Network.AWS.KMS.CreateGrant

Adds a grant to a key to specify who can access the key and under what conditions. Grants are alternate permission mechanisms to key policies. If absent, access to the key is evaluated based on IAM policies attached to the user. By default, grants do not expire. Grants can be listed, retired, or revoked as indicated by the following APIs. Typically, when you are finished using a grant, you retire it. When you want to end a grant immediately, revoke it. For more information about grants, see Grants. ListGrants RetireGrant RevokeGrant

http://docs.aws.amazon.com/kms/latest/APIReference/API_CreateGrant.html

Request

data CreateGrant

Instances

Eq CreateGrant

Show CreateGrant

ToJSON CreateGrant

AWSRequest CreateGrant

ToQuery CreateGrant

ToHeaders CreateGrant

ToPath CreateGrant

type Rs CreateGrant = CreateGrantResponse

type Sv CreateGrant = KMS

Request constructor

createGrant

Arguments

:: Text

cgKeyId

-> Text

cgGranteePrincipal

-> CreateGrant

CreateGrant constructor.

The fields accessible through corresponding lenses are:

• cgConstraints :: Maybe GrantConstraints
• cgGrantTokens :: [Text]
• cgGranteePrincipal :: Text
• cgKeyId :: Text
• cgOperations :: [GrantOperation]
• cgRetiringPrincipal :: Maybe Text

Request lenses

cgConstraints :: Lens' CreateGrant (Maybe GrantConstraints)

Specifies the conditions under which the actions specified by the Operations parameter are allowed.

cgGrantTokens :: Lens' CreateGrant [Text]

List of grant tokens.

cgGranteePrincipal :: Lens' CreateGrant Text

Principal given permission by the grant to use the key identified by the keyId parameter.

cgKeyId :: Lens' CreateGrant Text

A unique key identifier for a customer master key. This value can be a globally unique identifier, an ARN, or an alias.

cgOperations :: Lens' CreateGrant [GrantOperation]

List of operations permitted by the grant. This can be any combination of one or more of the following values: Decrypt Encrypt GenerateDataKey GenerateDataKeyWithoutPlaintext ReEncryptFrom ReEncryptTo CreateGrant

cgRetiringPrincipal :: Lens' CreateGrant (Maybe Text)

Principal given permission to retire the grant. For more information, see RetireGrant.

Response

data CreateGrantResponse

Instances

Eq CreateGrantResponse

Ord CreateGrantResponse

Show CreateGrantResponse

FromJSON CreateGrantResponse

Response constructor

createGrantResponse :: CreateGrantResponse

CreateGrantResponse constructor.

The fields accessible through corresponding lenses are:

• cgrGrantId :: Maybe Text
• cgrGrantToken :: Maybe Text

Response lenses

cgrGrantId :: Lens' CreateGrantResponse (Maybe Text)

Unique grant identifier. You can use the GrantId value to revoke a grant.

cgrGrantToken :: Lens' CreateGrantResponse (Maybe Text)

The grant token. A grant token is a string that identifies a grant and which can be used to make a grant take effect immediately. A token contains all of the information necessary to create a grant.