# IEncryptedResource

A resource that contains data that can be encrypted, using a KMS key.s.

Extends: IEncryptedResource
Extends: IEnvironmentAware
Implemented by: Table, TableBase, Bucket, BucketBase, Topic, TopicBase, Queue, QueueBase, StringListParameter, StringParameter

- Source: [`aws-iam/lib/grant.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-iam/lib/grant.ts#L549)
- Type last changed: v2.237.0 · 2 Feb 2026

## Properties

- `env`: [ResourceEnvironment](/cdk/api/v2/docs/aws-cdk-lib.interfaces.ResourceEnvironment.html) — The environment this resource belongs to.

  For resources that are created and managed in a Stack (those created by
  creating new class instances like `new Role()`, `new Bucket()`, etc.), this
  is always the same as the environment of the stack they belong to.

  For referenced resources (those obtained from referencing methods like
  `Role.fromRoleArn()`, `Bucket.fromBucketName()`, etc.), they might be
  different than the stack they were imported into.

## Methods

- `grantOnKey(grantee: IGrantable, ...actions: string[]): GrantOnKeyResult` — Gives permissions to a grantable entity to perform actions on the encryption key.