Grant

class aws_cdk.aws_iam.Grant(*args: Any, **kwargs)

Bases: object

Result of a grant() operation.

This class is not instantiable by consumers on purpose, so that they will be required to call the Grant factory functions.

ExampleMetadata:

infused

Example:

# instance: ec2.Instance
# volume: ec2.Volume


attach_grant = volume.grant_attach_volume_by_resource_tag(instance.grant_principal, [instance])
detach_grant = volume.grant_detach_volume_by_resource_tag(instance.grant_principal, [instance])

Methods

apply_before(*constructs)

Make sure this grant is applied before the given constructs are deployed.

The same as construct.node.addDependency(grant), but slightly nicer to read.

Parameters:

constructs (IConstruct) –

Return type:

None

assert_success()

Throw an error if this grant wasn’t successful.

Return type:

None

Attributes

principal_statement

The statement that was added to the principal’s policy.

Can be accessed to (e.g.) add additional conditions to the statement.

resource_statement

The statement that was added to the resource policy.

Can be accessed to (e.g.) add additional conditions to the statement.

success

Whether the grant operation was successful.

Static Methods

classmethod add_to_principal(*, scope=None, actions, grantee, resource_arns)

Try to grant the given permissions to the given principal.

Absence of a principal leads to a warning, but failing to add the permissions to a present principal is not an error.

Parameters:

  • scope (Optional[IConstruct]) – Construct to report warnings on in case grant could not be registered. Default: - the construct in which this construct is defined

  • actions (Sequence[str]) – The actions to grant.

  • grantee (IGrantable) – The principal to grant to. Default: if principal is undefined, no work is done.

  • resource_arns (Sequence[str]) – The resource ARNs to grant to.

Return type:

Grant

classmethod add_to_principal_and_resource(*, resource, resource_policy_principal=None, resource_self_arns=None, actions, grantee, resource_arns)

Add a grant both on the principal and on the resource.

As long as any principal is given, granting on the principal may fail (in case of a non-identity principal), but granting on the resource will never fail.

Statement will be the resource statement.

Parameters:

  • resource (IResourceWithPolicy) – The resource with a resource policy. The statement will always be added to the resource policy.

  • resource_policy_principal (Optional[IPrincipal]) – The principal to use in the statement for the resource policy. Default: - the principal of the grantee will be used

  • resource_self_arns (Optional[Sequence[str]]) – When referring to the resource in a resource policy, use this as ARN. (Depending on the resource type, this needs to be ‘*’ in a resource policy). Default: Same as regular resource ARNs

  • actions (Sequence[str]) – The actions to grant.

  • grantee (IGrantable) – The principal to grant to. Default: if principal is undefined, no work is done.

  • resource_arns (Sequence[str]) – The resource ARNs to grant to.

Return type:

Grant

classmethod add_to_principal_or_resource(*, resource, resource_self_arns=None, actions, grantee, resource_arns)

Grant the given permissions to the principal.

The permissions will be added to the principal policy primarily, falling back to the resource policy if necessary. The permissions must be granted somewhere.

  • Trying to grant permissions to a principal that does not admit adding to the principal policy while not providing a resource with a resource policy is an error.

  • Trying to grant permissions to an absent principal (possible in the case of imported resources) leads to a warning being added to the resource construct.

Parameters:

  • resource (IResourceWithPolicy) – The resource with a resource policy. The statement will be added to the resource policy if it couldn’t be added to the principal policy.

  • resource_self_arns (Optional[Sequence[str]]) – When referring to the resource in a resource policy, use this as ARN. (Depending on the resource type, this needs to be ‘*’ in a resource policy). Default: Same as regular resource ARNs

  • actions (Sequence[str]) – The actions to grant.

  • grantee (IGrantable) – The principal to grant to. Default: if principal is undefined, no work is done.

  • resource_arns (Sequence[str]) – The resource ARNs to grant to.

Return type:

Grant

classmethod drop(grantee, _intent)

Returns a “no-op” Grant object which represents a “dropped grant”.

This can be used for e.g. imported resources where you may not be able to modify the resource’s policy or some underlying policy which you don’t know about.

Parameters:

  • grantee (IGrantable) – The intended grantee.

  • _intent (str) – The user’s intent (will be ignored at the moment).

Return type:

Grant