TableGrants Facade
A set of permissions to grant on a Table.
Example
ts
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import { aws_dynamodb as dynamodb } from 'aws-cdk-lib';
import { aws_iam as iam } from 'aws-cdk-lib';
import { aws_dynamodb as interfaces_dynamodb } from 'aws-cdk-lib/interfaces';
declare const encryptedResource: iam.IEncryptedResource;
declare const resourceWithPolicyV2: iam.IResourceWithPolicyV2;
declare const tableRef: interfaces_dynamodb.ITableRef;
const tableGrants = new dynamodb.TableGrants({
table: tableRef,
// the properties below are optional
encryptedResource: encryptedResource,
hasIndex: false,
policyResource: resourceWithPolicyV2,
regions: ['regions'],
});
python
# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk import aws_dynamodb as dynamodb
from aws_cdk import aws_iam as iam
from aws_cdk.interfaces import aws_dynamodb as interfaces_dynamodb
# encrypted_resource: iam.IEncryptedResource
# resource_with_policy_v2: iam.IResourceWithPolicyV2
# table_ref: interfaces_dynamodb.ITableRef
table_grants = dynamodb.TableGrants(
table=table_ref,
# the properties below are optional
encrypted_resource=encrypted_resource,
has_index=False,
policy_resource=resource_with_policy_v2,
regions=["regions"]
)
java
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import software.amazon.awscdk.services.dynamodb.*;
import software.amazon.awscdk.services.iam.*;
import software.amazon.awscdk.interfaces.dynamodb.*;
IEncryptedResource encryptedResource;
IResourceWithPolicyV2 resourceWithPolicyV2;
ITableRef tableRef;
TableGrants tableGrants = TableGrants.Builder.create()
.table(tableRef)
// the properties below are optional
.encryptedResource(encryptedResource)
.hasIndex(false)
.policyResource(resourceWithPolicyV2)
.regions(List.of("regions"))
.build();
csharp
// Install: dotnet add package Amazon.CDK.Lib
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
using Amazon.CDK.AWS.DynamoDB;
using Amazon.CDK.AWS.IAM;
using Amazon.CDK.Interfaces.DynamoDB;
IEncryptedResource encryptedResource;
IResourceWithPolicyV2 resourceWithPolicyV2;
ITableRef tableRef;
var tableGrants = new TableGrants(new TableGrantsProps {
Table = tableRef,
// the properties below are optional
EncryptedResource = encryptedResource,
HasIndex = false,
PolicyResource = resourceWithPolicyV2,
Regions = new [] { "regions" }
});
go
// Install: go get github.com/aws/aws-cdk-go/awscdk/v2
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"
import "github.com/aws/aws-cdk-go/awscdk"
import "github.com/aws/aws-cdk-go/awscdk"
var encryptedResource IEncryptedResource
var resourceWithPolicyV2 IResourceWithPolicyV2
var tableRef ITableRef
tableGrants := awscdk.Aws_dynamodb.NewTableGrants(&TableGrantsProps{
Table: tableRef,
// the properties below are optional
EncryptedResource: encryptedResource,
HasIndex: jsii.Boolean(false),
PolicyResource: resourceWithPolicyV2,
Regions: []*string{
jsii.String("regions"),
},
})
Initializer
ts
new TableGrants(props: TableGrantsProps)
python
TableGrants(props: TableGrantsProps)
java
new TableGrants(TableGrantsProps props)
csharp
new TableGrants(TableGrantsProps props)
go
NewTableGrants(Props TableGrantsProps)
Methods
actions(grantee: IGrantable, ...actions: string[]): Grantdef actions(self, grantee: IGrantable, actions: str) -> Grantpublic Grant actions(IGrantable grantee, String actions)public Grant Actions(IGrantable grantee, string actions)func Actions(Grantee IGrantable, Actions *string) Grant#Adds an IAM policy statement associated with this table to an IAM principal's policy.
If encryptionKey is present, appropriate grants to the key needs to be added separately using the table.encryptionKey.grant* methods.
2 parameters
Parameters
granteegranteegranteegranteeGrantee— The principal (no-op if undefined).actionsactionsactionsactionsActions— The set of actions to allow (i.e. "dynamodb:PutItem", "dynamodb:GetItem", ...).
fromTable(table: ITableRef, regions?: string[], hasIndex?: boolean): TableGrants // chainable@staticmethod def from_table(table: ITableRef, regions: typing.Optional[typing.List[str]] = None, has_index: typing.Optional[bool] = None) -> TableGrantspublic static TableGrants fromTable(ITableRef table, List<String> regions, Boolean hasIndex)public static TableGrants FromTable(ITableRef table, string[]? regions = null, bool? hasIndex = null)func FromTable(Table ITableRef, Regions *[]*string, HasIndex *bool) TableGrantsstatic#Creates a TableGrants object for a given table.
fullAccess(grantee: IGrantable): Grantdef full_access(self, grantee: IGrantable) -> Grantpublic Grant fullAccess(IGrantable grantee)public Grant FullAccess(IGrantable grantee)func FullAccess(Grantee IGrantable) Grant#Permits all DynamoDB operations ("dynamodb:*") to an IAM principal.
Appropriate grants will also be added to the customer-managed KMS key if one was configured.
1 parameter
Parameters
granteegranteegranteegranteeGrantee— The principal to grant access to.
multiAccountReplicationFrom(sourceReplicaArn: string): voiddef multi_account_replication_from(self, source_replica_arn: str) -> Nonepublic void multiAccountReplicationFrom(String sourceReplicaArn)public void MultiAccountReplicationFrom(string sourceReplicaArn)func MultiAccountReplicationFrom(SourceReplicaArn *string)#Grants permissions for this table to act as a destination for multi-account global table replication.
1 parameter
Parameters
sourceReplicaArnsource_replica_arnsourceReplicaArnsourceReplicaArnSourceReplicaArn— The ARN of the source replica table in the other account.
multiAccountReplicationTo(destinationReplicaArn: string): voiddef multi_account_replication_to(self, destination_replica_arn: str) -> Nonepublic void multiAccountReplicationTo(String destinationReplicaArn)public void MultiAccountReplicationTo(string destinationReplicaArn)func MultiAccountReplicationTo(DestinationReplicaArn *string)#Grants permissions for this table to act as a source for multi-account global table replication.
1 parameter
Parameters
destinationReplicaArndestination_replica_arndestinationReplicaArndestinationReplicaArnDestinationReplicaArn— The ARN of the destination replica table in the other account.
readData(grantee: IGrantable): Grantdef read_data(self, grantee: IGrantable) -> Grantpublic Grant readData(IGrantable grantee)public Grant ReadData(IGrantable grantee)func ReadData(Grantee IGrantable) Grant#Permits an IAM principal all data read operations from this table: BatchGetItem, GetRecords, GetShardIterator, Query, GetItem, Scan, DescribeTable.
Appropriate grants will also be added to the customer-managed KMS key if one was configured.
1 parameter
Parameters
granteegranteegranteegranteeGrantee— The principal to grant access to.
readWriteData(grantee: IGrantable): Grantdef read_write_data(self, grantee: IGrantable) -> Grantpublic Grant readWriteData(IGrantable grantee)public Grant ReadWriteData(IGrantable grantee)func ReadWriteData(Grantee IGrantable) Grant#Permits an IAM principal to all data read/write operations to this table.
BatchGetItem, GetRecords, GetShardIterator, Query, GetItem, Scan, BatchWriteItem, PutItem, UpdateItem, DeleteItem, DescribeTable
Appropriate grants will also be added to the customer-managed KMS key if one was configured.
1 parameter
Parameters
granteegranteegranteegranteeGrantee— The principal to grant access to.
writeData(grantee: IGrantable): Grantdef write_data(self, grantee: IGrantable) -> Grantpublic Grant writeData(IGrantable grantee)public Grant WriteData(IGrantable grantee)func WriteData(Grantee IGrantable) Grant#Permits an IAM principal all data write operations to this table: BatchWriteItem, PutItem, UpdateItem, DeleteItem, DescribeTable.
Appropriate grants will also be added to the customer-managed KMS key if one was configured.
1 parameter
Parameters
granteegranteegranteegranteeGrantee— The principal to grant access to.