本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。
# `CreateGrant`与 AWS SDK 或 CLI 配合使用
以下代码示例演示如何使用 `CreateGrant`。
操作示例是大型程序的代码摘录，必须在上下文中运行。在以下代码示例中，您可以查看此操作的上下文：
+ [了解基本功能](example_kms_Scenario_Basics_section.md)
------
#### [ .NET ]
**适用于 .NET 的 SDK**
还有更多相关信息 GitHub。在 [AWS 代码示例存储库](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/dotnetv3/KMS#code-examples)中查找完整示例，了解如何进行设置和运行。
```
public static async Task Main()
{
var client = new AmazonKeyManagementServiceClient();
// The identity that is given permission to perform the operations
// specified in the grant.
var grantee = "arn:aws:iam::111122223333:role/ExampleRole";
// The identifier of the AWS KMS key to which the grant applies. You
// can use the key ID or the Amazon Resource Name (ARN) of the KMS key.
var keyId = "7c9eccc2-38cb-4c4f-9db3-766ee8dd3ad4";
var request = new CreateGrantRequest
{
GranteePrincipal = grantee,
KeyId = keyId,
// A list of operations that the grant allows.
Operations = new List
{
"Encrypt",
"Decrypt",
},
};
var response = await client.CreateGrantAsync(request);
string grantId = response.GrantId; // The unique identifier of the grant.
string grantToken = response.GrantToken; // The grant token.
Console.WriteLine($"Id: {grantId}, Token: {grantToken}");
}
}
```
+ 有关 API 的详细信息，请参阅 *适用于 .NET 的 AWS SDK API 参考[CreateGrant](https://docs.aws.amazon.com/goto/DotNetSDKV3/kms-2014-11-01/CreateGrant)*中的。
------
#### [ CLI ]
**AWS CLI**
**创建授权**
以下 `create-grant` 示例将创建授权，以允许 `exampleUser` 用户对 `1234abcd-12ab-34cd-56ef-1234567890ab` KMS 密钥示例使用 `decrypt` 命令。停用主体是 `adminRole` 角色。该授权使用 `EncryptionContextSubset` 授权约束，以便仅在 `decrypt` 请求中的加密上下文包含 `"Department": "IT"` 键值对时才允许此权限。
```
aws kms create-grant \
--key-id 1234abcd-12ab-34cd-56ef-1234567890ab \
--grantee-principal arn:aws:iam::123456789012:user/exampleUser \
--operations Decrypt \
--constraints EncryptionContextSubset={Department=IT} \
--retiring-principal arn:aws:iam::123456789012:role/adminRole
```
输出：
```
{
"GrantId": "1a2b3c4d2f5e69f440bae30eaec9570bb1fb7358824f9ddfa1aa5a0dab1a59b2",
"GrantToken": ""
}
```
要查看有关授权的详细信息，请使用 `list-grants` 命令。
有关更多信息，请参阅《密*AWS 钥管理服务开发人员指南*》[中的 AWS KMS 中的授权](https://docs.aws.amazon.com/kms/latest/developerguide/grants.html)。
+ 有关 API 的详细信息，请参阅*AWS CLI 命令参考[CreateGrant](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/kms/create-grant.html)*中的。
------
#### [ Java ]
**适用于 Java 的 SDK 2.x**
还有更多相关信息 GitHub。在 [AWS 代码示例存储库](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javav2/example_code/kms#code-examples)中查找完整示例，了解如何进行设置和运行。
```
/**
* Grants permissions to a specified principal on a customer master key (CMK) asynchronously.
*
* @param keyId The unique identifier for the customer master key (CMK) that the grant applies to.
* @param granteePrincipal The principal that is given permission to perform the operations that the grant permits on the CMK.
* @return A {@link CompletableFuture} that, when completed, contains the ID of the created grant.
* @throws RuntimeException If an error occurs during the grant creation process.
*/
public CompletableFuture grantKeyAsync(String keyId, String granteePrincipal) {
List grantPermissions = List.of(
GrantOperation.ENCRYPT,
GrantOperation.DECRYPT,
GrantOperation.DESCRIBE_KEY
);
CreateGrantRequest grantRequest = CreateGrantRequest.builder()
.keyId(keyId)
.name("grant1")
.granteePrincipal(granteePrincipal)
.operations(grantPermissions)
.build();
CompletableFuture responseFuture = getAsyncClient().createGrant(grantRequest);
responseFuture.whenComplete((response, ex) -> {
if (ex == null) {
logger.info("Grant created successfully with ID: " + response.grantId());
} else {
if (ex instanceof KmsException kmsEx) {
throw new RuntimeException("Failed to create grant: " + kmsEx.getMessage(), kmsEx);
} else {
throw new RuntimeException("An unexpected error occurred: " + ex.getMessage(), ex);
}
}
});
return responseFuture.thenApply(CreateGrantResponse::grantId);
}
```
+ 有关 API 的详细信息，请参阅 *AWS SDK for Java 2.x API 参考[CreateGrant](https://docs.aws.amazon.com/goto/SdkForJavaV2/kms-2014-11-01/CreateGrant)*中的。
------
#### [ Kotlin ]
**适用于 Kotlin 的 SDK**
还有更多相关信息 GitHub。在 [AWS 代码示例存储库](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/kotlin/services/kms#code-examples)中查找完整示例，了解如何进行设置和运行。
```
suspend fun createNewGrant(
keyIdVal: String?,
granteePrincipalVal: String?,
operation: String,
): String? {
val operationOb = GrantOperation.fromValue(operation)
val grantOperationList = ArrayList()
grantOperationList.add(operationOb)
val request =
CreateGrantRequest {
keyId = keyIdVal
granteePrincipal = granteePrincipalVal
operations = grantOperationList
}
KmsClient.fromEnvironment { region = "us-west-2" }.use { kmsClient ->
val response = kmsClient.createGrant(request)
return response.grantId
}
}
```
+ 有关 API 的详细信息，请参阅适用[CreateGrant](https://sdk.amazonaws.com/kotlin/api/latest/index.html)于 K *otlin 的AWS SDK API 参考*。
------
#### [ PHP ]
**适用于 PHP 的 SDK**
还有更多相关信息 GitHub。在 [AWS 代码示例存储库](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/php/example_code/kms#code-examples)中查找完整示例，了解如何进行设置和运行。
```
/***
* @param string $keyId
* @param string $granteePrincipal
* @param array $operations
* @param array $grantTokens
* @return Result
*/
public function createGrant(string $keyId, string $granteePrincipal, array $operations, array $grantTokens = [])
{
$args = [
'KeyId' => $keyId,
'GranteePrincipal' => $granteePrincipal,
'Operations' => $operations,
];
if($grantTokens){
$args['GrantTokens'] = $grantTokens;
}
try{
return $this->client->createGrant($args);
}catch(KmsException $caught){
if($caught->getAwsErrorMessage() == "InvalidGrantTokenException"){
echo "The request was rejected because the specified grant token is not valid.\n";
}
throw $caught;
}
}
```
+ 有关 API 的详细信息，请参阅 *适用于 PHP 的 AWS SDK API 参考[CreateGrant](https://docs.aws.amazon.com/goto/SdkForPHPV3/kms-2014-11-01/CreateGrant)*中的。
------
#### [ Python ]
**适用于 Python 的 SDK（Boto3）**
还有更多相关信息 GitHub。在 [AWS 代码示例存储库](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/kms#code-examples)中查找完整示例，了解如何进行设置和运行。
```
class GrantManager:
def __init__(self, kms_client):
self.kms_client = kms_client
@classmethod
def from_client(cls) -> "GrantManager":
"""
Creates a GrantManager instance with a default KMS client.
:return: An instance of GrantManager initialized with the default KMS client.
"""
kms_client = boto3.client("kms")
return cls(kms_client)
def create_grant(
self, key_id: str, principal: str, operations: [str]
) -> dict[str, str]:
"""
Creates a grant for a key that lets a principal generate a symmetric data
encryption key.
:param key_id: The ARN or ID of the key.
:param principal: The principal to grant permission to.
:param operations: The operations to grant permission for.
:return: The grant that is created.
"""
try:
return self.kms_client.create_grant(
KeyId=key_id,
GranteePrincipal=principal,
Operations=operations,
)
except ClientError as err:
logger.error(
"Couldn't create a grant on key %s. Here's why: %s",
key_id,
err.response["Error"]["Message"],
)
raise
```
+ 有关 API 的详细信息，请参阅适用[CreateGrant](https://docs.aws.amazon.com/goto/boto3/kms-2014-11-01/CreateGrant)于 *Python 的AWS SDK (Boto3) API 参考*。
------
#### [ SAP ABAP ]
**适用于 SAP ABAP 的 SDK**
还有更多相关信息 GitHub。在 [AWS 代码示例存储库](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/kms#code-examples)中查找完整示例，了解如何进行设置和运行。
```
TRY.
" iv_key_id = 'arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab'
" iv_grantee_principal = 'arn:aws:iam::123456789012:role/my-role'
" it_operations contains 'Encrypt', 'Decrypt', 'GenerateDataKey'
oo_result = lo_kms->creategrant(
iv_keyid = iv_key_id
iv_granteeprincipal = iv_grantee_principal
it_operations = it_operations
).
MESSAGE 'Grant created successfully.' TYPE 'I'.
CATCH /aws1/cx_kmsdisabledexception.
MESSAGE 'The key is disabled.' TYPE 'E'.
CATCH /aws1/cx_kmsnotfoundexception.
MESSAGE 'Key not found.' TYPE 'E'.
CATCH /aws1/cx_kmskmsinternalex.
MESSAGE 'An internal error occurred.' TYPE 'E'.
ENDTRY.
```
+ 有关 API 的详细信息，请参阅适用[CreateGrant](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html)于 S *AP 的AWS SDK ABAP API 参考*。
------
有关 S AWS DK 开发者指南和代码示例的完整列表，请参阅[将此服务与 AWS SDK 配合使用](sdk-general-information-section.md)。本主题还包括有关入门的信息以及有关先前的 SDK 版本的详细信息。