aws-cdk-lib/aws-dynamodb/lib/table-grants.d.ts

Version 2 of the AWS Cloud Development Kit library

import { ITableRef } from './dynamodb.generated';
import * as iam from '../../aws-iam';
/**
 * Construction properties for TableGrants
 */
export interface TableGrantsProps {
    /**
     * The table to grant permissions on
     */
    readonly table: ITableRef;
    /**
     * Additional regions other than the main one that this table is replicated to
     *
     * @default - No regions
     */
    readonly regions?: string[];
    /**
     * Whether this table has indexes
     *
     * If so, permissions are granted on all table indexes as well.
     *
     * @default false
     */
    readonly hasIndex?: boolean;
    /**
     * The encrypted resource on which actions will be allowed
     *
     * @default - No permission is added to the KMS key, even if it exists
     */
    readonly encryptedResource?: iam.IEncryptedResource;
    /**
     * The resource with policy on which actions will be allowed
     *
     * @default - No resource policy is created
     */
    readonly policyResource?: iam.IResourceWithPolicyV2;
}
/**
 * A set of permissions to grant on a Table
 */
export declare class TableGrants {
    private readonly table;
    private readonly arns;
    private readonly encryptedResource?;
    private readonly policyResource?;
    constructor(props: TableGrantsProps);
    /**
     * Adds an IAM policy statement associated with this table to an IAM
     * principal's policy.
     *
     * If `encryptionKey` is present, appropriate grants to the key needs to be added
     * separately using the `table.encryptionKey.grant*` methods.
     *
     * @param grantee The principal (no-op if undefined)
     * @param actions The set of actions to allow (i.e. "dynamodb:PutItem", "dynamodb:GetItem", ...)
     */
    actions(grantee: iam.IGrantable, ...actions: string[]): iam.Grant;
    /**
     * Permits an IAM principal all data read operations from this table:
     * BatchGetItem, GetRecords, GetShardIterator, Query, GetItem, Scan, DescribeTable.
     *
     * Appropriate grants will also be added to the customer-managed KMS key
     * if one was configured.
     *
     * @param grantee The principal to grant access to
     */
    readData(grantee: iam.IGrantable): iam.Grant;
    /**
     * Permits an IAM principal all data write operations to this table:
     * BatchWriteItem, PutItem, UpdateItem, DeleteItem, DescribeTable.
     *
     * Appropriate grants will also be added to the customer-managed KMS key
     * if one was configured.
     *
     * @param grantee The principal to grant access to
     */
    writeData(grantee: iam.IGrantable): iam.Grant;
    /**
     * Permits an IAM principal to all data read/write operations to this table.
     * BatchGetItem, GetRecords, GetShardIterator, Query, GetItem, Scan,
     * BatchWriteItem, PutItem, UpdateItem, DeleteItem, DescribeTable
     *
     * Appropriate grants will also be added to the customer-managed KMS key
     * if one was configured.
     *
     * @param grantee The principal to grant access to
     */
    readWriteData(grantee: iam.IGrantable): iam.Grant;
    /**
     * Permits all DynamoDB operations ("dynamodb:*") to an IAM principal.
     *
     * Appropriate grants will also be added to the customer-managed KMS key
     * if one was configured.
     *
     * @param grantee The principal to grant access to
     */
    fullAccess(grantee: iam.IGrantable): iam.Grant;
}