Grant Class
Result of a grant() operation.
This class is not instantiable by consumers on purpose, so that they will be required to call the Grant factory functions.
Example
ts
declare const instance: ec2.Instance;
declare const volume: ec2.Volume;
const attachGrant = volume.grantAttachVolumeByResourceTag(instance.grantPrincipal, [instance]);
const detachGrant = volume.grantDetachVolumeByResourceTag(instance.grantPrincipal, [instance]);
Properties
principalStatementPolicyStatementprincipal_statementPolicyStatementprincipalStatementPolicyStatementPrincipalStatementPolicyStatementPrincipalStatementPolicyStatementdeprecated#Use `principalStatements` instead
principalStatementsPolicyStatement[]principal_statementstyping.List[PolicyStatement]principalStatementsList<PolicyStatement>PrincipalStatementsPolicyStatement[]PrincipalStatements*[]PolicyStatementrequired#The statements that were added to the principal's policy.
resourceStatementPolicyStatementresource_statementPolicyStatementresourceStatementPolicyStatementResourceStatementPolicyStatementResourceStatementPolicyStatementdeprecated#Use `resourceStatements` instead
resourceStatementsPolicyStatement[]resource_statementstyping.List[PolicyStatement]resourceStatementsList<PolicyStatement>ResourceStatementsPolicyStatement[]ResourceStatements*[]PolicyStatementrequired#The statements that were added to the resource policy.
Whether the grant operation was successful.
Methods
addStatementToResourcePolicy(options: GrantPolicyWithResourceOptions): Grant // chainable@staticmethod def add_statement_to_resource_policy(options: GrantPolicyWithResourceOptions) -> Grantpublic static Grant addStatementToResourcePolicy(GrantPolicyWithResourceOptions options)public static Grant AddStatementToResourcePolicy(GrantPolicyWithResourceOptions options)func AddStatementToResourcePolicy(Options GrantPolicyWithResourceOptions) Grantstatic#Add a pre-constructed policy statement to the resource's policy.
notes · 1 parameter · returns · example
This method provides direct, low-level control over the initial policy statement being added. It is useful when you need to:
- Add complex policy statements that can't be expressed through other grant methods
- Specify the initial structure of the policy statement
- Add statements with custom conditions or other advanced IAM features
Important differences from other grant methods:
- Only modifies the resource policy, never modifies any principal's policy
- Takes a complete PolicyStatement rather than constructing one from parameters
- Always attempts to add the statement, regardless of principal type or account
- Does not attempt any automatic principal/resource policy selection logic
Note: The final form of the policy statement in the resource's policy may differ from the provided statement, depending on the resource's implementation of addToResourcePolicy.
Parameters
optionsoptionsoptionsoptionsOptions— Contains both the target resource and the policy statement to add.
Returns: A Grant object representing the result of the operation
ts
declare const grantee: iam.IGrantable;
declare const actions: string[];
declare const resourceArns: string[];
declare const bucket: s3.Bucket;
const statement = new iam.PolicyStatement({
effect: iam.Effect.ALLOW,
actions: actions,
principals: [new iam.ServicePrincipal('lambda.amazonaws.com')],
conditions: {
StringEquals: {
'aws:SourceAccount': Stack.of(this).account,
},
},
});
iam.Grant.addStatementToResourcePolicy({
grantee: grantee,
actions: actions,
resourceArns: resourceArns,
resource: bucket,
statement: statement,
});
addToPrincipal(options: GrantOnPrincipalOptions): Grant // chainable@staticmethod def add_to_principal(options: GrantOnPrincipalOptions) -> Grantpublic static Grant addToPrincipal(GrantOnPrincipalOptions options)public static Grant AddToPrincipal(GrantOnPrincipalOptions options)func AddToPrincipal(Options GrantOnPrincipalOptions) Grantstatic#Try to grant the given permissions to the given principal.
Absence of a principal leads to a warning, but failing to add the permissions to a present principal is not an error.
addToPrincipalAndResource(options: GrantOnPrincipalAndResourceOptions): Grant // chainable@staticmethod def add_to_principal_and_resource(options: GrantOnPrincipalAndResourceOptions) -> Grantpublic static Grant addToPrincipalAndResource(GrantOnPrincipalAndResourceOptions options)public static Grant AddToPrincipalAndResource(GrantOnPrincipalAndResourceOptions options)func AddToPrincipalAndResource(Options GrantOnPrincipalAndResourceOptions) Grantstatic#Add a grant both on the principal and on the resource.
As long as any principal is given, granting on the principal may fail (in case of a non-identity principal), but granting on the resource will never fail.
Statement will be the resource statement.
addToPrincipalOrResource(options: GrantWithResourceOptions): Grant // chainable@staticmethod def add_to_principal_or_resource(options: GrantWithResourceOptions) -> Grantpublic static Grant addToPrincipalOrResource(GrantWithResourceOptions options)public static Grant AddToPrincipalOrResource(GrantWithResourceOptions options)func AddToPrincipalOrResource(Options GrantWithResourceOptions) Grantstatic#Grant the given permissions to the principal.
notes
The permissions will be added to the principal policy primarily, falling back to the resource policy if necessary. The permissions must be granted somewhere.
- Trying to grant permissions to a principal that does not admit adding to the principal policy while not providing a resource with a resource policy is an error.
- Trying to grant permissions to an absent principal (possible in the case of imported resources) leads to a warning being added to the resource construct.
applyBefore(...constructs: IConstruct[]): voiddef apply_before(self, constructs: IConstruct) -> Nonepublic void applyBefore(IConstruct constructs)public void ApplyBefore(IConstruct constructs)func ApplyBefore(Constructs IConstruct)#Make sure this grant is applied before the given constructs are deployed.
The same as construct.node.addDependency(grant), but slightly nicer to read.
assertSuccess(): voiddef assert_success(self, ) -> Nonepublic void assertSuccess()public void AssertSuccess()func AssertSuccess()#Throw an error if this grant wasn't successful.
combine(rhs: Grant): Grant // chainabledef combine(self, rhs: Grant) -> Grantpublic Grant combine(Grant rhs)public Grant Combine(Grant rhs)func Combine(Rhs Grant) Grant#Combine two grants into a new one.
drop(grantee: IGrantable, _intent: string): Grant // chainable@staticmethod def drop(grantee: IGrantable, _intent: str) -> Grantpublic static Grant drop(IGrantable grantee, String _intent)public static Grant Drop(IGrantable grantee, string _intent)func Drop(Grantee IGrantable, _intent *string) Grantstatic#Returns a "no-op" `Grant` object which represents a "dropped grant".
This can be used for e.g. imported resources where you may not be able to modify the resource's policy or some underlying policy which you don't know about.
2 parameters
Parameters
granteegranteegranteegranteeGrantee— The intended grantee._intent_intent_intent_intent_intent— The user's intent (will be ignored at the moment).