/*
* Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
*
* Licensed under the Apache License, Version 2.0 (the "License").
* You may not use this file except in compliance with the License.
* A copy of the License is located at
*
* http://aws.amazon.com/apache2.0
*
* or in the "license" file accompanying this file. This file is distributed
* on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied. See the License for the specific language governing
* permissions and limitations under the License.
*/
/*
* Do not modify this file. This file is generated from the kms-2014-11-01.normal.json service model.
*/
using System;
using System.Collections.Generic;
using System.Xml.Serialization;
using System.Text;
using System.IO;
using System.Net;
using Amazon.Runtime;
using Amazon.Runtime.Internal;
namespace Amazon.KeyManagementService.Model
{
///
/// Container for the parameters to the CreateGrant operation.
/// Adds a grant to a KMS key.
///
///
///
/// A grant is a policy instrument that allows Amazon Web Services principals to
/// use KMS keys in cryptographic operations. It also can allow them to view a KMS key
/// (DescribeKey) and create and manage grants. When authorizing access to a KMS
/// key, grants are considered along with key policies and IAM policies. Grants are often
/// used for temporary permissions because you can create one, use its permissions, and
/// delete it without changing your key policies or IAM policies.
///
///
///
/// For detailed information about grants, including grant terminology, see Grants
/// in KMS in the Key Management Service Developer Guide . For examples
/// of working with grants in several programming languages, see Programming
/// grants.
///
///
///
/// The CreateGrant operation returns a GrantToken and a GrantId.
///
/// -
///
/// When you create, retire, or revoke a grant, there might be a brief delay, usually
/// less than five minutes, until the grant is available throughout KMS. This state is
/// known as eventual consistency. Once the grant has achieved eventual consistency,
/// the grantee principal can use the permissions in the grant without identifying the
/// grant.
///
///
///
/// However, to use the permissions in the grant immediately, use the
GrantToken
/// that CreateGrant returns. For details, see Using
/// a grant token in the Key Management Service Developer Guide .
///
/// -
///
/// The
CreateGrant operation also returns a GrantId. You can
/// use the GrantId and a key identifier to identify the grant in the RetireGrant
/// and RevokeGrant operations. To find the grant ID, use the ListGrants
/// or ListRetirableGrants operations.
///
///
///
/// The KMS key that you use for this operation must be in a compatible key state. For
/// details, see Key
/// states of KMS keys in the Key Management Service Developer Guide.
///
///
///
/// Cross-account use: Yes. To perform this operation on a KMS key in a different
/// Amazon Web Services account, specify the key ARN in the value of the KeyId
/// parameter.
///
///
///
/// Required permissions: kms:CreateGrant
/// (key policy)
///
///
///
/// Related operations:
///
///
///
public partial class CreateGrantRequest : AmazonKeyManagementServiceRequest
{
private GrantConstraints _constraints;
private bool? _dryRun;
private string _granteePrincipal;
private List _grantTokens = new List();
private string _keyId;
private string _name;
private List _operations = new List();
private string _retiringPrincipal;
///
/// Gets and sets the property Constraints.
///
/// Specifies a grant constraint.
///
///
///
/// Do not include confidential or sensitive information in this field. This field may
/// be displayed in plaintext in CloudTrail logs and other output.
///
///
///
/// KMS supports the EncryptionContextEquals and EncryptionContextSubset
/// grant constraints, which allow the permissions in the grant only when the encryption
/// context in the request matches (EncryptionContextEquals) or includes
/// (EncryptionContextSubset) the encryption context specified in the constraint.
///
///
///
///
/// The encryption context grant constraints are supported only on grant
/// operations that include an EncryptionContext parameter, such as cryptographic
/// operations on symmetric encryption KMS keys. Grants with grant constraints can include
/// the DescribeKey and RetireGrant operations, but the constraint doesn't
/// apply to these operations. If a grant with a grant constraint includes the CreateGrant
/// operation, the constraint requires that any grants created with the CreateGrant
/// permission have an equally strict or stricter encryption context constraint.
///
///
///
/// You cannot use an encryption context grant constraint for cryptographic operations
/// with asymmetric KMS keys or HMAC KMS keys. Operations with these keys don't support
/// an encryption context.
///
///
///
/// Each constraint value can include up to 8 encryption context pairs. The encryption
/// context value in each constraint cannot exceed 384 characters. For information about
/// grant constraints, see Using
/// grant constraints in the Key Management Service Developer Guide. For more
/// information about encryption context, see Encryption
/// context in the Key Management Service Developer Guide .
///
///
public GrantConstraints Constraints
{
get { return this._constraints; }
set { this._constraints = value; }
}
// Check to see if Constraints property is set
internal bool IsSetConstraints()
{
return this._constraints != null;
}
///
/// Gets and sets the property DryRun.
///
/// Checks if your request will succeed. DryRun is an optional parameter.
///
///
///
///
/// To learn more about how to use this parameter, see Testing
/// your KMS API calls in the Key Management Service Developer Guide.
///
///
public bool DryRun
{
get { return this._dryRun.GetValueOrDefault(); }
set { this._dryRun = value; }
}
// Check to see if DryRun property is set
internal bool IsSetDryRun()
{
return this._dryRun.HasValue;
}
///
/// Gets and sets the property GranteePrincipal.
///
/// The identity that gets the permissions specified in the grant.
///
///
///
/// To specify the grantee principal, use the Amazon Resource Name (ARN) of an Amazon
/// Web Services principal. Valid principals include Amazon Web Services accounts, IAM
/// users, IAM roles, federated users, and assumed role users. For help with the ARN syntax
/// for a principal, see IAM
/// ARNs in the Identity and Access Management User Guide .
///
///
[AWSProperty(Required=true, Min=1, Max=256)]
public string GranteePrincipal
{
get { return this._granteePrincipal; }
set { this._granteePrincipal = value; }
}
// Check to see if GranteePrincipal property is set
internal bool IsSetGranteePrincipal()
{
return this._granteePrincipal != null;
}
///
/// Gets and sets the property GrantTokens.
///
/// A list of grant tokens.
///
///
///
/// Use a grant token when your permission to call this operation comes from a new grant
/// that has not yet achieved eventual consistency. For more information, see Grant
/// token and Using
/// a grant token in the Key Management Service Developer Guide.
///
///
[AWSProperty(Min=0, Max=10)]
public List GrantTokens
{
get { return this._grantTokens; }
set { this._grantTokens = value; }
}
// Check to see if GrantTokens property is set
internal bool IsSetGrantTokens()
{
return this._grantTokens != null && this._grantTokens.Count > 0;
}
///
/// Gets and sets the property KeyId.
///
/// Identifies the KMS key for the grant. The grant gives principals permission to use
/// this KMS key.
///
///
///
/// Specify the key ID or key ARN of the KMS key. To specify a KMS key in a different
/// Amazon Web Services account, you must use the key ARN.
///
///
///
/// For example:
///
/// -
///
/// Key ID:
1234abcd-12ab-34cd-56ef-1234567890ab
///
/// -
///
/// Key ARN:
arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
///
///
///
///
/// To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey.
///
///
[AWSProperty(Required=true, Min=1, Max=2048)]
public string KeyId
{
get { return this._keyId; }
set { this._keyId = value; }
}
// Check to see if KeyId property is set
internal bool IsSetKeyId()
{
return this._keyId != null;
}
///
/// Gets and sets the property Name.
///
/// A friendly name for the grant. Use this value to prevent the unintended creation of
/// duplicate grants when retrying this request.
///
///
///
/// Do not include confidential or sensitive information in this field. This field may
/// be displayed in plaintext in CloudTrail logs and other output.
///
///
///
/// When this value is absent, all CreateGrant requests result in a new grant
/// with a unique GrantId even if all the supplied parameters are identical.
/// This can result in unintended duplicates when you retry the CreateGrant
/// request.
///
///
///
/// When this value is present, you can retry a CreateGrant request with
/// identical parameters; if the grant already exists, the original GrantId
/// is returned without creating a new grant. Note that the returned grant token is unique
/// with every CreateGrant request, even when a duplicate GrantId
/// is returned. All grant tokens for the same grant ID can be used interchangeably.
///
///
[AWSProperty(Min=1, Max=256)]
public string Name
{
get { return this._name; }
set { this._name = value; }
}
// Check to see if Name property is set
internal bool IsSetName()
{
return this._name != null;
}
///
/// Gets and sets the property Operations.
///
/// A list of operations that the grant permits.
///
///
///
/// This list must include only operations that are permitted in a grant. Also, the operation
/// must be supported on the KMS key. For example, you cannot create a grant for a symmetric
/// encryption KMS key that allows the Sign operation, or a grant for an asymmetric
/// KMS key that allows the GenerateDataKey operation. If you try, KMS returns
/// a ValidationError exception. For details, see Grant
/// operations in the Key Management Service Developer Guide.
///
///
[AWSProperty(Required=true)]
public List Operations
{
get { return this._operations; }
set { this._operations = value; }
}
// Check to see if Operations property is set
internal bool IsSetOperations()
{
return this._operations != null && this._operations.Count > 0;
}
///
/// Gets and sets the property RetiringPrincipal.
///
/// The principal that has permission to use the RetireGrant operation to retire
/// the grant.
///
///
///
/// To specify the principal, use the Amazon
/// Resource Name (ARN) of an Amazon Web Services principal. Valid principals include
/// Amazon Web Services accounts, IAM users, IAM roles, federated users, and assumed role
/// users. For help with the ARN syntax for a principal, see IAM
/// ARNs in the Identity and Access Management User Guide .
///
///
///
/// The grant determines the retiring principal. Other principals might have permission
/// to retire the grant or revoke the grant. For details, see RevokeGrant and Retiring
/// and revoking grants in the Key Management Service Developer Guide.
///
///
[AWSProperty(Min=1, Max=256)]
public string RetiringPrincipal
{
get { return this._retiringPrincipal; }
set { this._retiringPrincipal = value; }
}
// Check to see if RetiringPrincipal property is set
internal bool IsSetRetiringPrincipal()
{
return this._retiringPrincipal != null;
}
}
}