# KeyGrants

Collection of grant methods for an IKey.

- Source: [`aws-kms/lib/key-grants.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-kms/lib/key-grants.ts#L17)
- Type last changed: v2.239.0 · 19 Feb 2026

## Example

```ts
declare const principal: iam.IPrincipal;
declare const key: kms.IKeyRef; // can be either an L1 or L2

kms.KeyGrants.fromKey(key).sign(principal);
```

## Methods

- `actions(grantee: IGrantable, ...actions: string[]): Grant` — Grant the indicated permissions on this key to the given principal.

  This modifies both the principal's policy as well as the resource policy,
  since the default CloudFormation setup for KMS keys is that the policy
  must not be empty and so default grants won't work.

- `admin(grantee: IGrantable): Grant` — Grant admins permissions using this key to the given principal.

  Key administrators have permissions to manage the key (e.g., change permissions, revoke), but do not have permissions
  to use the key in cryptographic operations (e.g., encrypt, decrypt).

- `decrypt(grantee: IGrantable): Grant` — Grant decryption permissions using this key to the given principal.

- `encrypt(grantee: IGrantable): Grant` — Grant encryption permissions using this key to the given principal.

- `encryptDecrypt(grantee: IGrantable): Grant` — Grant encryption and decryption permissions using this key to the given principal.

- `fromKey(resource: IKeyRef, trustAccountIdentities?: boolean): KeyGrants // chainable` (static) — Creates grants for an IKeyRef.

- `generateMac(grantee: IGrantable): Grant` — Grant permissions to generating MACs to the given principal.

- `sign(grantee: IGrantable): Grant` — Grant sign permissions using this key to the given principal.

- `signVerify(grantee: IGrantable): Grant` — Grant sign and verify permissions using this key to the given principal.

- `verify(grantee: IGrantable): Grant` — Grant verify permissions using this key to the given principal.

- `verifyMac(grantee: IGrantable): Grant` — Grant permissions to verifying MACs to the given principal.