class Grant

Language	Type name
.NET	Amazon.CDK.AWS.IAM.Grant
Java	software.amazon.awscdk.services.iam.Grant
Python	aws_cdk.aws_iam.Grant
TypeScript (source)	@aws-cdk/aws-iam » Grant

Implements IDependable

Result of a grant() operation.

This class is not instantiable by consumers on purpose, so that they will be required to call the Grant factory functions.

Example

declare const instance: ec2.Instance;
declare const volume: ec2.Volume;

const attachGrant = volume.grantAttachVolumeByResourceTag(instance.grantPrincipal, [instance]);
const detachGrant = volume.grantDetachVolumeByResourceTag(instance.grantPrincipal, [instance]);

Properties

Name	Type	Description
success	boolean	Whether the grant operation was successful.
principalStatement?	PolicyStatement	The statement that was added to the principal's policy.
resourceStatement?	PolicyStatement	The statement that was added to the resource policy.

---

success

Type: boolean

Whether the grant operation was successful.

---

principalStatement?

Type: PolicyStatement (optional)

The statement that was added to the principal's policy.

Can be accessed to (e.g.) add additional conditions to the statement.

---

resourceStatement?

Type: PolicyStatement (optional)

The statement that was added to the resource policy.

Can be accessed to (e.g.) add additional conditions to the statement.

Methods

Name	Description
applyBefore(...constructs)	Make sure this grant is applied before the given constructs are deployed.
assertSuccess()	Throw an error if this grant wasn't successful.
static addToPrincipal(options)	Try to grant the given permissions to the given principal.
static addToPrincipalAndResource(options)	Add a grant both on the principal and on the resource.
static addToPrincipalOrResource(options)	Grant the given permissions to the principal.
static drop(grantee, _intent)	Returns a "no-op" Grant object which represents a "dropped grant".

---

applyBefore(...constructs)

public applyBefore(...constructs: IConstruct[]): void

Parameters

• constructs IConstruct

Make sure this grant is applied before the given constructs are deployed.

The same as construct.node.addDependency(grant), but slightly nicer to read.

---

assertSuccess()

public assertSuccess(): void

Throw an error if this grant wasn't successful.

---

static addToPrincipal(options)

public static addToPrincipal(options: GrantOnPrincipalOptions): Grant

Parameters

• options GrantOnPrincipalOptions

Returns

• Grant

Try to grant the given permissions to the given principal.

Absence of a principal leads to a warning, but failing to add the permissions to a present principal is not an error.

---

static addToPrincipalAndResource(options)

public static addToPrincipalAndResource(options: GrantOnPrincipalAndResourceOptions): Grant

Parameters

• options GrantOnPrincipalAndResourceOptions

Returns

• Grant

Add a grant both on the principal and on the resource.

As long as any principal is given, granting on the principal may fail (in case of a non-identity principal), but granting on the resource will never fail.

Statement will be the resource statement.

---

static addToPrincipalOrResource(options)

public static addToPrincipalOrResource(options: GrantWithResourceOptions): Grant

Parameters

• options GrantWithResourceOptions

Returns

• Grant

Grant the given permissions to the principal.

The permissions will be added to the principal policy primarily, falling back to the resource policy if necessary. The permissions must be granted somewhere.

• Trying to grant permissions to a principal that does not admit adding to the principal policy while not providing a resource with a resource policy is an error.
• Trying to grant permissions to an absent principal (possible in the case of imported resources) leads to a warning being added to the resource construct.

---

static drop(grantee, _intent)

public static drop(grantee: IGrantable, _intent: string): Grant

Parameters

• grantee IGrantable — The intended grantee.
• _intent string — The user's intent (will be ignored at the moment).

Returns

• Grant

Returns a "no-op" Grant object which represents a "dropped grant".

This can be used for e.g. imported resources where you may not be able to modify the resource's policy or some underlying policy which you don't know about.