Class Grant
Result of a grant() operation.
Implements
Namespace: Amazon.CDK.AWS.IAM
Assembly: Amazon.CDK.Lib.dll
Syntax (csharp)
public class Grant : DeputyBase, IDependableSyntax (vb)
Public Class Grant Inherits DeputyBase Implements IDependableRemarks
This class is not instantiable by consumers on purpose, so that they will be required to call the Grant factory functions.
ExampleMetadata: infused
Examples
Instance instance;
Volume volume;
var attachGrant = volume.GrantAttachVolumeByResourceTag(instance.GrantPrincipal, new [] { instance });
var detachGrant = volume.GrantDetachVolumeByResourceTag(instance.GrantPrincipal, new [] { instance });Synopsis
Properties
| PrincipalStatement | (deprecated) The statement that was added to the principal's policy. |
| PrincipalStatements | The statements that were added to the principal's policy. |
| ResourceStatement | (deprecated) The statement that was added to the resource policy. |
| ResourceStatements | The statements that were added to the resource policy. |
| Success | Whether the grant operation was successful. |
Methods
| AddStatementToResourcePolicy(IGrantPolicyWithResourceOptions) | Add a pre-constructed policy statement to the resource's policy. |
| AddToPrincipal(IGrantOnPrincipalOptions) | Try to grant the given permissions to the given principal. |
| AddToPrincipalAndResource(IGrantOnPrincipalAndResourceOptions) | Add a grant both on the principal and on the resource. |
| AddToPrincipalOrResource(IGrantWithResourceOptions) | Grant the given permissions to the principal. |
| ApplyBefore(params IConstruct[]) | Make sure this grant is applied before the given constructs are deployed. |
| AssertSuccess() | Throw an error if this grant wasn't successful. |
| Combine(Grant) | Combine two grants into a new one. |
| Drop(IGrantable, string) | Returns a "no-op" |
Properties
PrincipalStatement
(deprecated) The statement that was added to the principal's policy.
[Obsolete("Use `principalStatements` instead")]
public virtual PolicyStatement? PrincipalStatement { get; }Property Value
Remarks
Stability: Deprecated
PrincipalStatements
The statements that were added to the principal's policy.
public virtual PolicyStatement[] PrincipalStatements { get; }Property Value
Remarks
This class is not instantiable by consumers on purpose, so that they will be required to call the Grant factory functions.
ExampleMetadata: infused
ResourceStatement
(deprecated) The statement that was added to the resource policy.
[Obsolete("Use `resourceStatements` instead")]
public virtual PolicyStatement? ResourceStatement { get; }Property Value
Remarks
Stability: Deprecated
ResourceStatements
The statements that were added to the resource policy.
public virtual PolicyStatement[] ResourceStatements { get; }Property Value
Remarks
This class is not instantiable by consumers on purpose, so that they will be required to call the Grant factory functions.
ExampleMetadata: infused
Success
Whether the grant operation was successful.
public virtual bool Success { get; }Property Value
Remarks
This class is not instantiable by consumers on purpose, so that they will be required to call the Grant factory functions.
ExampleMetadata: infused
Methods
AddStatementToResourcePolicy(IGrantPolicyWithResourceOptions)
Add a pre-constructed policy statement to the resource's policy.
public static Grant AddStatementToResourcePolicy(IGrantPolicyWithResourceOptions options)Parameters
- options IGrantPolicyWithResourceOptions
Contains both the target resource and the policy statement to add.
Returns
A Grant object representing the result of the operation
Remarks
This method provides direct, low-level control over the initial policy statement being added. It is useful when you need to:
Important differences from other grant methods:
Note: The final form of the policy statement in the resource's policy may differ from the provided statement, depending on the resource's implementation of addToResourcePolicy.
Examples
IGrantable grantee;
string[] actions;
string[] resourceArns;
Bucket bucket;
var statement = new PolicyStatement(new PolicyStatementProps {
Effect = Effect.ALLOW,
Actions = actions,
Principals = new [] { new ServicePrincipal("lambda.amazonaws.com") },
Conditions = new Dictionary<string, object> {
{ "StringEquals", new Dictionary<string, string> {
{ "aws:SourceAccount", Stack.Of(this).Account }
} }
}
});
Grant.AddStatementToResourcePolicy(new GrantPolicyWithResourceOptions {
Grantee = grantee,
Actions = actions,
ResourceArns = resourceArns,
Resource = bucket,
Statement = statement
});AddToPrincipal(IGrantOnPrincipalOptions)
Try to grant the given permissions to the given principal.
public static Grant AddToPrincipal(IGrantOnPrincipalOptions options)Parameters
- options IGrantOnPrincipalOptions
Returns
Remarks
Absence of a principal leads to a warning, but failing to add the permissions to a present principal is not an error.
AddToPrincipalAndResource(IGrantOnPrincipalAndResourceOptions)
Add a grant both on the principal and on the resource.
public static Grant AddToPrincipalAndResource(IGrantOnPrincipalAndResourceOptions options)Parameters
Returns
Remarks
As long as any principal is given, granting on the principal may fail (in case of a non-identity principal), but granting on the resource will never fail.
Statement will be the resource statement.
AddToPrincipalOrResource(IGrantWithResourceOptions)
Grant the given permissions to the principal.
public static Grant AddToPrincipalOrResource(IGrantWithResourceOptions options)Parameters
- options IGrantWithResourceOptions
Returns
Remarks
The permissions will be added to the principal policy primarily, falling back to the resource policy if necessary. The permissions must be granted somewhere.
ApplyBefore(params IConstruct[])
Make sure this grant is applied before the given constructs are deployed.
public virtual void ApplyBefore(params IConstruct[] constructs)Parameters
- constructs IConstruct[]
Remarks
The same as construct.node.addDependency(grant), but slightly nicer to read.
AssertSuccess()
Throw an error if this grant wasn't successful.
public virtual void AssertSuccess()Remarks
This class is not instantiable by consumers on purpose, so that they will be required to call the Grant factory functions.
ExampleMetadata: infused
Combine(Grant)
Combine two grants into a new one.
public virtual Grant Combine(Grant rhs)Parameters
- rhs Grant
Returns
Remarks
This class is not instantiable by consumers on purpose, so that they will be required to call the Grant factory functions.
ExampleMetadata: infused
Drop(IGrantable, string)
Returns a "no-op" Grant object which represents a "dropped grant".
public static Grant Drop(IGrantable grantee, string intent)Parameters
- grantee IGrantable
The intended grantee.
- intent string
The user's intent (will be ignored at the moment).
Returns
Remarks
This can be used for e.g. imported resources where you may not be able to modify the resource's policy or some underlying policy which you don't know about.