west-2` or an unknown label).
+/// with `aws-cn`, `us-west-2` or an unknown label). On `StreamArn` an empty
+/// partition is refused before this check ([`check_stream_arn_scope`]).
 pub(super) fn check_stream_arn_account(arn: &str, account_id: &str) -> Result<(), DynamoDbError> {
     let Some(f) = extenddb_core::arn::fields(arn) else {
         return Err(DynamoDbError::ValidationException(
@@ -30,18 +33,24 @@ pub(super) fn check_stream_arn_account(arn: &str, account_id: &str) -> Result<()
     Ok(())
 }
 
-/// Refuse a well-formed `StreamArn` that names a stream outside this
-/// deployment's scope, before the IAM decision, as the service does for
-/// DescribeStream and GetShardIterator (measured live 2026-10-23, probe F2-1,
-/// identical for an admin, a no-permissions user, a user allowed the exact
-/// stream ARN and a user with a Deny on it):
+/// Refuse a `StreamArn` that is not a stream ARN in this deployment's scope,
+/// before the IAM decision, as the service does for DescribeStream and
+/// GetShardIterator (measured live 2026-10-23, probe F2-1, identical for an
+/// admin, a no-permissions user, a user allowed the exact stream ARN and a user
+/// with a Deny on it). The checks run in the service's order (measured on
+/// DescribeStream 2026-10-28):
 ///
-/// - an account other than the caller's: `AccessDeniedException`
-///   ([`check_stream_arn_account`]), checked first;
-/// - a partition other than `aws` (`aws-cn`, `aws-us-gov`), a service other
-///   than `dynamodb` (`DynamoDB`, `DYNAMODB`), or a region other than this
-///   server's (`us-west-2`, `US-EAST-1`): `ValidationException`
-///   `Invalid StreamArn`.
+/// 1. not a stream ARN (a table ARN, an extra or missing field, a trailing
+///    slash), or an empty partition, service or account field:
+///    `ValidationException` `Invalid StreamArn`, for any account;
+/// 2. an account other than the caller's: `AccessDeniedException`
+///    ([`check_stream_arn_account`]), whatever the region field holds;
+/// 3. a partition other than `aws` (`aws-cn`, `aws-us-gov`), a service other
+///    than `dynamodb` (`DynamoDB`, `DYNAMODB`), or a region other than this
+///    server's (empty, `us-west-2`, `US-EAST-1`): `ValidationException`
+///    `Invalid StreamArn`.
+///
+/// An empty service field is not among the measured cells; it stays in step 1.
 ///
 /// The stream engine resolves a stream by table name and label within the
 /// caller's account, so a stream ARN that passes here names exactly the stream
@@ -58,16 +67,27 @@ pub(super) fn check_stream_arn_scope(
     region: &str,
     account_id: &str,
 ) -> Result<(), DynamoDbError> {
-    check_stream_arn_account(arn, account_id)?;
-    let Some(f) = extenddb_core::arn::fields(arn) else {
-        return Err(DynamoDbError::ValidationException(
+    let invalid = || {
+        Err(DynamoDbError::ValidationException(
             INVALID_STREAM_ARN_MESSAGE.to_owned(),
-        ));
+        ))
+    };
+    let is_stream = matches!(
+        parse_resource_identity(arn),
+        Some(ResourceId {
+            sub: Some(Sub::Stream(_)),
+            ..
+        })
+    );
+    let Some(f) = extenddb_core::arn::fields(arn).filter(|_| is_stream) else {
+        return invalid();
     };
+    if f.partition.is_empty() || f.service.is_empty() || f.account.is_empty() {
+        return invalid();
+    }
+    check_stream_arn_account(arn, account_id)?;
     if f.partition != PARTITION || f.service != SERVICE || f.region != region {
-        return Err(DynamoDbError::ValidationException(
-            INVALID_STREAM_ARN_MESSAGE.to_owned(),
-        ));
+        return invalid();
     }
     Ok(())
 }
@@ -152,6 +172,42 @@ mod tests {
         ]
     }
 
+    type Check = fn(Result<(), DynamoDbError>, &str, &str);
+
+    /// The seven StreamArn cells measured live on DescribeStream on 2026-10-28
+    /// (the order table in the module docstring of
+    /// `tests/test_stream_arn_scope.py`), each with the answer it expects: an
+    /// empty partition is "Invalid StreamArn" even in another account, another
+    /// account is "Access is denied" whatever the region field holds, and the
+    /// caller's account with an empty or another region is "Invalid StreamArn".
+    fn measured_order() -> [(String, Check); 7] {
+        let other = |arn: String| arn.replace(A, "111111111111");
+        let no_partition = STREAM.replace("arn:aws:", "arn::");
+        let no_region = STREAM.replace("us-east-1", "");
+        let west = STREAM.replace("us-east-1", "us-west-2");
+        [
+            (other(no_partition.clone()), assert_invalid_stream_arn),
+            (no_partition, assert_invalid_stream_arn),
+            (other(no_region.clone()), assert_access_denied),
+            (other(west.clone()), assert_access_denied),
+            (other(STREAM.to_owned()), assert_access_denied),
+            (no_region, assert_invalid_stream_arn),
+            (west, assert_invalid_stream_arn),
+        ]
+    }
+
+    /// The StreamArn checks run in the measured order: the partition's shape,
+    /// then the account, then the region. GetShardIterator takes the same
+    /// check; the 2026-10-28 cells were measured on DescribeStream.
+    #[test]
+    fn stream_arn_checks_follow_the_measured_order() {
+        for (arn, check) in measured_order() {
+            for op in ["DescribeStream", "GetShardIterator"] {
+                check(stream_arn_check(op, &arn), op, &arn);
+            }
+        }
+    }
+
     /// The service answers a stream ARN in another account with
     /// AccessDeniedException "Access is denied" before the IAM decision, on
     /// StreamArn and on a tag ResourceArn (measured 2026-10-23).
diff --git a/tests/test_stream_arn_scope.py b/tests/test_stream_arn_scope.py
index f08cca526..22f9f0fc6 100644
--- a/tests/test_stream_arn_scope.py
+++ b/tests/test_stream_arn_scope.py
@@ -29,6 +29,20 @@
   | a label the table never had                        | IAM decision first (noperm, exact   |
   |                                                    |   denied); then ResourceNotFound    |
 
+The order of those StreamArn checks, measured on DescribeStream on 2026-10-28
+(20:47 to 20:48 UTC, us-east-1, as an admin, two samples per row): the
+partition's shape first, then the account, then the region.
+
+  | StreamArn                                          | answer                              |
+  |----------------------------------------------------|-------------------------------------|
+  | empty partition, in another account or the         | ValidationException                 |
+  |   caller's                                         |   "Invalid StreamArn"               |
+  | another account with an empty region, with         | AccessDeniedException               |
+  |   us-west-2, or with every other field the         |   "Access is denied"                |
+  |   caller's                                         |                                     |
+  | the caller's account with an empty region or       | ValidationException                 |
+  |   us-west-2                                        |   "Invalid StreamArn"               |
+
 ResourceArn (ListTagsOfResource, TagResource, UntagResource):
 
   | spelling                                          | answer                              |
@@ -199,7 +213,8 @@ def table(auth_env, mgmt, account_id, region):
 
 
 def _variants(stream_arn: str, region: str, account_id: str) -> dict[str, str]:
-    """The spellings measured in probes F2-1 and W1-1, keyed by their names."""
+    """The spellings measured on 2026-10-23 and 2026-10-28 (module docstring),
+    keyed by their names."""
     other_region = "us-west-2" if region != "us-west-2" else "us-east-1"
     table_arn = stream_arn.split("/stream/")[0]
     v = {
@@ -222,6 +237,10 @@ def _variants(stream_arn: str, region: str, account_id: str) -> dict[str, str]:
         f":{account_id}:", f":{OTHER_ACCOUNT}:", 1)
     v["account_other_and_region_other"] = v["account_other"].replace(
         f":{region}:", f":{other_region}:", 1)
+    v["partition_empty"] = stream_arn.replace("arn:aws:", "arn::", 1)
+    v["region_empty"] = stream_arn.replace(f":{region}:", "::", 1)
+    v["account_other_and_partition_empty"] = v["account_other"].replace("arn:aws:", "arn::", 1)
+    v["account_other_and_region_empty"] = v["account_other"].replace(f":{region}:", "::", 1)
     return v
 
 
@@ -344,6 +363,29 @@ def test_empty_account_and_missing_region(self):
                 err = p.error(op, arn, self.shard_id)
                 self._assert_err(err, "AccessDeniedException", ACCESS_IS_DENIED, (who, "account_empty", op))
 
+    def test_partition_then_account_then_region(self):
+        """The seven DescribeStream cells measured on 2026-10-28 (the order
+        table above): an empty partition is "Invalid StreamArn" even in another
+        account; another account is "Access is denied" whatever the region
+        field holds; the caller's account with an empty or another region is
+        "Invalid StreamArn". Measured as an admin. GetShardIterator takes the
+        same check and is asserted with the same answers, not measured for
+        these cells."""
+        admin = self._principal(ALLOW_ALL)
+        cells = (
+            ("account_other_and_partition_empty", "ValidationException", INVALID_STREAM_ARN),
+            ("partition_empty", "ValidationException", INVALID_STREAM_ARN),
+            ("account_other_and_region_empty", "AccessDeniedException", ACCESS_IS_DENIED),
+            ("account_other_and_region_other", "AccessDeniedException", ACCESS_IS_DENIED),
+            ("account_other", "AccessDeniedException", ACCESS_IS_DENIED),
+            ("region_empty", "ValidationException", INVALID_STREAM_ARN),
+            ("region_other", "ValidationException", INVALID_STREAM_ARN),
+        )
+        for label, code, message in cells:
+            for op in STREAM_OPS:
+                err = admin.error(op, self.variants[label], self.shard_id)
+                self._assert_err(err, code, message, ("admin", label, op))
+
     # -- #451: another partition, region or service ---------------------------
 
     def test_respelled_stream_arn_on_stream_operations_is_invalid(self):

From 4ab378e8c31b875e52a7601aba47eeb7b245ecc6 Mon Sep 17 00:00:00 2001
From: Lee Hannigan <29015211+LeeroyHannigan@users.noreply.github.com>
Date: Wed, 28 Oct 2026 21:35:57 +0000
Subject: [PATCH 07/14] docs(server): state the GetRecords and tag stream ARN
 answers

The authz_resource module docs said a GetRecords iterator naming another
account answers "Access is denied" and one naming another partition,
service or region answers "Invalid StreamArn". The code answers both
with ValidationException "Invalid ShardIterator", as the tests expect.
The docs also said every resource ARN is canonicalized, while a tag
operation's stream ARN is authorized as sent and refused by the engine's
validate_resource_arn unless its partition, service, region and account
are this deployment's.

The comments cited measurement files and probe names that are not in
the repository. They now cite the measured tables in the module
docstring of tests/test_stream_arn_scope.py and their dates, except the
GetRecords token answer, which keeps its 2026-10-22 citation as main's
iterator comments do.
---
 crates/server/src/authz_resource.rs           | 47 ++++++++++++-------
 .../server/src/authz_resource/stream_scope.rs | 18 +++----
 tests/test_stream_arn_scope.py                | 10 ++--
 3 files changed, 44 insertions(+), 31 deletions(-)

diff --git a/crates/server/src/authz_resource.rs b/crates/server/src/authz_resource.rs
index 522f1b7d0..d2d807683 100644
--- a/crates/server/src/authz_resource.rs
+++ b/crates/server/src/authz_resource.rs
@@ -36,21 +36,29 @@
 //! service, region, and account of a supplied ARN and act within this
 //! deployment's account, so a caller who respells those fields would otherwise
 //! evade a Deny written against the canonical ARN. Canonicalizing here closes
-//! that bypass: a Deny on the real resource always matches.
+//! that bypass: a Deny on the real resource always matches. A tag operation's
+//! stream ARN is not canonicalized. It is authorized as sent, and the engine's
+//! `validate_resource_arn` refuses it after the IAM decision, before any tag
+//! row is read or written, unless its partition, service, region and account
+//! are this deployment's.
 //!
 //! A stream ARN is held to a stricter rule than canonicalization (issues #450
-//! and #451; measured live 2026-10-23, probes F2-1 and F2-2). Its account must
-//! be the caller's: another account is `AccessDeniedException` "Access is
-//! denied" before the IAM decision, on `StreamArn`, on a tag operation's
-//! `ResourceArn` and inside a `GetRecords` iterator alike
-//! ([`check_stream_arn_account`]). Its partition, service and region must be
-//! this deployment's: on `StreamArn` (DescribeStream, GetShardIterator) and in
-//! a `GetRecords` iterator another spelling is refused before the IAM decision
-//! with `Invalid StreamArn` ([`check_stream_arn_scope`]); on a tag operation's
+//! and #451; measured live 2026-10-23 and 2026-10-28, tabled in the module
+//! docstring of `tests/test_stream_arn_scope.py`). Its account must be the
+//! caller's: another account is `AccessDeniedException` "Access is denied"
+//! before the IAM decision, on `StreamArn` and on a tag operation's
+//! `ResourceArn` ([`check_stream_arn_account`]). Its partition, service and
+//! region must be this deployment's: on `StreamArn` (DescribeStream,
+//! GetShardIterator) another spelling is refused before the IAM decision with
+//! `Invalid StreamArn` ([`check_stream_arn_scope`]); on a tag operation's
 //! `ResourceArn` the IAM decision runs first, on the ARN as sent, and the
-//! engine refuses the spelling afterwards with the same message. So a
-//! respelled stream ARN is never served as the caller's own stream, and a
-//! stream ARN that reaches the engine spells the stream the engine reads.
+//! engine refuses the spelling afterwards with the same message. A `GetRecords`
+//! iterator whose stream ARN is out of scope in any field, the account
+//! included, is refused before the IAM decision with ValidationException
+//! `Invalid ShardIterator` ([`getrecords_resource`]); GetShardIterator issues
+//! no such iterator. So a respelled stream ARN is never served as the
+//! caller's own stream, and a stream ARN that reaches the engine spells the
+//! stream the engine reads.
 //!
 //! Fail-closed: a missing or unparseable resource field never falls back to
 //! `table/*`. It yields the field value verbatim (often empty), which an
@@ -171,9 +179,10 @@ fn backup_arn_field(input: &Value) -> String {
 /// deployment. A stream ARN is authorized as sent: the service evaluates the
 /// IAM decision on the spelling the caller gave (a no-permissions principal's
 /// denial names `arn:aws-cn:...` as sent, and a principal allowed the exact
-/// canonical ARN is denied the `aws-cn` spelling; measured 2026-10-23, probe
-/// F2-1), and the engine refuses another partition, service or region after
-/// authorization with `Invalid StreamArn`. A foreign-service ARN is left
+/// canonical ARN is denied the `aws-cn` spelling; measured 2026-10-23, module
+/// docstring of `tests/test_stream_arn_scope.py`), and the engine refuses
+/// another partition, service or region after authorization with
+/// `Invalid StreamArn`. A foreign-service ARN is left
 /// verbatim so authorization denies it, matching the service (measured, arn-1
 /// table).
 fn tag_resource_arn(arn: &str, region: &str, account_id: &str) -> String {
@@ -215,8 +224,9 @@ fn arn_is_backup(arn: &str) -> bool {
 }
 
 /// Validate ARN-bearing fields before the IAM decision, matching the service
-/// (measured live, `live-r2/arn-kinds-live.json` and
-/// `arn-r3/review/rv3-2/live-matrix.json`).
+/// (measured live, `live-r2/arn-kinds-live.json`; for `StreamArn`, the tables
+/// in the module docstring of `tests/test_stream_arn_scope.py`, measured
+/// 2026-10-23 and 2026-10-28).
 ///
 /// The two field families differ, as the service does:
 ///
@@ -425,7 +435,8 @@ fn backup_wildcard(region: &str, account_id: &str) -> String {
 /// A stream ARN's account is also checked here ([`check_stream_arn_account`]):
 /// the service answers `AccessDeniedException` "Access is denied" for a stream
 /// ARN in another account on ListTagsOfResource and TagResource, to every
-/// principal, before the IAM decision (measured 2026-10-23, probe F2-1). Its
+/// principal, before the IAM decision (measured 2026-10-23, module docstring
+/// of `tests/test_stream_arn_scope.py`). Its
 /// partition, service and region are not checked here: the service runs the
 /// IAM decision on the ARN as sent and refuses `aws-cn`, `DYNAMODB` or
 /// `us-west-2` afterwards with `Invalid StreamArn`, which the engine's
diff --git a/crates/server/src/authz_resource/stream_scope.rs b/crates/server/src/authz_resource/stream_scope.rs
index e49208ce5..e8f0071c7 100644
--- a/crates/server/src/authz_resource/stream_scope.rs
+++ b/crates/server/src/authz_resource/stream_scope.rs
@@ -15,10 +15,11 @@ use super::{
 /// `AccessDeniedException` "Access is denied". The service answers this before
 /// the IAM decision, for every principal, on `StreamArn` (DescribeStream,
 /// GetShardIterator) and on a tag operation's `ResourceArn` alike, and before
-/// it compares the partition, region or label (measured live 2026-10-23,
-/// probe F2-1: another 12-digit account, `abc`, and another account combined
-/// with `aws-cn`, `us-west-2` or an unknown label). On `StreamArn` an empty
-/// partition is refused before this check ([`check_stream_arn_scope`]).
+/// it compares the partition, region or label (measured live 2026-10-23, in
+/// the module docstring of `tests/test_stream_arn_scope.py`: another 12-digit
+/// account, `abc`, and another account combined with `aws-cn`, `us-west-2` or
+/// an unknown label). On `StreamArn` an empty partition is refused before this
+/// check ([`check_stream_arn_scope`]).
 pub(super) fn check_stream_arn_account(arn: &str, account_id: &str) -> Result<(), DynamoDbError> {
     let Some(f) = extenddb_core::arn::fields(arn) else {
         return Err(DynamoDbError::ValidationException(
@@ -35,10 +36,11 @@ pub(super) fn check_stream_arn_account(arn: &str, account_id: &str) -> Result<()
 
 /// Refuse a `StreamArn` that is not a stream ARN in this deployment's scope,
 /// before the IAM decision, as the service does for DescribeStream and
-/// GetShardIterator (measured live 2026-10-23, probe F2-1, identical for an
-/// admin, a no-permissions user, a user allowed the exact stream ARN and a user
-/// with a Deny on it). The checks run in the service's order (measured on
-/// DescribeStream 2026-10-28):
+/// GetShardIterator (measured live 2026-10-23, identical for an admin, a
+/// no-permissions user, a user allowed the exact stream ARN and a user with a
+/// Deny on it). The checks run in the service's order, measured on
+/// DescribeStream on 2026-10-28; both measurements are tabled in the module
+/// docstring of `tests/test_stream_arn_scope.py`:
 ///
 /// 1. not a stream ARN (a table ARN, an extra or missing field, a trailing
 ///    slash), or an empty partition, service or account field:
diff --git a/tests/test_stream_arn_scope.py b/tests/test_stream_arn_scope.py
index 22f9f0fc6..cf81fc023 100644
--- a/tests/test_stream_arn_scope.py
+++ b/tests/test_stream_arn_scope.py
@@ -10,11 +10,11 @@
 service or region, was served as the caller's own stream.
 
 Every expected answer below was measured against live DynamoDB on 2026-10-23
-(12:22 to 12:27 UTC, probes F2-1 and F2-2; UntagResource and the
-GetShardIterator unknown-label recheck in probe W1-1) for four principals: an
-admin (Allow dynamodb:* on *), a user with no stream permissions, a user
-allowed exactly the canonical stream ARN, and a user with Allow * plus a Deny
-on the canonical stream ARN.
+(12:22 to 12:27 UTC, and UntagResource from 14:03 to 14:09 UTC with a recheck
+of GetShardIterator on an unknown label in that second run) for four
+principals: an admin (Allow dynamodb:* on *), a user with no stream
+permissions, a user allowed exactly the canonical stream ARN, and a user with
+Allow * plus a Deny on the canonical stream ARN.
 
 StreamArn (DescribeStream, GetShardIterator), the same for every principal, so
 before the IAM decision:

From 631d6a855012edd0c478d03f8e198c929ae33a7e Mon Sep 17 00:00:00 2001
From: Lee Hannigan <29015211+LeeroyHannigan@users.noreply.github.com>
Date: Wed, 28 Oct 2026 21:36:37 +0000
Subject: [PATCH 08/14] test(server): drop a wrong reason from two test helper
 comments

The variant() doc in stream_scope.rs and a comment in
validate_operation_arns_matches_measured_live_behaviour said the error
text is left out of failure messages because it carries the account id
from the checked ARN. The scope checks answer "Access is denied" and
"Invalid StreamArn", which carry no account id, and the same failure
messages print the ARN. The reason is removed; the helpers are
unchanged.
---
 crates/server/src/authz_resource.rs              | 2 --
 crates/server/src/authz_resource/stream_scope.rs | 3 +--
 2 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/crates/server/src/authz_resource.rs b/crates/server/src/authz_resource.rs
index d2d807683..86b540276 100644
--- a/crates/server/src/authz_resource.rs
+++ b/crates/server/src/authz_resource.rs
@@ -1198,8 +1198,6 @@ mod tests {
         let err_msg = |op: &str, input: Value| match validate_operation_arns(op, &input, R, A) {
             Err(DynamoDbError::ValidationException(m)) => Some(m),
             Ok(()) => None,
-            // The error's text is not printed: it carries the account id
-            // from the checked ARN.
             Err(_) => panic!("unexpected non-validation error for {op}"),
         };
 
diff --git a/crates/server/src/authz_resource/stream_scope.rs b/crates/server/src/authz_resource/stream_scope.rs
index e8f0071c7..08e644e8a 100644
--- a/crates/server/src/authz_resource/stream_scope.rs
+++ b/crates/server/src/authz_resource/stream_scope.rs
@@ -127,8 +127,7 @@ mod tests {
         validate_operation_arns(op, &json!({ "StreamArn": arn }), R, A)
     }
 
-    /// Names the result's variant for a failure message without printing the
-    /// error's text, which carries the account id from the checked ARN.
+    /// Names the result's variant for a failure message.
     fn variant(r: &Result<(), DynamoDbError>) -> &'static str {
         match r {
             Ok(()) => "Ok",

From 7733631c593ec2c86e632e404bfbe9571b25fade Mon Sep 17 00:00:00 2001
From: Lee Hannigan <29015211+LeeroyHannigan@users.noreply.github.com>
Date: Wed, 28 Oct 2026 22:41:19 +0000
Subject: [PATCH 09/14] test(server): pin the empty-service StreamArn cells

check_stream_arn_scope refuses a StreamArn with an empty service field
with ValidationException "Invalid StreamArn" before it compares the
account, so that answer holds in another account too. The service gives
the same answer on DescribeStream and GetShardIterator, in another
account and in the caller's (measured 2026-10-28 at 21:51 UTC, two
samples each).

No test sent an empty-service StreamArn, so removing the empty-service
check left every test passing. measured_order() and
test_partition_then_account_then_region now assert both cells on both
operations, and the order table in tests/test_stream_arn_scope.py lists
them with the time they were measured.
---
 .../server/src/authz_resource/stream_scope.rs   | 17 ++++++++++-------
 tests/test_stream_arn_scope.py                  | 12 ++++++++++--
 2 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/crates/server/src/authz_resource/stream_scope.rs b/crates/server/src/authz_resource/stream_scope.rs
index 08e644e8a..436c5c361 100644
--- a/crates/server/src/authz_resource/stream_scope.rs
+++ b/crates/server/src/authz_resource/stream_scope.rs
@@ -175,20 +175,23 @@ mod tests {
 
     type Check = fn(Result<(), DynamoDbError>, &str, &str);
 
-    /// The seven StreamArn cells measured live on DescribeStream on 2026-10-28
-    /// (the order table in the module docstring of
-    /// `tests/test_stream_arn_scope.py`), each with the answer it expects: an
-    /// empty partition is "Invalid StreamArn" even in another account, another
-    /// account is "Access is denied" whatever the region field holds, and the
-    /// caller's account with an empty or another region is "Invalid StreamArn".
-    fn measured_order() -> [(String, Check); 7] {
+    /// The nine StreamArn cells measured live on 2026-10-28 (the order table in
+    /// the module docstring of `tests/test_stream_arn_scope.py`), each with the
+    /// answer it expects: an empty partition or service is "Invalid StreamArn"
+    /// even in another account, another account is "Access is denied" whatever
+    /// the region field holds, and the caller's account with an empty or
+    /// another region is "Invalid StreamArn".
+    fn measured_order() -> [(String, Check); 9] {
         let other = |arn: String| arn.replace(A, "111111111111");
         let no_partition = STREAM.replace("arn:aws:", "arn::");
+        let no_service = STREAM.replace(":dynamodb:", "::");
         let no_region = STREAM.replace("us-east-1", "");
         let west = STREAM.replace("us-east-1", "us-west-2");
         [
             (other(no_partition.clone()), assert_invalid_stream_arn),
             (no_partition, assert_invalid_stream_arn),
+            (other(no_service.clone()), assert_invalid_stream_arn),
+            (no_service, assert_invalid_stream_arn),
             (other(no_region.clone()), assert_access_denied),
             (other(west.clone()), assert_access_denied),
             (other(STREAM.to_owned()), assert_access_denied),
diff --git a/tests/test_stream_arn_scope.py b/tests/test_stream_arn_scope.py
index cf81fc023..8ad084011 100644
--- a/tests/test_stream_arn_scope.py
+++ b/tests/test_stream_arn_scope.py
@@ -37,6 +37,10 @@
   |----------------------------------------------------|-------------------------------------|
   | empty partition, in another account or the         | ValidationException                 |
   |   caller's                                         |   "Invalid StreamArn"               |
+  | empty service, in another account (21:51 UTC,      | ValidationException                 |
+  |   DescribeStream and GetShardIterator)             |   "Invalid StreamArn"               |
+  | empty service, in the caller's account (21:51      | ValidationException                 |
+  |   UTC, DescribeStream and GetShardIterator)        |   "Invalid StreamArn"               |
   | another account with an empty region, with         | AccessDeniedException               |
   |   us-west-2, or with every other field the         |   "Access is denied"                |
   |   caller's                                         |                                     |
@@ -241,6 +245,8 @@ def _variants(stream_arn: str, region: str, account_id: str) -> dict[str, str]:
     v["region_empty"] = stream_arn.replace(f":{region}:", "::", 1)
     v["account_other_and_partition_empty"] = v["account_other"].replace("arn:aws:", "arn::", 1)
     v["account_other_and_region_empty"] = v["account_other"].replace(f":{region}:", "::", 1)
+    v["service_empty"] = stream_arn.replace(":dynamodb:", "::", 1)
+    v["account_other_and_service_empty"] = v["account_other"].replace(":dynamodb:", "::", 1)
     return v
 
 
@@ -364,8 +370,8 @@ def test_empty_account_and_missing_region(self):
                 self._assert_err(err, "AccessDeniedException", ACCESS_IS_DENIED, (who, "account_empty", op))
 
     def test_partition_then_account_then_region(self):
-        """The seven DescribeStream cells measured on 2026-10-28 (the order
-        table above): an empty partition is "Invalid StreamArn" even in another
+        """The order cells measured on 2026-10-28 (the order table above): an
+        empty partition or service is "Invalid StreamArn" even in another
         account; another account is "Access is denied" whatever the region
         field holds; the caller's account with an empty or another region is
         "Invalid StreamArn". Measured as an admin. GetShardIterator takes the
@@ -375,6 +381,8 @@ def test_partition_then_account_then_region(self):
         cells = (
             ("account_other_and_partition_empty", "ValidationException", INVALID_STREAM_ARN),
             ("partition_empty", "ValidationException", INVALID_STREAM_ARN),
+            ("account_other_and_service_empty", "ValidationException", INVALID_STREAM_ARN),
+            ("service_empty", "ValidationException", INVALID_STREAM_ARN),
             ("account_other_and_region_empty", "AccessDeniedException", ACCESS_IS_DENIED),
             ("account_other_and_region_other", "AccessDeniedException", ACCESS_IS_DENIED),
             ("account_other", "AccessDeniedException", ACCESS_IS_DENIED),

From f3203f94c3e2a5f5aabbb0a3a0c7c9eecb378cb9 Mon Sep 17 00:00:00 2001
From: Lee Hannigan <29015211+LeeroyHannigan@users.noreply.github.com>
Date: Wed, 28 Oct 2026 22:46:57 +0000
Subject: [PATCH 10/14] test(server): pin the tag ResourceArn shape check in
 dev mode

authorize_request runs validate_tag_resource_arn_shape before the
dev-mode return, so a dev-mode server refuses a malformed tag
ResourceArn with the same answer as every other build. No dev-mode case
sent a tag operation, so moving that check back below the return left
every test passing, and a dev-mode server then answered 200 to
TagResource with the issued stream ARN plus a trailing slash and wrote
a tag under that ARN.

The new case in TestDevModeKeepsStreamArnScope sends TagResource and
ListTagsOfResource with that ARN and expects ValidationException "One
or more parameter values were invalid: Provided Arn is not a DynamoDB
resource arn: <arn>", the service's answer for every principal
(measured 2026-10-23).
---
 tests/test_dev_mode_authorization.py | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/tests/test_dev_mode_authorization.py b/tests/test_dev_mode_authorization.py
index bc1c6a38b..12df93eeb 100644
--- a/tests/test_dev_mode_authorization.py
+++ b/tests/test_dev_mode_authorization.py
@@ -231,6 +231,28 @@ def test_stream_arn_outside_scope_is_refused(self, stream_table):
                 err = _error(call, sent)
                 assert (err["Code"], err.get("Message")) == (code, message), (op, sent, err)
 
+    def test_tag_resource_arn_with_trailing_slash_is_refused(self, dynamodb_client, stream_table):
+        """The issued stream ARN with a trailing slash, as a tag operation's
+        ResourceArn, is not a DynamoDB resource ARN: the service answers this
+        for every principal, so the shape check runs before the dev-mode
+        return. Without it TagResource writes a tag under that ARN."""
+        sent = stream_table[0] + "/"
+        expected = {
+            "Code": "ValidationException",
+            "Message": (
+                "One or more parameter values were invalid: "
+                f"Provided Arn is not a DynamoDB resource arn: {sent}"
+            ),
+        }
+        calls = {
+            "TagResource": lambda: dynamodb_client.tag_resource(
+                ResourceArn=sent, Tags=[{"Key": "k", "Value": "v"}]),
+            "ListTagsOfResource": lambda: dynamodb_client.list_tags_of_resource(ResourceArn=sent),
+        }
+        for op, call in calls.items():
+            err = _error(call)
+            assert err == expected, (op, err)
+
     def test_getrecords_token_not_issued_here_is_refused(self, stream_table):
         """A token is base64 of `shard|type|seq|ts|stream_arn`. One naming
         another account is "Invalid ShardIterator"; GetShardIterator issues no

From 0821bae682c1884eace0720e489aa1387f1345a2 Mon Sep 17 00:00:00 2001
From: Lee Hannigan <29015211+LeeroyHannigan@users.noreply.github.com>
Date: Wed, 28 Oct 2026 22:49:52 +0000
Subject: [PATCH 11/14] docs(server): cite the GetShardIterator and
 empty-service cells

The StreamArn order cells were measured on GetShardIterator on
2026-10-28 at 21:51 UTC, and an empty service field in another account
and in the caller's on both operations at the same time, with the
answers the code gives. The comments still said those cells were
measured on DescribeStream only, or not measured.

The order table header in tests/test_stream_arn_scope.py, the doc of
check_stream_arn_scope, the doc of
stream_arn_checks_follow_the_measured_order and the docstring of
test_partition_then_account_then_region now name both operations and
the 21:51 UTC set. Comments only.
---
 .../server/src/authz_resource/stream_scope.rs | 17 ++++++++------
 tests/test_stream_arn_scope.py                | 23 +++++++++++--------
 2 files changed, 23 insertions(+), 17 deletions(-)

diff --git a/crates/server/src/authz_resource/stream_scope.rs b/crates/server/src/authz_resource/stream_scope.rs
index 436c5c361..df406bbf0 100644
--- a/crates/server/src/authz_resource/stream_scope.rs
+++ b/crates/server/src/authz_resource/stream_scope.rs
@@ -38,9 +38,9 @@ pub(super) fn check_stream_arn_account(arn: &str, account_id: &str) -> Result<()
 /// before the IAM decision, as the service does for DescribeStream and
 /// GetShardIterator (measured live 2026-10-23, identical for an admin, a
 /// no-permissions user, a user allowed the exact stream ARN and a user with a
-/// Deny on it). The checks run in the service's order, measured on
-/// DescribeStream on 2026-10-28; both measurements are tabled in the module
-/// docstring of `tests/test_stream_arn_scope.py`:
+/// Deny on it). The checks run in the service's order, measured as an admin on
+/// DescribeStream and GetShardIterator on 2026-10-28; both measurements are
+/// tabled in the module docstring of `tests/test_stream_arn_scope.py`:
 ///
 /// 1. not a stream ARN (a table ARN, an extra or missing field, a trailing
 ///    slash), or an empty partition, service or account field:
@@ -52,7 +52,9 @@ pub(super) fn check_stream_arn_account(arn: &str, account_id: &str) -> Result<()
 ///    server's (empty, `us-west-2`, `US-EAST-1`): `ValidationException`
 ///    `Invalid StreamArn`.
 ///
-/// An empty service field is not among the measured cells; it stays in step 1.
+/// The order was measured on DescribeStream from 20:47 to 20:48 UTC and on
+/// GetShardIterator at 21:51 UTC. An empty service field, measured on both
+/// operations at 21:51 UTC, is step 1's refusal in another account too.
 ///
 /// The stream engine resolves a stream by table name and label within the
 /// caller's account, so a stream ARN that passes here names exactly the stream
@@ -200,9 +202,10 @@ mod tests {
         ]
     }
 
-    /// The StreamArn checks run in the measured order: the partition's shape,
-    /// then the account, then the region. GetShardIterator takes the same
-    /// check; the 2026-10-28 cells were measured on DescribeStream.
+    /// The StreamArn checks run in the measured order on DescribeStream and
+    /// GetShardIterator: an empty partition or service field, then the
+    /// account, then the region (measured on both operations on 2026-10-28,
+    /// GetShardIterator and the empty service at 21:51 UTC).
     #[test]
     fn stream_arn_checks_follow_the_measured_order() {
         for (arn, check) in measured_order() {
diff --git a/tests/test_stream_arn_scope.py b/tests/test_stream_arn_scope.py
index 8ad084011..f96381997 100644
--- a/tests/test_stream_arn_scope.py
+++ b/tests/test_stream_arn_scope.py
@@ -29,9 +29,12 @@
   | a label the table never had                        | IAM decision first (noperm, exact   |
   |                                                    |   denied); then ResourceNotFound    |
 
-The order of those StreamArn checks, measured on DescribeStream on 2026-10-28
-(20:47 to 20:48 UTC, us-east-1, as an admin, two samples per row): the
-partition's shape first, then the account, then the region.
+The order of those StreamArn checks, measured on 2026-10-28 in us-east-1 as an
+admin, two samples per row: the shape first (an empty partition or service
+field), then the account, then the region. The empty-partition, account and
+region rows were measured on DescribeStream from 20:47 to 20:48 UTC and on
+GetShardIterator at 21:51 UTC; the empty-service rows on both operations at
+21:51 UTC.
 
   | StreamArn                                          | answer                              |
   |----------------------------------------------------|-------------------------------------|
@@ -370,13 +373,13 @@ def test_empty_account_and_missing_region(self):
                 self._assert_err(err, "AccessDeniedException", ACCESS_IS_DENIED, (who, "account_empty", op))
 
     def test_partition_then_account_then_region(self):
-        """The order cells measured on 2026-10-28 (the order table above): an
-        empty partition or service is "Invalid StreamArn" even in another
-        account; another account is "Access is denied" whatever the region
-        field holds; the caller's account with an empty or another region is
-        "Invalid StreamArn". Measured as an admin. GetShardIterator takes the
-        same check and is asserted with the same answers, not measured for
-        these cells."""
+        """The order cells measured on 2026-10-28 (the order table above), on
+        DescribeStream and GetShardIterator: an empty partition or service is
+        "Invalid StreamArn" even in another account; another account is
+        "Access is denied" whatever the region field holds; the caller's
+        account with an empty or another region is "Invalid StreamArn".
+        Measured as an admin; GetShardIterator and the empty service at 21:51
+        UTC."""
         admin = self._principal(ALLOW_ALL)
         cells = (
             ("account_other_and_partition_empty", "ValidationException", INVALID_STREAM_ARN),

From 970afdfb117b843e334d9fcd81394e5d57566dc8 Mon Sep 17 00:00:00 2001
From: Lee Hannigan <29015211+LeeroyHannigan@users.noreply.github.com>
Date: Wed, 28 Oct 2026 22:54:05 +0000
Subject: [PATCH 12/14] docs(server): name the exceptions in stream ARN doc
 comments

The authz_resource.rs module docs said every resource ARN produced
there is canonical and that a Deny on the real resource always matches,
while a tag operation's stream ARN is authorized as sent. They now name
that exception, and say that on StreamArn the shape step runs before
the account check, so an empty partition, service or account field is
Invalid StreamArn in any account.

The module docstring of tests/test_stream_arn_scope.py said every
answer below it was measured for four principals; the 2026-10-28 order
table was measured as the admin only, and the docstring now says so.
The TestDevModeKeepsStreamArnScope docstring now says that "Shard
iterator has expired" for a pre-upgrade token is this server's own
upgrade answer, which no service measurement covers. Comments only.
---
 crates/server/src/authz_resource.rs  | 36 +++++++++++++++-------------
 tests/test_dev_mode_authorization.py |  4 +++-
 tests/test_stream_arn_scope.py       | 14 ++++++-----
 3 files changed, 31 insertions(+), 23 deletions(-)

diff --git a/crates/server/src/authz_resource.rs b/crates/server/src/authz_resource.rs
index 86b540276..09fde7c11 100644
--- a/crates/server/src/authz_resource.rs
+++ b/crates/server/src/authz_resource.rs
@@ -29,26 +29,30 @@
 //! | `ListTables` | `ListTables` | `table/*` |
 //! | item/table ops | same | the table ARN (from `TableName`, name or ARN) |
 //!
-//! Every resource ARN produced here is CANONICAL for this deployment: the
-//! partition, service, region, and account are fixed to this server's, and only
-//! the resource identity (table name and optional sub-resource) is taken from
-//! the request. ExtendDB's stream and backup resolvers ignore the partition,
-//! service, region, and account of a supplied ARN and act within this
-//! deployment's account, so a caller who respells those fields would otherwise
-//! evade a Deny written against the canonical ARN. Canonicalizing here closes
-//! that bypass: a Deny on the real resource always matches. A tag operation's
-//! stream ARN is not canonicalized. It is authorized as sent, and the engine's
-//! `validate_resource_arn` refuses it after the IAM decision, before any tag
-//! row is read or written, unless its partition, service, region and account
-//! are this deployment's.
+//! Every resource ARN produced here, except a tag operation's stream ARN, is
+//! CANONICAL for this deployment: the partition, service, region, and account
+//! are fixed to this server's, and only the resource identity (table name and
+//! optional sub-resource) is taken from the request. ExtendDB's stream and
+//! backup resolvers ignore the partition, service, region, and account of a
+//! supplied ARN and act within this deployment's account, so a caller who
+//! respells those fields would otherwise evade a Deny written against the
+//! canonical ARN. Canonicalizing here closes that bypass: a Deny on the real
+//! resource matches every canonical ARN. A tag operation's stream ARN is
+//! authorized as sent, so a Deny on the real stream ARN does not match a
+//! respelled one; the engine's `validate_resource_arn` refuses it after the IAM
+//! decision, before any tag row is read or written, unless its partition,
+//! service, region and account are this deployment's.
 //!
 //! A stream ARN is held to a stricter rule than canonicalization (issues #450
 //! and #451; measured live 2026-10-23 and 2026-10-28, tabled in the module
 //! docstring of `tests/test_stream_arn_scope.py`). Its account must be the
-//! caller's: another account is `AccessDeniedException` "Access is denied"
-//! before the IAM decision, on `StreamArn` and on a tag operation's
-//! `ResourceArn` ([`check_stream_arn_account`]). Its partition, service and
-//! region must be this deployment's: on `StreamArn` (DescribeStream,
+//! caller's: a well-formed stream ARN in another account is
+//! `AccessDeniedException` "Access is denied" before the IAM decision, on
+//! `StreamArn` and on a tag operation's `ResourceArn`
+//! ([`check_stream_arn_account`]). On `StreamArn` the shape step runs first, so
+//! a value that is not a stream ARN, or has an empty partition, service or
+//! account field, is `Invalid StreamArn` in any account. Its partition, service
+//! and region must be this deployment's: on `StreamArn` (DescribeStream,
 //! GetShardIterator) another spelling is refused before the IAM decision with
 //! `Invalid StreamArn` ([`check_stream_arn_scope`]); on a tag operation's
 //! `ResourceArn` the IAM decision runs first, on the ARN as sent, and the
diff --git a/tests/test_dev_mode_authorization.py b/tests/test_dev_mode_authorization.py
index 12df93eeb..734ae0082 100644
--- a/tests/test_dev_mode_authorization.py
+++ b/tests/test_dev_mode_authorization.py
@@ -210,7 +210,9 @@ def stream_table(dynamodb_client, endpoint_url, unique_table_name):
 class TestDevModeKeepsStreamArnScope:
     """The stream ARN refusals run before the dev-mode return (#450, #451).
     The expected answers are the service's, measured 2026-10-23 and tabled in
-    the module docstring of tests/test_stream_arn_scope.py."""
+    the module docstring of tests/test_stream_arn_scope.py, except "Shard
+    iterator has expired" for a pre-upgrade token, which is this server's
+    upgrade answer."""
 
     def test_stream_arn_outside_scope_is_refused(self, stream_table):
         arn, shard_id, streams = stream_table
diff --git a/tests/test_stream_arn_scope.py b/tests/test_stream_arn_scope.py
index f96381997..e2c19213c 100644
--- a/tests/test_stream_arn_scope.py
+++ b/tests/test_stream_arn_scope.py
@@ -9,12 +9,14 @@
 StreamArn in another account, partition or region, or with an upper-cased
 service or region, was served as the caller's own stream.
 
-Every expected answer below was measured against live DynamoDB on 2026-10-23
-(12:22 to 12:27 UTC, and UntagResource from 14:03 to 14:09 UTC with a recheck
-of GetShardIterator on an unknown label in that second run) for four
-principals: an admin (Allow dynamodb:* on *), a user with no stream
-permissions, a user allowed exactly the canonical stream ARN, and a user with
-Allow * plus a Deny on the canonical stream ARN.
+Every expected answer in the StreamArn and ResourceArn tables below was
+measured against live DynamoDB on 2026-10-23 (12:22 to 12:27 UTC, and
+UntagResource from 14:03 to 14:09 UTC with a recheck of GetShardIterator on an
+unknown label in that second run) for four principals: an admin (Allow
+dynamodb:* on *), a user with no stream permissions, a user allowed exactly
+the canonical stream ARN, and a user with Allow * plus a Deny on the canonical
+stream ARN. The order table between them was measured on 2026-10-28 as the
+admin only.
 
 StreamArn (DescribeStream, GetShardIterator), the same for every principal, so
 before the IAM decision:

From 5ebcfb4714834d71ba2e79cfc6d29bfe66a8ffa5 Mon Sep 17 00:00:00 2001
From: Lee Hannigan <29015211+LeeroyHannigan@users.noreply.github.com>
Date: Sat, 31 Oct 2026 10:12:59 +0000
Subject: [PATCH 13/14] refactor(arn): check stream and tag ARN scope with one
 predicate

check_stream_arn_scope in the server and validate_resource_arn in the
engine tag handler each compared an ARN's partition, service and region
with this deployment's. The tag path depends on the engine copy: a tag
operation's stream ARN is authorized as sent, so a Deny on the canonical
stream ARN does not match an aws-cn or DYNAMODB spelling, and only the
engine check refuses it before a tag row is written. Only the tests kept
the two copies in step.

Both now call ArnFields::in_deployment in extenddb_core::arn. The tag
handler's refusal moves into deployment_scope_error, a function with no
storage access, so a unit test can reach it. Unit tests in core, in
stream_scope.rs and in tagging.rs check each caller's answer against the
predicate for the aws-cn, aws-us-gov, DynamoDB, DYNAMODB, us-west-2,
US-EAST-1 and empty-region spellings. No answer changes.
---
 crates/core/src/arn.rs                        |  44 ++++++-
 crates/engine/src/tagging.rs                  | 107 +++++++++++++-----
 .../server/src/authz_resource/stream_scope.rs |  29 ++++-
 3 files changed, 146 insertions(+), 34 deletions(-)

diff --git a/crates/core/src/arn.rs b/crates/core/src/arn.rs
index 408d368cc..cdcbf0f2c 100644
--- a/crates/core/src/arn.rs
+++ b/crates/core/src/arn.rs
@@ -14,8 +14,8 @@
 //!
 //! [`parse`] requires the literal `arn:` prefix and five colon-separated fields.
 //! The partition, service, region, and account are captured but not constrained
-//! to any value: a caller that pins them to its deployment does so itself, and a
-//! caller that ignores them (authorization canonicalizes every supplied ARN to
+//! to any value: a caller that pins them to its deployment does so itself
+//! ([`ArnFields::in_deployment`]), and a caller that ignores them (authorization canonicalizes every supplied ARN to
 //! its own deployment) reads only the table and sub-resource.
 
 /// A table sub-resource: a secondary index, a stream, or a backup.
@@ -49,6 +49,18 @@ pub struct TableResource {
     pub sub: Option<SubResource>,
 }
 
+impl ArnFields<'_> {
+    /// True when the partition is `aws`, the service `dynamodb` and the region
+    /// `region`, each compared exactly. Every ARN the server issues carries
+    /// these three values. The server's `StreamArn` scope check and the engine's
+    /// tag `ResourceArn` check both refuse an ARN for which this is false; the
+    /// account and resource are not compared.
+    #[must_use]
+    pub fn in_deployment(&self, region: &str) -> bool {
+        self.partition == "aws" && self.service == "dynamodb" && self.region == region
+    }
+}
+
 /// Split a string into the five ARN fields after the `arn:` prefix.
 ///
 /// The resource field keeps every `:` and `/` it contains, so a stream ARN's
@@ -148,6 +160,34 @@ mod tests {
         assert_eq!(f.resource, "table/T");
     }
 
+    #[test]
+    fn in_deployment_compares_partition_service_and_region_exactly() {
+        let arn = "arn:aws:dynamodb:us-east-1:1:table/T/stream/2026-10-20T16:17:40.188";
+        assert!(fields(arn).unwrap().in_deployment("us-east-1"));
+        // The account and the resource are not compared.
+        assert!(
+            fields("arn:aws:dynamodb:us-east-1:2:table/U")
+                .unwrap()
+                .in_deployment("us-east-1")
+        );
+        for other in [
+            arn.replace("arn:aws:", "arn:aws-cn:"),
+            arn.replace("arn:aws:", "arn:aws-us-gov:"),
+            arn.replace("arn:aws:", "arn::"),
+            arn.replace(":dynamodb:", ":DynamoDB:"),
+            arn.replace(":dynamodb:", ":DYNAMODB:"),
+            arn.replace(":dynamodb:", ":s3:"),
+            arn.replace("us-east-1", "us-west-2"),
+            arn.replace("us-east-1", "US-EAST-1"),
+            arn.replace("us-east-1", ""),
+        ] {
+            assert!(
+                !fields(&other).unwrap().in_deployment("us-east-1"),
+                "{other}"
+            );
+        }
+    }
+
     #[test]
     fn parses_table_index_stream_backup() {
         assert_eq!(
diff --git a/crates/engine/src/tagging.rs b/crates/engine/src/tagging.rs
index 669b386aa..d9b674386 100755
--- a/crates/engine/src/tagging.rs
+++ b/crates/engine/src/tagging.rs
@@ -41,6 +41,36 @@ fn tag_subresource_is_stream(resource: &str) -> bool {
         .is_some_and(|tail| tail.split('/').nth(1) == Some("stream"))
 }
 
+/// The refusal for a tag operation's ARN whose partition, service or region is
+/// not this deployment's, or `None` when all three are. The rule is
+/// [`extenddb_core::arn::ArnFields::in_deployment`], the predicate the server's
+/// `StreamArn` scope check uses.
+///
+/// A stream ARN with another partition, service or region reaches this point
+/// for an authorized principal (the server authorizes a tag operation's stream
+/// ARN as sent, and refuses another account before authorization). The service
+/// answers "Invalid StreamArn" here (measured live 2026-10-23,
+/// ListTagsOfResource and TagResource for an admin and for a principal with
+/// Allow * plus a Deny on the canonical ARN). The service's table message
+/// differs (measured live).
+fn deployment_scope_error(
+    fields: &extenddb_core::arn::ArnFields<'_>,
+    arn: &str,
+    region: &str,
+) -> Option<DynamoDbError> {
+    if fields.in_deployment(region) {
+        return None;
+    }
+    if tag_subresource_is_stream(fields.resource) {
+        return Some(DynamoDbError::ValidationException(
+            "Invalid StreamArn".to_owned(),
+        ));
+    }
+    Some(DynamoDbError::ValidationException(format!(
+        "Invalid TableArn: Invalid ResourceArn provided as input {arn}"
+    )))
+}
+
 /// Extract the table name from a `DynamoDB` table ARN, using the one shared
 /// resource parser ([`extenddb_core::arn::fields`]) so this layer splits an ARN
 /// the same way authorization and the engine stream resolver do.
@@ -84,25 +114,19 @@ async fn validate_resource_arn(arn: &str, ctx: &OperationContext) -> Result<(),
 
     // A string that is not shaped like an ARN (fewer than the five
     // colon-separated fields) is denied rather than reported as malformed.
-    let Some(extenddb_core::arn::ArnFields {
-        partition,
-        service,
-        region,
-        account,
-        resource,
-    }) = extenddb_core::arn::fields(arn)
-    else {
+    let Some(fields) = extenddb_core::arn::fields(arn) else {
         return Err(DynamoDbError::AccessDeniedException(
             "Access is denied".to_owned(),
         ));
     };
+    let resource = fields.resource;
 
     if !resource.starts_with("table/") {
         // A DynamoDB ARN whose resource is not a table (a bare index, an
         // export, and so on) is reported as not a DynamoDB resource. An ARN for
         // another service is denied rather than reported as malformed, as the
         // service does.
-        if service == "dynamodb" {
+        if fields.service == "dynamodb" {
             return Err(DynamoDbError::ValidationException(format!(
                 "One or more parameter values were invalid: \
                  Provided Arn is not a DynamoDB resource arn: {arn}"
@@ -129,28 +153,14 @@ async fn validate_resource_arn(arn: &str, ctx: &OperationContext) -> Result<(),
         )));
     }
 
-    if account != ctx.account_id.as_ref() {
+    if fields.account != ctx.account_id.as_ref() {
         return Err(DynamoDbError::AccessDeniedException(
             "Access is denied".to_owned(),
         ));
     }
 
-    if partition != "aws" || service != "dynamodb" || region != ctx.region.as_ref() {
-        // A stream ARN with another partition, service or region reaches this
-        // point for an authorized principal (the server authorizes a tag
-        // operation's stream ARN as sent, and refuses another account before
-        // authorization). The service answers "Invalid StreamArn" here
-        // (measured live 2026-10-23, ListTagsOfResource and TagResource for an
-        // admin and for a principal with Allow * plus a Deny on the canonical
-        // ARN). The service's table message differs (measured live).
-        if tag_subresource_is_stream(resource) {
-            return Err(DynamoDbError::ValidationException(
-                "Invalid StreamArn".to_owned(),
-            ));
-        }
-        return Err(DynamoDbError::ValidationException(format!(
-            "Invalid TableArn: Invalid ResourceArn provided as input {arn}"
-        )));
+    if let Some(err) = deployment_scope_error(&fields, arn, &ctx.region) {
+        return Err(err);
     }
 
     let table_name = extract_table_name_from_arn(arn).ok_or_else(|| {
@@ -284,7 +294,50 @@ pub async fn handle_list_tags_of_resource(
 
 #[cfg(test)]
 mod tests {
-    use super::{tag_subresource_not_dynamodb_resource, tag_subresource_not_table_or_stream};
+    use super::{
+        deployment_scope_error, tag_subresource_not_dynamodb_resource,
+        tag_subresource_not_table_or_stream,
+    };
+    use extenddb_core::error::DynamoDbError;
+
+    /// The tag handler refuses exactly the ARNs the shared predicate puts
+    /// outside this deployment, the predicate the server's StreamArn scope
+    /// check uses (`stream_arn_scope_uses_the_shared_predicate` in
+    /// `crates/server/src/authz_resource/stream_scope.rs`), with the
+    /// service's message for a stream and for a table.
+    #[test]
+    fn deployment_scope_uses_the_shared_predicate() {
+        const R: &str = "us-east-1";
+        let stream =
+            "arn:aws:dynamodb:us-east-1:964157134968:table/T/stream/2026-10-20T16:17:40.188";
+        let table = "arn:aws:dynamodb:us-east-1:964157134968:table/T";
+        for base in [stream, table] {
+            for arn in [
+                base.to_owned(),
+                base.replace("arn:aws:", "arn:aws-cn:"),
+                base.replace("arn:aws:", "arn:aws-us-gov:"),
+                base.replace(":dynamodb:", ":DynamoDB:"),
+                base.replace(":dynamodb:", ":DYNAMODB:"),
+                base.replace("us-east-1", "us-west-2"),
+                base.replace("us-east-1", "US-EAST-1"),
+                base.replace("us-east-1", ""),
+            ] {
+                let fields = extenddb_core::arn::fields(&arn).unwrap();
+                let err = deployment_scope_error(&fields, &arn, R);
+                assert_eq!(err.is_none(), fields.in_deployment(R), "{arn}");
+                let expected = if base == stream {
+                    "Invalid StreamArn".to_owned()
+                } else {
+                    format!("Invalid TableArn: Invalid ResourceArn provided as input {arn}")
+                };
+                match err {
+                    None => assert_eq!(arn, base, "only the canonical ARN passes"),
+                    Some(DynamoDbError::ValidationException(m)) => assert_eq!(m, expected),
+                    Some(_) => panic!("{arn}: expected ValidationException"),
+                }
+            }
+        }
+    }
 
     #[test]
     fn tag_subresource_classification() {
diff --git a/crates/server/src/authz_resource/stream_scope.rs b/crates/server/src/authz_resource/stream_scope.rs
index df406bbf0..d2a108315 100644
--- a/crates/server/src/authz_resource/stream_scope.rs
+++ b/crates/server/src/authz_resource/stream_scope.rs
@@ -7,9 +7,7 @@
 
 use extenddb_core::error::DynamoDbError;
 
-use super::{
-    INVALID_STREAM_ARN_MESSAGE, PARTITION, ResourceId, SERVICE, Sub, parse_resource_identity,
-};
+use super::{INVALID_STREAM_ARN_MESSAGE, ResourceId, Sub, parse_resource_identity};
 
 /// Refuse a stream ARN whose account is not the caller's with
 /// `AccessDeniedException` "Access is denied". The service answers this before
@@ -50,7 +48,9 @@ pub(super) fn check_stream_arn_account(arn: &str, account_id: &str) -> Result<()
 /// 3. a partition other than `aws` (`aws-cn`, `aws-us-gov`), a service other
 ///    than `dynamodb` (`DynamoDB`, `DYNAMODB`), or a region other than this
 ///    server's (empty, `us-west-2`, `US-EAST-1`): `ValidationException`
-///    `Invalid StreamArn`.
+///    `Invalid StreamArn`. This is the rule the engine applies to a tag
+///    operation's `ResourceArn`, through the one predicate
+///    [`extenddb_core::arn::ArnFields::in_deployment`].
 ///
 /// The order was measured on DescribeStream from 20:47 to 20:48 UTC and on
 /// GetShardIterator at 21:51 UTC. An empty service field, measured on both
@@ -90,7 +90,7 @@ pub(super) fn check_stream_arn_scope(
         return invalid();
     }
     check_stream_arn_account(arn, account_id)?;
-    if f.partition != PARTITION || f.service != SERVICE || f.region != region {
+    if !f.in_deployment(region) {
         return invalid();
     }
     Ok(())
@@ -278,6 +278,25 @@ mod tests {
         );
     }
 
+    /// In the caller's account, the StreamArn check refuses exactly the stream
+    /// ARNs the shared predicate puts outside this deployment, the predicate the
+    /// engine tag handler applies to a tag ResourceArn
+    /// (`deployment_scope_error` in `crates/engine/src/tagging.rs`).
+    #[test]
+    fn stream_arn_scope_uses_the_shared_predicate() {
+        let mut arns = respellings().to_vec();
+        arns.push(STREAM.replace("us-east-1", ""));
+        arns.push(STREAM.to_owned());
+        for arn in &arns {
+            let f = extenddb_core::arn::fields(arn).unwrap();
+            assert_eq!(
+                check_stream_arn_scope(arn, R, A).is_ok(),
+                f.in_deployment(R),
+                "{arn}"
+            );
+        }
+    }
+
     /// Account is checked before the partition, service and region (measured
     /// 2026-10-23: another account combined with aws-cn or us-west-2 is
     /// "Access is denied" on every operation).

From c2efc385f8bae4ca9368559448fe958f55fcbaac Mon Sep 17 00:00:00 2001
From: Lee Hannigan <29015211+LeeroyHannigan@users.noreply.github.com>
Date: Thu, 5 Nov 2026 10:01:06 +0000
Subject: [PATCH 14/14] fix(server): answer an empty account without a catalog
 lookup

A tag operation whose ResourceArn holds a stream ARN with an empty account
field reaches cross_account::refuse, which looked the empty account up in
the catalog. Cassandra refuses an empty partition key. The request then
failed with InternalServerError "Internal error during authorization",
where the service and the other backends answer AccessDeniedException
"Access is denied". The Cassandra pytest job found it in
test_stream_arn_scope.py::TestStreamArnScope::test_empty_account_and_missing_region.

account_in_catalog now answers that an empty account is not held, without
a lookup.
---
 crates/server/src/authz_resource/cross_account.rs | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/crates/server/src/authz_resource/cross_account.rs b/crates/server/src/authz_resource/cross_account.rs
index f718ca390..f3b1949f2 100644
--- a/crates/server/src/authz_resource/cross_account.rs
+++ b/crates/server/src/authz_resource/cross_account.rs
@@ -207,7 +207,15 @@ pub(crate) fn refusal(
 /// True when this deployment's catalog holds `account`. A deployment without
 /// a catalog store knows no other account. A lookup failure fails the request
 /// (it is refused either way) with the authorization layer's internal error.
+///
+/// An empty account field names no account the catalog can hold, so it is
+/// answered without a lookup. Cassandra refuses an empty partition key, and
+/// the lookup would fail the request with that internal error where every
+/// other backend answers that the account is not held.
 async fn account_in_catalog(state: &AppState, account: &str) -> Result<bool, DynamoDbError> {
+    if account.is_empty() {
+        return Ok(false);
+    }
     let Some(store) = state.catalog_store.as_ref() else {
         return Ok(false);
     };