Docs Packages
  1. Packages
  2. AWS Classic
  3. API Docs
  4. kms
  5. Grant

Try AWS Native preview for resources not in the classic version.

AWS Classic v6.42.0 published on Wednesday, Jun 26, 2024 by Pulumi
pulumi/pulumi-aws

aws.kms.Grant

Explore with Pulumi AI

aws logo

Try AWS Native preview for resources not in the classic version.

AWS Classic v6.42.0 published on Wednesday, Jun 26, 2024 by Pulumi
pulumi/pulumi-aws

    Provides a resource-based access control mechanism for a KMS customer master key.

    Note: All arguments including the grant token will be stored in the raw state as plain-text.

    Import

    Using pulumi import, import KMS Grants using the Key ID and Grant ID separated by a colon (:). For example:

    $ pulumi import aws:kms/grant:Grant test 1234abcd-12ab-34cd-56ef-1234567890ab:abcde1237f76e4ba7987489ac329fbfba6ad343d6f7075dbd1ef191f0120514

    Create Grant Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new Grant(name: string, args: GrantArgs, opts?: CustomResourceOptions);
    @overload
def Grant(resource_name: str,
          args: GrantArgs,
          opts: Optional[ResourceOptions] = None)

@overload
def Grant(resource_name: str,
          opts: Optional[ResourceOptions] = None,
          grantee_principal: Optional[str] = None,
          key_id: Optional[str] = None,
          operations: Optional[Sequence[str]] = None,
          constraints: Optional[Sequence[GrantConstraintArgs]] = None,
          grant_creation_tokens: Optional[Sequence[str]] = None,
          name: Optional[str] = None,
          retire_on_delete: Optional[bool] = None,
          retiring_principal: Optional[str] = None)
    func NewGrant(ctx *Context, name string, args GrantArgs, opts ...ResourceOption) (*Grant, error)
    public Grant(string name, GrantArgs args, CustomResourceOptions? opts = null)
    public Grant(String name, GrantArgs args)
public Grant(String name, GrantArgs args, CustomResourceOptions options)

    type: aws:kms:Grant
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args GrantArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args GrantArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args GrantArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args GrantArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args GrantArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var grantResource = new Aws.Kms.Grant("grantResource", new()
{
    GranteePrincipal = "string",
    KeyId = "string",
    Operations = new[]
    {
        "string",
    },
    Constraints = new[]
    {
        new Aws.Kms.Inputs.GrantConstraintArgs
        {
            EncryptionContextEquals = 
            {
                { "string", "string" },
            },
            EncryptionContextSubset = 
            {
                { "string", "string" },
            },
        },
    },
    GrantCreationTokens = new[]
    {
        "string",
    },
    Name = "string",
    RetireOnDelete = false,
    RetiringPrincipal = "string",
});

    example, err := kms.NewGrant(ctx, "grantResource", &kms.GrantArgs{
	GranteePrincipal: pulumi.String("string"),
	KeyId:            pulumi.String("string"),
	Operations: pulumi.StringArray{
		pulumi.String("string"),
	},
	Constraints: kms.GrantConstraintArray{
		&kms.GrantConstraintArgs{
			EncryptionContextEquals: pulumi.StringMap{
				"string": pulumi.String("string"),
			},
			EncryptionContextSubset: pulumi.StringMap{
				"string": pulumi.String("string"),
			},
		},
	},
	GrantCreationTokens: pulumi.StringArray{
		pulumi.String("string"),
	},
	Name:              pulumi.String("string"),
	RetireOnDelete:    pulumi.Bool(false),
	RetiringPrincipal: pulumi.String("string"),
})

    var grantResource = new Grant("grantResource", GrantArgs.builder()
    .granteePrincipal("string")
    .keyId("string")
    .operations("string")
    .constraints(GrantConstraintArgs.builder()
        .encryptionContextEquals(Map.of("string", "string"))
        .encryptionContextSubset(Map.of("string", "string"))
        .build())
    .grantCreationTokens("string")
    .name("string")
    .retireOnDelete(false)
    .retiringPrincipal("string")
    .build());

    grant_resource = aws.kms.Grant("grantResource",
    grantee_principal="string",
    key_id="string",
    operations=["string"],
    constraints=[{
        "encryptionContextEquals": {
            "string": "string",
        },
        "encryptionContextSubset": {
            "string": "string",
        },
    }],
    grant_creation_tokens=["string"],
    name="string",
    retire_on_delete=False,
    retiring_principal="string")

    const grantResource = new aws.kms.Grant("grantResource", {
    granteePrincipal: "string",
    keyId: "string",
    operations: ["string"],
    constraints: [{
        encryptionContextEquals: {
            string: "string",
        },
        encryptionContextSubset: {
            string: "string",
        },
    }],
    grantCreationTokens: ["string"],
    name: "string",
    retireOnDelete: false,
    retiringPrincipal: "string",
});

    type: aws:kms:Grant
properties:
    constraints:
        - encryptionContextEquals:
            string: string
          encryptionContextSubset:
            string: string
    grantCreationTokens:
        - string
    granteePrincipal: string
    keyId: string
    name: string
    operations:
        - string
    retireOnDelete: false
    retiringPrincipal: string

    Grant Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    The Grant resource accepts the following input properties:

    GranteePrincipal string
    The principal that is given permission to perform the operations that the grant permits in ARN format. Note that due to eventual consistency issues around IAM principals, the providers's state may not always be refreshed to reflect what is true in AWS.
    KeyId string
    The unique identifier for the customer master key (CMK) that the grant applies to. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. To specify a CMK in a different AWS account, you must use the key ARN.
    Operations List<string>
    A list of operations that the grant permits. The permitted values are: Decrypt, Encrypt, GenerateDataKey, GenerateDataKeyWithoutPlaintext, ReEncryptFrom, ReEncryptTo, Sign, Verify, GetPublicKey, CreateGrant, RetireGrant, DescribeKey, GenerateDataKeyPair, or GenerateDataKeyPairWithoutPlaintext.
    Constraints List<GrantConstraint>
    A structure that you can use to allow certain operations in the grant only when the desired encryption context is present. For more information about encryption context, see Encryption Context.
    GrantCreationTokens List<string>
    A list of grant tokens to be used when creating the grant. See Grant Tokens for more information about grant tokens.
    Name string
    A friendly name for identifying the grant.
    RetireOnDelete bool
    If set to false (the default) the grants will be revoked upon deletion, and if set to true the grants will try to be retired upon deletion. Note that retiring grants requires special permissions, hence why we default to revoking grants. See RetireGrant for more information.
    RetiringPrincipal string
    The principal that is given permission to retire the grant by using RetireGrant operation in ARN format. Note that due to eventual consistency issues around IAM principals, the providers's state may not always be refreshed to reflect what is true in AWS.
    GranteePrincipal string
    The principal that is given permission to perform the operations that the grant permits in ARN format. Note that due to eventual consistency issues around IAM principals, the providers's state may not always be refreshed to reflect what is true in AWS.
    KeyId string
    The unique identifier for the customer master key (CMK) that the grant applies to. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. To specify a CMK in a different AWS account, you must use the key ARN.
    Operations []string
    A list of operations that the grant permits. The permitted values are: Decrypt, Encrypt, GenerateDataKey, GenerateDataKeyWithoutPlaintext, ReEncryptFrom, ReEncryptTo, Sign, Verify, GetPublicKey, CreateGrant, RetireGrant, DescribeKey, GenerateDataKeyPair, or GenerateDataKeyPairWithoutPlaintext.
    Constraints []GrantConstraintArgs
    A structure that you can use to allow certain operations in the grant only when the desired encryption context is present. For more information about encryption context, see Encryption Context.
    GrantCreationTokens []string
    A list of grant tokens to be used when creating the grant. See Grant Tokens for more information about grant tokens.
    Name string
    A friendly name for identifying the grant.
    RetireOnDelete bool
    If set to false (the default) the grants will be revoked upon deletion, and if set to true the grants will try to be retired upon deletion. Note that retiring grants requires special permissions, hence why we default to revoking grants. See RetireGrant for more information.
    RetiringPrincipal string
    The principal that is given permission to retire the grant by using RetireGrant operation in ARN format. Note that due to eventual consistency issues around IAM principals, the providers's state may not always be refreshed to reflect what is true in AWS.
    granteePrincipal String
    The principal that is given permission to perform the operations that the grant permits in ARN format. Note that due to eventual consistency issues around IAM principals, the providers's state may not always be refreshed to reflect what is true in AWS.
    keyId String
    The unique identifier for the customer master key (CMK) that the grant applies to. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. To specify a CMK in a different AWS account, you must use the key ARN.
    operations List<String>
    A list of operations that the grant permits. The permitted values are: Decrypt, Encrypt, GenerateDataKey, GenerateDataKeyWithoutPlaintext, ReEncryptFrom, ReEncryptTo, Sign, Verify, GetPublicKey, CreateGrant, RetireGrant, DescribeKey, GenerateDataKeyPair, or GenerateDataKeyPairWithoutPlaintext.
    constraints List<GrantConstraint>
    A structure that you can use to allow certain operations in the grant only when the desired encryption context is present. For more information about encryption context, see Encryption Context.
    grantCreationTokens List<String>
    A list of grant tokens to be used when creating the grant. See Grant Tokens for more information about grant tokens.
    name String
    A friendly name for identifying the grant.
    retireOnDelete Boolean
    If set to false (the default) the grants will be revoked upon deletion, and if set to true the grants will try to be retired upon deletion. Note that retiring grants requires special permissions, hence why we default to revoking grants. See RetireGrant for more information.
    retiringPrincipal String
    The principal that is given permission to retire the grant by using RetireGrant operation in ARN format. Note that due to eventual consistency issues around IAM principals, the providers's state may not always be refreshed to reflect what is true in AWS.
    granteePrincipal string
    The principal that is given permission to perform the operations that the grant permits in ARN format. Note that due to eventual consistency issues around IAM principals, the providers's state may not always be refreshed to reflect what is true in AWS.
    keyId string
    The unique identifier for the customer master key (CMK) that the grant applies to. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. To specify a CMK in a different AWS account, you must use the key ARN.
    operations string[]
    A list of operations that the grant permits. The permitted values are: Decrypt, Encrypt, GenerateDataKey, GenerateDataKeyWithoutPlaintext, ReEncryptFrom, ReEncryptTo, Sign, Verify, GetPublicKey, CreateGrant, RetireGrant, DescribeKey, GenerateDataKeyPair, or GenerateDataKeyPairWithoutPlaintext.
    constraints GrantConstraint[]
    A structure that you can use to allow certain operations in the grant only when the desired encryption context is present. For more information about encryption context, see Encryption Context.
    grantCreationTokens string[]
    A list of grant tokens to be used when creating the grant. See Grant Tokens for more information about grant tokens.
    name string
    A friendly name for identifying the grant.
    retireOnDelete boolean
    If set to false (the default) the grants will be revoked upon deletion, and if set to true the grants will try to be retired upon deletion. Note that retiring grants requires special permissions, hence why we default to revoking grants. See RetireGrant for more information.
    retiringPrincipal string
    The principal that is given permission to retire the grant by using RetireGrant operation in ARN format. Note that due to eventual consistency issues around IAM principals, the providers's state may not always be refreshed to reflect what is true in AWS.
    grantee_principal str
    The principal that is given permission to perform the operations that the grant permits in ARN format. Note that due to eventual consistency issues around IAM principals, the providers's state may not always be refreshed to reflect what is true in AWS.
    key_id str
    The unique identifier for the customer master key (CMK) that the grant applies to. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. To specify a CMK in a different AWS account, you must use the key ARN.
    operations Sequence[str]
    A list of operations that the grant permits. The permitted values are: Decrypt, Encrypt, GenerateDataKey, GenerateDataKeyWithoutPlaintext, ReEncryptFrom, ReEncryptTo, Sign, Verify, GetPublicKey, CreateGrant, RetireGrant, DescribeKey, GenerateDataKeyPair, or GenerateDataKeyPairWithoutPlaintext.
    constraints Sequence[GrantConstraintArgs]
    A structure that you can use to allow certain operations in the grant only when the desired encryption context is present. For more information about encryption context, see Encryption Context.
    grant_creation_tokens Sequence[str]
    A list of grant tokens to be used when creating the grant. See Grant Tokens for more information about grant tokens.
    name str
    A friendly name for identifying the grant.
    retire_on_delete bool
    If set to false (the default) the grants will be revoked upon deletion, and if set to true the grants will try to be retired upon deletion. Note that retiring grants requires special permissions, hence why we default to revoking grants. See RetireGrant for more information.
    retiring_principal str
    The principal that is given permission to retire the grant by using RetireGrant operation in ARN format. Note that due to eventual consistency issues around IAM principals, the providers's state may not always be refreshed to reflect what is true in AWS.
    granteePrincipal String
    The principal that is given permission to perform the operations that the grant permits in ARN format. Note that due to eventual consistency issues around IAM principals, the providers's state may not always be refreshed to reflect what is true in AWS.
    keyId String
    The unique identifier for the customer master key (CMK) that the grant applies to. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. To specify a CMK in a different AWS account, you must use the key ARN.
    operations List<String>
    A list of operations that the grant permits. The permitted values are: Decrypt, Encrypt, GenerateDataKey, GenerateDataKeyWithoutPlaintext, ReEncryptFrom, ReEncryptTo, Sign, Verify, GetPublicKey, CreateGrant, RetireGrant, DescribeKey, GenerateDataKeyPair, or GenerateDataKeyPairWithoutPlaintext.
    constraints List<Property Map>
    A structure that you can use to allow certain operations in the grant only when the desired encryption context is present. For more information about encryption context, see Encryption Context.
    grantCreationTokens List<String>
    A list of grant tokens to be used when creating the grant. See Grant Tokens for more information about grant tokens.
    name String
    A friendly name for identifying the grant.
    retireOnDelete Boolean
    If set to false (the default) the grants will be revoked upon deletion, and if set to true the grants will try to be retired upon deletion. Note that retiring grants requires special permissions, hence why we default to revoking grants. See RetireGrant for more information.
    retiringPrincipal String
    The principal that is given permission to retire the grant by using RetireGrant operation in ARN format. Note that due to eventual consistency issues around IAM principals, the providers's state may not always be refreshed to reflect what is true in AWS.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the Grant resource produces the following output properties:

    GrantId string
    The unique identifier for the grant.
    GrantToken string
    The grant token for the created grant. For more information, see Grant Tokens.
    Id string
    The provider-assigned unique ID for this managed resource.
    GrantId string
    The unique identifier for the grant.
    GrantToken string
    The grant token for the created grant. For more information, see Grant Tokens.
    Id string
    The provider-assigned unique ID for this managed resource.
    grantId String
    The unique identifier for the grant.
    grantToken String
    The grant token for the created grant. For more information, see Grant Tokens.
    id String
    The provider-assigned unique ID for this managed resource.
    grantId string
    The unique identifier for the grant.
    grantToken string
    The grant token for the created grant. For more information, see Grant Tokens.
    id string
    The provider-assigned unique ID for this managed resource.
    grant_id str
    The unique identifier for the grant.
    grant_token str
    The grant token for the created grant. For more information, see Grant Tokens.
    id str
    The provider-assigned unique ID for this managed resource.
    grantId String
    The unique identifier for the grant.
    grantToken String
    The grant token for the created grant. For more information, see Grant Tokens.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing Grant Resource

    Get an existing Grant resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: GrantState, opts?: CustomResourceOptions): Grant
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        constraints: Optional[Sequence[GrantConstraintArgs]] = None,
        grant_creation_tokens: Optional[Sequence[str]] = None,
        grant_id: Optional[str] = None,
        grant_token: Optional[str] = None,
        grantee_principal: Optional[str] = None,
        key_id: Optional[str] = None,
        name: Optional[str] = None,
        operations: Optional[Sequence[str]] = None,
        retire_on_delete: Optional[bool] = None,
        retiring_principal: Optional[str] = None) -> Grant
    func GetGrant(ctx *Context, name string, id IDInput, state *GrantState, opts ...ResourceOption) (*Grant, error)
    public static Grant Get(string name, Input<string> id, GrantState? state, CustomResourceOptions? opts = null)
    public static Grant get(String name, Output<String> id, GrantState state, CustomResourceOptions options)
    Resource lookup is not supported in YAML
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Constraints List<GrantConstraint>
    A structure that you can use to allow certain operations in the grant only when the desired encryption context is present. For more information about encryption context, see Encryption Context.
    GrantCreationTokens List<string>
    A list of grant tokens to be used when creating the grant. See Grant Tokens for more information about grant tokens.
    GrantId string
    The unique identifier for the grant.
    GrantToken string
    The grant token for the created grant. For more information, see Grant Tokens.
    GranteePrincipal string
    The principal that is given permission to perform the operations that the grant permits in ARN format. Note that due to eventual consistency issues around IAM principals, the providers's state may not always be refreshed to reflect what is true in AWS.
    KeyId string
    The unique identifier for the customer master key (CMK) that the grant applies to. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. To specify a CMK in a different AWS account, you must use the key ARN.
    Name string
    A friendly name for identifying the grant.
    Operations List<string>
    A list of operations that the grant permits. The permitted values are: Decrypt, Encrypt, GenerateDataKey, GenerateDataKeyWithoutPlaintext, ReEncryptFrom, ReEncryptTo, Sign, Verify, GetPublicKey, CreateGrant, RetireGrant, DescribeKey, GenerateDataKeyPair, or GenerateDataKeyPairWithoutPlaintext.
    RetireOnDelete bool
    If set to false (the default) the grants will be revoked upon deletion, and if set to true the grants will try to be retired upon deletion. Note that retiring grants requires special permissions, hence why we default to revoking grants. See RetireGrant for more information.
    RetiringPrincipal string
    The principal that is given permission to retire the grant by using RetireGrant operation in ARN format. Note that due to eventual consistency issues around IAM principals, the providers's state may not always be refreshed to reflect what is true in AWS.
    Constraints []GrantConstraintArgs
    A structure that you can use to allow certain operations in the grant only when the desired encryption context is present. For more information about encryption context, see Encryption Context.
    GrantCreationTokens []string
    A list of grant tokens to be used when creating the grant. See Grant Tokens for more information about grant tokens.
    GrantId string
    The unique identifier for the grant.
    GrantToken string
    The grant token for the created grant. For more information, see Grant Tokens.
    GranteePrincipal string
    The principal that is given permission to perform the operations that the grant permits in ARN format. Note that due to eventual consistency issues around IAM principals, the providers's state may not always be refreshed to reflect what is true in AWS.
    KeyId string
    The unique identifier for the customer master key (CMK) that the grant applies to. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. To specify a CMK in a different AWS account, you must use the key ARN.
    Name string
    A friendly name for identifying the grant.
    Operations []string
    A list of operations that the grant permits. The permitted values are: Decrypt, Encrypt, GenerateDataKey, GenerateDataKeyWithoutPlaintext, ReEncryptFrom, ReEncryptTo, Sign, Verify, GetPublicKey, CreateGrant, RetireGrant, DescribeKey, GenerateDataKeyPair, or GenerateDataKeyPairWithoutPlaintext.
    RetireOnDelete bool
    If set to false (the default) the grants will be revoked upon deletion, and if set to true the grants will try to be retired upon deletion. Note that retiring grants requires special permissions, hence why we default to revoking grants. See RetireGrant for more information.
    RetiringPrincipal string
    The principal that is given permission to retire the grant by using RetireGrant operation in ARN format. Note that due to eventual consistency issues around IAM principals, the providers's state may not always be refreshed to reflect what is true in AWS.
    constraints List<GrantConstraint>
    A structure that you can use to allow certain operations in the grant only when the desired encryption context is present. For more information about encryption context, see Encryption Context.
    grantCreationTokens List<String>
    A list of grant tokens to be used when creating the grant. See Grant Tokens for more information about grant tokens.
    grantId String
    The unique identifier for the grant.
    grantToken String
    The grant token for the created grant. For more information, see Grant Tokens.
    granteePrincipal String
    The principal that is given permission to perform the operations that the grant permits in ARN format. Note that due to eventual consistency issues around IAM principals, the providers's state may not always be refreshed to reflect what is true in AWS.
    keyId String
    The unique identifier for the customer master key (CMK) that the grant applies to. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. To specify a CMK in a different AWS account, you must use the key ARN.
    name String
    A friendly name for identifying the grant.
    operations List<String>
    A list of operations that the grant permits. The permitted values are: Decrypt, Encrypt, GenerateDataKey, GenerateDataKeyWithoutPlaintext, ReEncryptFrom, ReEncryptTo, Sign, Verify, GetPublicKey, CreateGrant, RetireGrant, DescribeKey, GenerateDataKeyPair, or GenerateDataKeyPairWithoutPlaintext.
    retireOnDelete Boolean
    If set to false (the default) the grants will be revoked upon deletion, and if set to true the grants will try to be retired upon deletion. Note that retiring grants requires special permissions, hence why we default to revoking grants. See RetireGrant for more information.
    retiringPrincipal String
    The principal that is given permission to retire the grant by using RetireGrant operation in ARN format. Note that due to eventual consistency issues around IAM principals, the providers's state may not always be refreshed to reflect what is true in AWS.
    constraints GrantConstraint[]
    A structure that you can use to allow certain operations in the grant only when the desired encryption context is present. For more information about encryption context, see Encryption Context.
    grantCreationTokens string[]
    A list of grant tokens to be used when creating the grant. See Grant Tokens for more information about grant tokens.
    grantId string
    The unique identifier for the grant.
    grantToken string
    The grant token for the created grant. For more information, see Grant Tokens.
    granteePrincipal string
    The principal that is given permission to perform the operations that the grant permits in ARN format. Note that due to eventual consistency issues around IAM principals, the providers's state may not always be refreshed to reflect what is true in AWS.
    keyId string
    The unique identifier for the customer master key (CMK) that the grant applies to. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. To specify a CMK in a different AWS account, you must use the key ARN.
    name string
    A friendly name for identifying the grant.
    operations string[]
    A list of operations that the grant permits. The permitted values are: Decrypt, Encrypt, GenerateDataKey, GenerateDataKeyWithoutPlaintext, ReEncryptFrom, ReEncryptTo, Sign, Verify, GetPublicKey, CreateGrant, RetireGrant, DescribeKey, GenerateDataKeyPair, or GenerateDataKeyPairWithoutPlaintext.
    retireOnDelete boolean
    If set to false (the default) the grants will be revoked upon deletion, and if set to true the grants will try to be retired upon deletion. Note that retiring grants requires special permissions, hence why we default to revoking grants. See RetireGrant for more information.
    retiringPrincipal string
    The principal that is given permission to retire the grant by using RetireGrant operation in ARN format. Note that due to eventual consistency issues around IAM principals, the providers's state may not always be refreshed to reflect what is true in AWS.
    constraints Sequence[GrantConstraintArgs]
    A structure that you can use to allow certain operations in the grant only when the desired encryption context is present. For more information about encryption context, see Encryption Context.
    grant_creation_tokens Sequence[str]
    A list of grant tokens to be used when creating the grant. See Grant Tokens for more information about grant tokens.
    grant_id str
    The unique identifier for the grant.
    grant_token str
    The grant token for the created grant. For more information, see Grant Tokens.
    grantee_principal str
    The principal that is given permission to perform the operations that the grant permits in ARN format. Note that due to eventual consistency issues around IAM principals, the providers's state may not always be refreshed to reflect what is true in AWS.
    key_id str
    The unique identifier for the customer master key (CMK) that the grant applies to. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. To specify a CMK in a different AWS account, you must use the key ARN.
    name str
    A friendly name for identifying the grant.
    operations Sequence[str]
    A list of operations that the grant permits. The permitted values are: Decrypt, Encrypt, GenerateDataKey, GenerateDataKeyWithoutPlaintext, ReEncryptFrom, ReEncryptTo, Sign, Verify, GetPublicKey, CreateGrant, RetireGrant, DescribeKey, GenerateDataKeyPair, or GenerateDataKeyPairWithoutPlaintext.
    retire_on_delete bool
    If set to false (the default) the grants will be revoked upon deletion, and if set to true the grants will try to be retired upon deletion. Note that retiring grants requires special permissions, hence why we default to revoking grants. See RetireGrant for more information.
    retiring_principal str
    The principal that is given permission to retire the grant by using RetireGrant operation in ARN format. Note that due to eventual consistency issues around IAM principals, the providers's state may not always be refreshed to reflect what is true in AWS.
    constraints List<Property Map>
    A structure that you can use to allow certain operations in the grant only when the desired encryption context is present. For more information about encryption context, see Encryption Context.
    grantCreationTokens List<String>
    A list of grant tokens to be used when creating the grant. See Grant Tokens for more information about grant tokens.
    grantId String
    The unique identifier for the grant.
    grantToken String
    The grant token for the created grant. For more information, see Grant Tokens.
    granteePrincipal String
    The principal that is given permission to perform the operations that the grant permits in ARN format. Note that due to eventual consistency issues around IAM principals, the providers's state may not always be refreshed to reflect what is true in AWS.
    keyId String
    The unique identifier for the customer master key (CMK) that the grant applies to. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. To specify a CMK in a different AWS account, you must use the key ARN.
    name String
    A friendly name for identifying the grant.
    operations List<String>
    A list of operations that the grant permits. The permitted values are: Decrypt, Encrypt, GenerateDataKey, GenerateDataKeyWithoutPlaintext, ReEncryptFrom, ReEncryptTo, Sign, Verify, GetPublicKey, CreateGrant, RetireGrant, DescribeKey, GenerateDataKeyPair, or GenerateDataKeyPairWithoutPlaintext.
    retireOnDelete Boolean
    If set to false (the default) the grants will be revoked upon deletion, and if set to true the grants will try to be retired upon deletion. Note that retiring grants requires special permissions, hence why we default to revoking grants. See RetireGrant for more information.
    retiringPrincipal String
    The principal that is given permission to retire the grant by using RetireGrant operation in ARN format. Note that due to eventual consistency issues around IAM principals, the providers's state may not always be refreshed to reflect what is true in AWS.

    Supporting Types

    GrantConstraint, GrantConstraintArgs

    EncryptionContextEquals Dictionary<string, string>
    A list of key-value pairs that must match the encryption context in subsequent cryptographic operation requests. The grant allows the operation only when the encryption context in the request is the same as the encryption context specified in this constraint. Conflicts with encryption_context_subset.
    EncryptionContextSubset Dictionary<string, string>
    A list of key-value pairs that must be included in the encryption context of subsequent cryptographic operation requests. The grant allows the cryptographic operation only when the encryption context in the request includes the key-value pairs specified in this constraint, although it can include additional key-value pairs. Conflicts with encryption_context_equals.
    EncryptionContextEquals map[string]string
    A list of key-value pairs that must match the encryption context in subsequent cryptographic operation requests. The grant allows the operation only when the encryption context in the request is the same as the encryption context specified in this constraint. Conflicts with encryption_context_subset.
    EncryptionContextSubset map[string]string
    A list of key-value pairs that must be included in the encryption context of subsequent cryptographic operation requests. The grant allows the cryptographic operation only when the encryption context in the request includes the key-value pairs specified in this constraint, although it can include additional key-value pairs. Conflicts with encryption_context_equals.
    encryptionContextEquals Map<String,String>
    A list of key-value pairs that must match the encryption context in subsequent cryptographic operation requests. The grant allows the operation only when the encryption context in the request is the same as the encryption context specified in this constraint. Conflicts with encryption_context_subset.
    encryptionContextSubset Map<String,String>
    A list of key-value pairs that must be included in the encryption context of subsequent cryptographic operation requests. The grant allows the cryptographic operation only when the encryption context in the request includes the key-value pairs specified in this constraint, although it can include additional key-value pairs. Conflicts with encryption_context_equals.
    encryptionContextEquals {[key: string]: string}
    A list of key-value pairs that must match the encryption context in subsequent cryptographic operation requests. The grant allows the operation only when the encryption context in the request is the same as the encryption context specified in this constraint. Conflicts with encryption_context_subset.
    encryptionContextSubset {[key: string]: string}
    A list of key-value pairs that must be included in the encryption context of subsequent cryptographic operation requests. The grant allows the cryptographic operation only when the encryption context in the request includes the key-value pairs specified in this constraint, although it can include additional key-value pairs. Conflicts with encryption_context_equals.
    encryption_context_equals Mapping[str, str]
    A list of key-value pairs that must match the encryption context in subsequent cryptographic operation requests. The grant allows the operation only when the encryption context in the request is the same as the encryption context specified in this constraint. Conflicts with encryption_context_subset.
    encryption_context_subset Mapping[str, str]
    A list of key-value pairs that must be included in the encryption context of subsequent cryptographic operation requests. The grant allows the cryptographic operation only when the encryption context in the request includes the key-value pairs specified in this constraint, although it can include additional key-value pairs. Conflicts with encryption_context_equals.
    encryptionContextEquals Map<String>
    A list of key-value pairs that must match the encryption context in subsequent cryptographic operation requests. The grant allows the operation only when the encryption context in the request is the same as the encryption context specified in this constraint. Conflicts with encryption_context_subset.
    encryptionContextSubset Map<String>
    A list of key-value pairs that must be included in the encryption context of subsequent cryptographic operation requests. The grant allows the cryptographic operation only when the encryption context in the request includes the key-value pairs specified in this constraint, although it can include additional key-value pairs. Conflicts with encryption_context_equals.

    Package Details

    Repository
    AWS Classic pulumi/pulumi-aws
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the aws Terraform Provider.
    aws logo

    Try AWS Native preview for resources not in the classic version.

    AWS Classic v6.42.0 published on Wednesday, Jun 26, 2024 by Pulumi
    pulumi/pulumi-aws