GrantPolicyWithResourceOptions Struct
Options for a grant operation that directly adds a policy statement to a resource.
This differs from GrantWithResourceOptions in that it requires a pre-constructed PolicyStatement rather than constructing one from individual permissions. Use this when you need fine-grained control over the initial policy statement's contents.
Example
ts
declare const grantee: iam.IGrantable;
declare const actions: string[];
declare const resourceArns: string[];
declare const bucket: s3.Bucket;
const statement = new iam.PolicyStatement({
effect: iam.Effect.ALLOW,
actions: actions,
principals: [new iam.ServicePrincipal('lambda.amazonaws.com')],
conditions: {
StringEquals: {
'aws:SourceAccount': Stack.of(this).account,
},
},
});
iam.Grant.addStatementToResourcePolicy({
grantee: grantee,
actions: actions,
resourceArns: resourceArns,
resource: bucket,
statement: statement,
});
Properties
The actions to grant.
conditions{ [key: string]: { [key: string]: any } }conditionstyping.Mapping[str, typing.Mapping[str, Any]]conditionsMap<String, Map<String, Object>>ConditionsIDictionary<string, IDictionary<string, object>>Conditions*map[string]*map[string]interface{}= No conditions#Any conditions to attach to the grant.
granteeIGrantablegranteeIGrantablegranteeIGrantableGranteeIGrantableGranteeIGrantable= if principal is undefined, no wo…required#The principal to grant to.
default
Default: if principal is undefined, no work is done.
resourceIResourceWithPolicyV2resourceIResourceWithPolicyV2resourceIResourceWithPolicyV2ResourceIResourceWithPolicyV2ResourceIResourceWithPolicyV2required#The resource with a resource policy.
The statement will be added to the resource policy if it couldn't be added to the principal policy.
resourceArnsstring[]resource_arnstyping.List[str]resourceArnsList<String>ResourceArnsstring[]ResourceArns*[]*stringrequired#The resource ARNs to grant to.
resourceSelfArnsstring[]resource_self_arnstyping.List[str]resourceSelfArnsList<String>ResourceSelfArnsstring[]ResourceSelfArns*[]*string= Same as regular resource ARNs#When referring to the resource in a resource policy, use this as ARN.
(Depending on the resource type, this needs to be '*' in a resource policy).
statementPolicyStatementstatementPolicyStatementstatementPolicyStatementStatementPolicyStatementStatementPolicyStatementrequired#The policy statement to add to the resource's policy.
This statement will be passed to the resource's addToResourcePolicy method. The actual handling of the statement depends on the specific IResourceWithPolicyV2 implementation.