Skip to content

KmsGrantConfiguration

Source code in docs_src/capo_accessanalyzer/types/kms_grant_configuration.py 
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
class KmsGrantConfiguration(TypedDict, closed=True):
    operations: (
        "capo_accessanalyzer.types.kms_grant_operations_list.KmsGrantOperationsList"
    )
    """<p>A list of operations that the grant permits.</p>"""
    grantee_principal: "capo_accessanalyzer.types.grantee_principal.GranteePrincipal"
    """<p>The principal that is given permission to perform the operations that the grant permits.</p>"""
    retiring_principal: NotRequired[
        "capo_accessanalyzer.types.retiring_principal.RetiringPrincipal"
    ]
    """<p>The principal that is given permission to retire the grant by using <a href="https://docs.aws.amazon.com/kms/latest/APIReference/API_RetireGrant.html">RetireGrant</a> operation.</p>"""
    constraints: NotRequired[
        "capo_accessanalyzer.types.kms_grant_constraints.KmsGrantConstraints"
    ]
    """<p>Use this structure to propose allowing <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations">cryptographic operations</a> in the grant only when the operation request includes the specified <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">encryption context</a>.</p>"""
    issuing_account: "capo_accessanalyzer.types.issuing_account.IssuingAccount"
    """<p> The Amazon Web Services account under which the grant was issued. The account is used to propose KMS grants issued by accounts other than the owner of the key.</p>"""

constraints instance-attribute 

constraints: NotRequired[KmsGrantConstraints]

Use this structure to propose allowing cryptographic operations in the grant only when the operation request includes the specified encryption context.

grantee_principal instance-attribute 

grantee_principal: GranteePrincipal

The principal that is given permission to perform the operations that the grant permits.

issuing_account instance-attribute 

issuing_account: IssuingAccount

The Amazon Web Services account under which the grant was issued. The account is used to propose KMS grants issued by accounts other than the owner of the key.

operations instance-attribute 

operations: KmsGrantOperationsList

A list of operations that the grant permits.

retiring_principal instance-attribute 

retiring_principal: NotRequired[RetiringPrincipal]

The principal that is given permission to retire the grant by using RetireGrant operation.