KeyGrants

class aws_cdk.aws_kms.KeyGrants(*args: Any, **kwargs)

Bases: object

Collection of grant methods for an IKey.

ExampleMetadata:: fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk import aws_kms as kms
from aws_cdk.interfaces import aws_kms as interfaces_kms

# key_ref: interfaces_kms.IKeyRef

key_grants = kms.KeyGrants.from_key(key_ref, False)

Methods

actions(grantee, *actions)

Grant the indicated permissions on this key to the given principal.

This modifies both the principal’s policy as well as the resource policy, since the default CloudFormation setup for KMS keys is that the policy must not be empty and so default grants won’t work.

Parameters:

grantee (IGrantable)
actions (str)

Return type:

Grant

decrypt(grantee)

Grant decryption permissions using this key to the given principal.

Parameters:: grantee (IGrantable)
Return type:: Grant

encrypt(grantee)

Grant encryption permissions using this key to the given principal.

Parameters:: grantee (IGrantable)
Return type:: Grant

encrypt_decrypt(grantee)

Grant encryption and decryption permissions using this key to the given principal.

Parameters:: grantee (IGrantable)
Return type:: Grant

generate_mac(grantee)

Grant permissions to generating MACs to the given principal.

Parameters:: grantee (IGrantable)
Return type:: Grant

sign(grantee)

Grant sign permissions using this key to the given principal.

Parameters:: grantee (IGrantable)
Return type:: Grant

sign_verify(grantee)

Grant sign and verify permissions using this key to the given principal.

Parameters:: grantee (IGrantable)
Return type:: Grant

verify(grantee)

Grant verify permissions using this key to the given principal.

Parameters:: grantee (IGrantable)
Return type:: Grant

verify_mac(grantee)

Grant permissions to verifying MACs to the given principal.

Parameters:: grantee (IGrantable)
Return type:: Grant

Static Methods

classmethod from_key(resource, trust_account_identities=None)

Creates grants for an IKeyRef.

Parameters:

resource (IKeyRef)
trust_account_identities (Optional[bool])

Return type:

KeyGrants