KeyGrants Facade
Collection of grant methods for an IKey.
Example
ts
declare const principal: iam.IPrincipal;
declare const key: kms.IKeyRef; // can be either an L1 or L2
kms.KeyGrants.fromKey(key).sign(principal);
Methods
actions(grantee: IGrantable, ...actions: string[]): Grantdef actions(self, grantee: IGrantable, actions: str) -> Grantpublic Grant actions(IGrantable grantee, String actions)public Grant Actions(IGrantable grantee, string actions)func Actions(Grantee IGrantable, Actions *string) Grant#Grant the indicated permissions on this key to the given principal.
This modifies both the principal's policy as well as the resource policy, since the default CloudFormation setup for KMS keys is that the policy must not be empty and so default grants won't work.
admin(grantee: IGrantable): Grantdef admin(self, grantee: IGrantable) -> Grantpublic Grant admin(IGrantable grantee)public Grant Admin(IGrantable grantee)func Admin(Grantee IGrantable) Grant#Grant admins permissions using this key to the given principal.
Key administrators have permissions to manage the key (e.g., change permissions, revoke), but do not have permissions to use the key in cryptographic operations (e.g., encrypt, decrypt).
decrypt(grantee: IGrantable): Grantdef decrypt(self, grantee: IGrantable) -> Grantpublic Grant decrypt(IGrantable grantee)public Grant Decrypt(IGrantable grantee)func Decrypt(Grantee IGrantable) Grant#Grant decryption permissions using this key to the given principal.
encrypt(grantee: IGrantable): Grantdef encrypt(self, grantee: IGrantable) -> Grantpublic Grant encrypt(IGrantable grantee)public Grant Encrypt(IGrantable grantee)func Encrypt(Grantee IGrantable) Grant#Grant encryption permissions using this key to the given principal.
encryptDecrypt(grantee: IGrantable): Grantdef encrypt_decrypt(self, grantee: IGrantable) -> Grantpublic Grant encryptDecrypt(IGrantable grantee)public Grant EncryptDecrypt(IGrantable grantee)func EncryptDecrypt(Grantee IGrantable) Grant#Grant encryption and decryption permissions using this key to the given principal.
fromKey(resource: IKeyRef, trustAccountIdentities?: boolean): KeyGrants // chainable@staticmethod def from_key(resource: IKeyRef, trust_account_identities: typing.Optional[bool] = None) -> KeyGrantspublic static KeyGrants fromKey(IKeyRef resource, Boolean trustAccountIdentities)public static KeyGrants FromKey(IKeyRef resource, bool? trustAccountIdentities = null)func FromKey(Resource IKeyRef, TrustAccountIdentities *bool) KeyGrantsstatic#Creates grants for an IKeyRef.
generateMac(grantee: IGrantable): Grantdef generate_mac(self, grantee: IGrantable) -> Grantpublic Grant generateMac(IGrantable grantee)public Grant GenerateMac(IGrantable grantee)func GenerateMac(Grantee IGrantable) Grant#Grant permissions to generating MACs to the given principal.
sign(grantee: IGrantable): Grantdef sign(self, grantee: IGrantable) -> Grantpublic Grant sign(IGrantable grantee)public Grant Sign(IGrantable grantee)func Sign(Grantee IGrantable) Grant#Grant sign permissions using this key to the given principal.
signVerify(grantee: IGrantable): Grantdef sign_verify(self, grantee: IGrantable) -> Grantpublic Grant signVerify(IGrantable grantee)public Grant SignVerify(IGrantable grantee)func SignVerify(Grantee IGrantable) Grant#Grant sign and verify permissions using this key to the given principal.
verify(grantee: IGrantable): Grantdef verify(self, grantee: IGrantable) -> Grantpublic Grant verify(IGrantable grantee)public Grant Verify(IGrantable grantee)func Verify(Grantee IGrantable) Grant#Grant verify permissions using this key to the given principal.
verifyMac(grantee: IGrantable): Grantdef verify_mac(self, grantee: IGrantable) -> Grantpublic Grant verifyMac(IGrantable grantee)public Grant VerifyMac(IGrantable grantee)func VerifyMac(Grantee IGrantable) Grant#Grant permissions to verifying MACs to the given principal.