title: How to reference secondary indexes in serverless.yml?
body: <p>I'm very unclear on how references or variables work with CloudFormation. </p>
  
  <p>Currently my iAmRole in my serverless.yml looks like:</p>
  
  <pre><code>  iamRoleStatements:
      - Effect: Allow
        Action:
          - dynamodb:DescribeTable
          - dynamodb:Query
          - dynamodb:Scan
          - dynamodb:GetItem
          - dynamodb:PutItem
          - dynamodb:UpdateItem
          - dynamodb:DeleteItem
        # Restrict our IAM role permissions to
        # the specific table for the stage
        Resource:
          - "Fn::GetAtt": [ ReportsTable, Arn ]
  </code></pre>
  
  <p>ReportsTable is a table created in another file that looks like:</p>
  
  <pre><code>Resources:
    ReportsTable:
      Type: AWS::DynamoDB::Table
      Properties:
      ...
      LocalSecondaryIndexes:
          - IndexName: typeId-accessToken-index
            KeySchema:
            - AttributeName: typeId
              KeyType: HASH
              ...etc
  </code></pre>
  
  <p>I understand that the second value in the Fn::GetAtt array is referencing an attributename, but I don't understand where Arn is coming from. It seems like a variable but it's not defined anywhere.</p>
  
  <p>Ultimately I need to add another Effect, Action, Resource block referencing the local secondary index I have created, but I'm lost as to where to start.</p>
  
  <p>Edit: Looks like Arn comes from dynamoDB tables return values (<a href="https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-dynamodb-table.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-dynamodb-table.html</a>)</p>
  
  <p>Edit2: Okay so I now have the format <code>arn:aws:dynamodb:region:account-id:table/table-name/index/*</code> from the <a href="https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/api-permissions-reference.html" rel="nofollow noreferrer">permissions reference docs</a>, testing now. </p>