AWS CDK Reference

Appearance

v2.274.0

GrantPolicyWithResourceOptions Struct ​

Options for a grant operation that directly adds a policy statement to a resource.

This differs from GrantWithResourceOptions in that it requires a pre-constructed PolicyStatement rather than constructing one from individual permissions. Use this when you need fine-grained control over the initial policy statement's contents.

Source
aws-iam/lib/grant.ts
Type last changed
v2.186.0 · 27 Mar 2025

Example ​

ts
declare const grantee: iam.IGrantable;
declare const actions: string[];
declare const resourceArns: string[];
declare const bucket: s3.Bucket;

const statement = new iam.PolicyStatement({
  effect: iam.Effect.ALLOW,
  actions: actions,
  principals: [new iam.ServicePrincipal('lambda.amazonaws.com')],
  conditions: {
    StringEquals: {
      'aws:SourceAccount': Stack.of(this).account,
    },
  },
});
iam.Grant.addStatementToResourcePolicy({
    grantee: grantee,
    actions: actions,
    resourceArns: resourceArns,
    resource: bucket,
    statement: statement,
 });

Properties ​

actionsstring[]actionstyping.List[str]actionsList<String>Actionsstring[]Actions*[]*stringrequired#
The actions to grant.
conditions{ [key: string]: { [key: string]: any } }conditionstyping.Mapping[str, typing.Mapping[str, Any]]conditionsMap<String, Map<String, Object>>ConditionsIDictionary<string, IDictionary<string, object>>Conditions*map[string]*map[string]interface{}#
Any conditions to attach to the grant.

Default: No conditions

granteeIGrantablegranteeIGrantablegranteeIGrantableGranteeIGrantableGranteeIGrantablerequired#
The principal to grant to.

Default: if principal is undefined, no work is done.

resourceIResourceWithPolicyV2resourceIResourceWithPolicyV2resourceIResourceWithPolicyV2ResourceIResourceWithPolicyV2ResourceIResourceWithPolicyV2required#
The resource with a resource policy.

The statement will be added to the resource policy if it couldn't be added to the principal policy.

resourceArnsstring[]resource_arnstyping.List[str]resourceArnsList<String>ResourceArnsstring[]ResourceArns*[]*stringrequired#
The resource ARNs to grant to.
resourceSelfArnsstring[]resource_self_arnstyping.List[str]resourceSelfArnsList<String>ResourceSelfArnsstring[]ResourceSelfArns*[]*string#
When referring to the resource in a resource policy, use this as ARN.

Default: Same as regular resource ARNs

(Depending on the resource type, this needs to be '*' in a resource policy).

statementPolicyStatementstatementPolicyStatementstatementPolicyStatementStatementPolicyStatementStatementPolicyStatementrequired#
The policy statement to add to the resource's policy.

This statement will be passed to the resource's addToResourcePolicy method. The actual handling of the statement depends on the specific IResourceWithPolicyV2 implementation.