Package com.pulumi.aws.kms

Class Grant

  • public class Grant
extends com.pulumi.resources.CustomResource
    Provides a resource-based access control mechanism for a KMS customer master key. > **Note:** All arguments including the grant token will be stored in the raw state as plain-text. ## Import Using `pulumi import`, import KMS Grants using the Key ID and Grant ID separated by a colon (`:`). For example: ```sh $ pulumi import aws:kms/grant:Grant test 1234abcd-12ab-34cd-56ef-1234567890ab:abcde1237f76e4ba7987489ac329fbfba6ad343d6f7075dbd1ef191f0120514 ```

    • Nested Class Summary

      • Nested classes/interfaces inherited from class com.pulumi.resources.CustomResource

        com.pulumi.resources.CustomResource.CustomResourceInternal

      • Nested classes/interfaces inherited from class com.pulumi.resources.Resource

        com.pulumi.resources.Resource.LazyField<T extends java.lang.Object>, com.pulumi.resources.Resource.LazyFields, com.pulumi.resources.Resource.ResourceInternal

    • Field Summary

      • Fields inherited from class com.pulumi.resources.Resource

        childResources, remote

    • Constructor Summary

      Constructors 
      Constructor Description
      Grant​(java.lang.String name)  
      Grant​(java.lang.String name, GrantArgs args)  
      Grant​(java.lang.String name, GrantArgs args, com.pulumi.resources.CustomResourceOptions options)  

    • Method Summary

      All Methods Static Methods Instance Methods Concrete Methods 
      Modifier and Type Method Description
      com.pulumi.core.Output<java.util.Optional<java.util.List<GrantConstraint>>> constraints()  
      static Grant get​(java.lang.String name, com.pulumi.core.Output<java.lang.String> id, GrantState state, com.pulumi.resources.CustomResourceOptions options)
      Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.
      com.pulumi.core.Output<java.util.Optional<java.util.List<java.lang.String>>> grantCreationTokens()  
      com.pulumi.core.Output<java.lang.String> granteePrincipal()  
      com.pulumi.core.Output<java.lang.String> grantId()  
      com.pulumi.core.Output<java.lang.String> grantToken()  
      com.pulumi.core.Output<java.lang.String> keyId()  
      com.pulumi.core.Output<java.lang.String> name()  
      com.pulumi.core.Output<java.util.List<java.lang.String>> operations()  
      com.pulumi.core.Output<java.lang.String> region()  
      com.pulumi.core.Output<java.util.Optional<java.lang.Boolean>> retireOnDelete()  
      com.pulumi.core.Output<java.util.Optional<java.lang.String>> retiringPrincipal()  

      • Methods inherited from class com.pulumi.resources.CustomResource

        getId, id, idFuture

      • Methods inherited from class com.pulumi.resources.Resource

        getChildResources, getResourceName, getResourceType, getUrn, pulumiChildResources, pulumiResourceName, pulumiResourceType, urn

      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    • Constructor Detail

      • Grant

        public Grant​(java.lang.String name)
        Parameters:
        name - The _unique_ name of the resulting resource.

      • Grant

        public Grant​(java.lang.String name,
             GrantArgs args)
        Parameters:
        name - The _unique_ name of the resulting resource.
        args - The arguments to use to populate this resource's properties.

      • Grant

        public Grant​(java.lang.String name,
             GrantArgs args,
             @Nullable
             com.pulumi.resources.CustomResourceOptions options)
        Parameters:
        name - The _unique_ name of the resulting resource.
        args - The arguments to use to populate this resource's properties.
        options - A bag of options that control this resource's behavior.

    • Method Detail

      • constraints

        public com.pulumi.core.Output<java.util.Optional<java.util.List<GrantConstraint>>> constraints()
        Returns:
        Structure that you can use to allow certain operations in the grant only when the desired encryption context is present. See `constraints` Block for details. For more information about encryption context, see [Encryption Context](https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html).

      • grantCreationTokens

        public com.pulumi.core.Output<java.util.Optional<java.util.List<java.lang.String>>> grantCreationTokens()
        Returns:
        List of grant tokens to be used when creating the grant. See [Grant Tokens](https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token) for more information about grant tokens.

      • grantId

        public com.pulumi.core.Output<java.lang.String> grantId()
        Returns:
        Unique identifier for the grant.

      • grantToken

        public com.pulumi.core.Output<java.lang.String> grantToken()
        Returns:
        Grant token for the created grant. For more information, see [Grant Tokens](https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token).

      • granteePrincipal

        public com.pulumi.core.Output<java.lang.String> granteePrincipal()
        Returns:
        Principal that is given permission to perform the operations that the grant permits in ARN format. Note that due to eventual consistency issues around IAM principals, Terraform's state may not always be refreshed to reflect what is true in AWS.

      • keyId

        public com.pulumi.core.Output<java.lang.String> keyId()
        Returns:
        Unique identifier for the customer master key (CMK) that the grant applies to. Specify the key ID or the ARN of the CMK. To specify a CMK in a different AWS account, you must use the key ARN.

      • name

        public com.pulumi.core.Output<java.lang.String> name()
        Returns:
        Friendly name for identifying the grant.

      • operations

        public com.pulumi.core.Output<java.util.List<java.lang.String>> operations()
        Returns:
        List of operations that the grant permits. The permitted values are: `Decrypt`, `Encrypt`, `GenerateDataKey`, `GenerateDataKeyWithoutPlaintext`, `ReEncryptFrom`, `ReEncryptTo`, `Sign`, `Verify`, `GetPublicKey`, `CreateGrant`, `RetireGrant`, `DescribeKey`, `GenerateDataKeyPair`, or `GenerateDataKeyPairWithoutPlaintext`.

      • region

        public com.pulumi.core.Output<java.lang.String> region()
        Returns:
        Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.

      • retireOnDelete

        public com.pulumi.core.Output<java.util.Optional<java.lang.Boolean>> retireOnDelete()
        Returns:
        If set to false (the default) the grants will be revoked upon deletion, and if set to true the grants will try to be retired upon deletion. Note that retiring grants requires special permissions, hence why we default to revoking grants. See [RetireGrant](https://docs.aws.amazon.com/kms/latest/APIReference/API_RetireGrant.html) for more information.

      • retiringPrincipal

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> retiringPrincipal()
        Returns:
        Principal that is given permission to retire the grant by using RetireGrant operation in ARN format. Note that due to eventual consistency issues around IAM principals, Terraform's state may not always be refreshed to reflect what is true in AWS.

      • get

        public static Grant get​(java.lang.String name,
                        com.pulumi.core.Output<java.lang.String> id,
                        @Nullable
                        GrantState state,
                        @Nullable
                        com.pulumi.resources.CustomResourceOptions options)
        Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.
        Parameters:
        name - The _unique_ name of the resulting resource.
        id - The _unique_ provider ID of the resource to lookup.
        state -
        options - Optional settings to control the behavior of the CustomResource.