# TableGrants

A set of permissions to grant on a Table.

- Source: [`aws-dynamodb/lib/table-grants.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-dynamodb/lib/table-grants.ts#L57)
- Type last changed: v2.239.0 · 19 Feb 2026

## Example

```ts
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import { aws_dynamodb as dynamodb } from 'aws-cdk-lib';
import { aws_iam as iam } from 'aws-cdk-lib';
import { aws_dynamodb as interfaces_dynamodb } from 'aws-cdk-lib/interfaces';

declare const encryptedResource: iam.IEncryptedResource;
declare const resourceWithPolicyV2: iam.IResourceWithPolicyV2;
declare const tableRef: interfaces_dynamodb.ITableRef;
const tableGrants = new dynamodb.TableGrants({
  table: tableRef,

  // the properties below are optional
  encryptedResource: encryptedResource,
  hasIndex: false,
  policyResource: resourceWithPolicyV2,
  regions: ['regions'],
});
```

## Initializer

```ts
new TableGrants(props: TableGrantsProps)
```

## Methods

- `actions(grantee: IGrantable, ...actions: string[]): Grant` — Adds an IAM policy statement associated with this table to an IAM principal's policy.

  If `encryptionKey` is present, appropriate grants to the key needs to be added
  separately using the `table.encryptionKey.grant*` methods.

  **Parameters**

  - `grantee` — The principal (no-op if undefined).
  - `actions` — The set of actions to allow (i.e. "dynamodb:PutItem", "dynamodb:GetItem", ...).

- `fromTable(table: ITableRef, regions?: string[], hasIndex?: boolean): TableGrants // chainable` (static) — Creates a TableGrants object for a given table.

- `fullAccess(grantee: IGrantable): Grant` — Permits all DynamoDB operations ("dynamodb:*") to an IAM principal.

  Appropriate grants will also be added to the customer-managed KMS key
  if one was configured.

  **Parameters**

  - `grantee` — The principal to grant access to.

- `multiAccountReplicationFrom(sourceReplicaArn: string): void` — Grants permissions for this table to act as a destination for multi-account global table replication.

  **Parameters**

  - `sourceReplicaArn` — The ARN of the source replica table in the other account.

- `multiAccountReplicationTo(destinationReplicaArn: string): void` — Grants permissions for this table to act as a source for multi-account global table replication.

  **Parameters**

  - `destinationReplicaArn` — The ARN of the destination replica table in the other account.

- `readData(grantee: IGrantable): Grant` — Permits an IAM principal all data read operations from this table: BatchGetItem, GetRecords, GetShardIterator, Query, GetItem, Scan, DescribeTable.

  Appropriate grants will also be added to the customer-managed KMS key
  if one was configured.

  **Parameters**

  - `grantee` — The principal to grant access to.

- `readWriteData(grantee: IGrantable): Grant` — Permits an IAM principal to all data read/write operations to this table.

  BatchGetItem, GetRecords, GetShardIterator, Query, GetItem, Scan,
  BatchWriteItem, PutItem, UpdateItem, DeleteItem, DescribeTable

  Appropriate grants will also be added to the customer-managed KMS key
  if one was configured.

  **Parameters**

  - `grantee` — The principal to grant access to.

- `writeData(grantee: IGrantable): Grant` — Permits an IAM principal all data write operations to this table: BatchWriteItem, PutItem, UpdateItem, DeleteItem, DescribeTable.

  Appropriate grants will also be added to the customer-managed KMS key
  if one was configured.

  **Parameters**

  - `grantee` — The principal to grant access to.