Grants
Opinion layer, less permanent than the rest
These are the AWS CDK's permission sets (Apache-2.0), copied at one commit.
They are opinion, not fact, and can change or move between releases. See Grants.
DynamoDb.Table
| Grant |
Actions |
Key actions |
Applies to |
DynamoDb.Table.read_data |
dynamodb:BatchGetItem
dynamodb:Query
dynamodb:GetItem
dynamodb:Scan
dynamodb:ConditionCheckItem
dynamodb:GetRecords
dynamodb:GetShardIterator
dynamodb:DescribeTable |
kms:Decrypt
kms:DescribeKey |
arn_and_indexes |
DynamoDb.Table.write_data |
dynamodb:BatchWriteItem
dynamodb:PutItem
dynamodb:UpdateItem
dynamodb:DeleteItem
dynamodb:DescribeTable |
kms:Decrypt
kms:DescribeKey
kms:Encrypt
kms:ReEncrypt*
kms:GenerateDataKey* |
arn_and_indexes |
DynamoDb.Table.read_write_data |
dynamodb:BatchGetItem
dynamodb:Query
dynamodb:GetItem
dynamodb:Scan
dynamodb:ConditionCheckItem
dynamodb:BatchWriteItem
dynamodb:PutItem
dynamodb:UpdateItem
dynamodb:DeleteItem
dynamodb:GetRecords
dynamodb:GetShardIterator
dynamodb:DescribeTable |
kms:Decrypt
kms:DescribeKey
kms:Encrypt
kms:ReEncrypt*
kms:GenerateDataKey* |
arn_and_indexes |
DynamoDb.Table.full_access |
dynamodb:* |
kms:Decrypt
kms:DescribeKey
kms:Encrypt
kms:ReEncrypt*
kms:GenerateDataKey* |
arn_and_indexes |
DynamoDb.Table.stream_read |
dynamodb:DescribeStream
dynamodb:GetRecords
dynamodb:GetShardIterator |
kms:Decrypt
kms:DescribeKey |
arn |
DynamoDb.Table.list_streams |
dynamodb:ListStreams |
|
any |
Events.EventBus
| Grant |
Actions |
Key actions |
Applies to |
Events.EventBus.all_put_events |
events:PutEvents |
|
any |
Kinesis.Stream
| Grant |
Actions |
Key actions |
Applies to |
Kinesis.Stream.read |
kinesis:DescribeStreamSummary
kinesis:GetRecords
kinesis:GetShardIterator
kinesis:ListShards
kinesis:SubscribeToShard
kinesis:DescribeStream
kinesis:ListStreams
kinesis:DescribeStreamConsumer |
kms:Decrypt |
arn |
Kinesis.Stream.write |
kinesis:ListShards
kinesis:PutRecord
kinesis:PutRecords |
kms:Encrypt
kms:ReEncrypt*
kms:GenerateDataKey* |
arn |
Kinesis.Stream.read_write |
kinesis:DescribeStreamSummary
kinesis:GetRecords
kinesis:GetShardIterator
kinesis:ListShards
kinesis:SubscribeToShard
kinesis:DescribeStream
kinesis:ListStreams
kinesis:DescribeStreamConsumer
kinesis:PutRecord
kinesis:PutRecords |
kms:Decrypt
kms:Encrypt
kms:ReEncrypt*
kms:GenerateDataKey* |
arn |
Kms.Key
| Grant |
Actions |
Key actions |
Applies to |
Kms.Key.admin |
kms:Create*
kms:Describe*
kms:Enable*
kms:List*
kms:Put*
kms:Update*
kms:Revoke*
kms:Disable*
kms:Get*
kms:Delete*
kms:TagResource
kms:UntagResource
kms:ScheduleKeyDeletion
kms:CancelKeyDeletion |
|
arn |
Kms.Key.decrypt |
kms:Decrypt |
|
arn |
Kms.Key.encrypt |
kms:Encrypt
kms:ReEncrypt*
kms:GenerateDataKey* |
|
arn |
Kms.Key.encrypt_decrypt |
kms:Decrypt
kms:Encrypt
kms:ReEncrypt*
kms:GenerateDataKey* |
|
arn |
Kms.Key.sign |
kms:Sign |
|
arn |
Kms.Key.verify |
kms:Verify |
|
arn |
Kms.Key.sign_verify |
kms:Sign
kms:Verify |
|
arn |
Kms.Key.generate_mac |
kms:GenerateMac |
|
arn |
Kms.Key.verify_mac |
kms:VerifyMac |
|
arn |
Lambda.Function
| Grant |
Actions |
Key actions |
Applies to |
Lambda.Function.invoke |
lambda:InvokeFunction |
|
arn |
Logs.LogGroup
| Grant |
Actions |
Key actions |
Applies to |
Logs.LogGroup.write |
logs:CreateLogStream
logs:PutLogEvents |
|
arn |
Logs.LogGroup.read |
logs:FilterLogEvents
logs:GetLogEvents
logs:GetLogGroupFields
logs:DescribeLogGroups
logs:DescribeLogStreams |
|
arn |
S3.Bucket
| Grant |
Actions |
Key actions |
Applies to |
S3.Bucket.read |
s3:GetObject*
s3:GetBucket*
s3:List* |
kms:Decrypt
kms:DescribeKey |
arn_and_objects |
S3.Bucket.put |
s3:PutObject
s3:PutObjectLegalHold
s3:PutObjectRetention
s3:PutObjectTagging
s3:PutObjectVersionTagging
s3:Abort* |
kms:Encrypt
kms:ReEncrypt*
kms:GenerateDataKey*
kms:Decrypt |
objects |
S3.Bucket.delete |
s3:DeleteObject* |
|
objects |
S3.Bucket.write |
s3:DeleteObject*
s3:PutObject
s3:PutObjectLegalHold
s3:PutObjectRetention
s3:PutObjectTagging
s3:PutObjectVersionTagging
s3:Abort* |
kms:Encrypt
kms:ReEncrypt*
kms:GenerateDataKey*
kms:Decrypt |
arn_and_objects |
S3.Bucket.put_acl |
s3:PutObjectAcl
s3:PutObjectVersionAcl |
|
objects |
S3.Bucket.read_write |
s3:GetObject*
s3:GetBucket*
s3:List*
s3:DeleteObject*
s3:PutObject
s3:PutObjectLegalHold
s3:PutObjectRetention
s3:PutObjectTagging
s3:PutObjectVersionTagging
s3:Abort* |
kms:Decrypt
kms:DescribeKey
kms:Encrypt
kms:ReEncrypt*
kms:GenerateDataKey* |
arn_and_objects |
SecretsManager.Secret
| Grant |
Actions |
Key actions |
Applies to |
SecretsManager.Secret.read |
secretsmanager:GetSecretValue
secretsmanager:DescribeSecret |
|
arn |
SecretsManager.Secret.write |
secretsmanager:PutSecretValue
secretsmanager:UpdateSecret
secretsmanager:UpdateSecretVersionStage |
|
arn |
Sns.Topic
| Grant |
Actions |
Key actions |
Applies to |
Sns.Topic.publish |
sns:Publish |
kms:Decrypt
kms:GenerateDataKey* |
arn |
Sns.Topic.subscribe |
sns:Subscribe |
|
arn |
Sqs.Queue
| Grant |
Actions |
Key actions |
Applies to |
Sqs.Queue.consume_messages |
sqs:ReceiveMessage
sqs:ChangeMessageVisibility
sqs:GetQueueUrl
sqs:DeleteMessage
sqs:GetQueueAttributes |
kms:Decrypt |
arn |
Sqs.Queue.send_messages |
sqs:SendMessage
sqs:GetQueueAttributes
sqs:GetQueueUrl |
kms:Decrypt
kms:Encrypt
kms:ReEncrypt*
kms:GenerateDataKey* |
arn |
Sqs.Queue.purge |
sqs:PurgeQueue
sqs:GetQueueAttributes
sqs:GetQueueUrl |
|
arn |
Ssm.Parameter
| Grant |
Actions |
Key actions |
Applies to |
Ssm.Parameter.read |
ssm:DescribeParameters
ssm:GetParameters
ssm:GetParameter
ssm:GetParameterHistory |
kms:Decrypt |
arn |