295295% % Example:
296296% % grant_constraints() :: #{
297297% % <<"EncryptionContextEquals">> => map(),
298- % % <<"EncryptionContextSubset">> => map()
298+ % % <<"EncryptionContextSubset">> => map(),
299+ % % <<"SourceArn">> => string()
299300% % }
300301-type grant_constraints () :: #{binary () => any ()}.
301302
309310% % list_retirable_grants_request() :: #{
310311% % <<"Limit">> => integer(),
311312% % <<"Marker">> => string(),
312- % % <<"RetiringPrincipal">> := string()
313+ % % <<"RetiringPrincipal">> => string(),
314+ % % <<"RetiringServicePrincipal">> => string()
313315% % }
314316-type list_retirable_grants_request () :: #{binary () => any ()}.
315317
491493% % list_grants_request() :: #{
492494% % <<"GrantId">> => string(),
493495% % <<"GranteePrincipal">> => string(),
496+ % % <<"GranteeServicePrincipal">> => string(),
494497% % <<"KeyId">> := string(),
495498% % <<"Limit">> => integer(),
496499% % <<"Marker">> => string()
814817% % <<"Constraints">> => grant_constraints(),
815818% % <<"DryRun">> => boolean(),
816819% % <<"GrantTokens">> => list(string()),
817- % % <<"GranteePrincipal">> := string(),
820+ % % <<"GranteePrincipal">> => string(),
821+ % % <<"GranteeServicePrincipal">> => string(),
818822% % <<"KeyId">> := string(),
819823% % <<"Name">> => string(),
820824% % <<"Operations">> := list(list(any())()),
821- % % <<"RetiringPrincipal">> => string()
825+ % % <<"RetiringPrincipal">> => string(),
826+ % % <<"RetiringServicePrincipal">> => string()
822827% % }
823828-type create_grant_request () :: #{binary () => any ()}.
824829
10971102% % <<"CreationDate">> => non_neg_integer(),
10981103% % <<"GrantId">> => string(),
10991104% % <<"GranteePrincipal">> => string(),
1105+ % % <<"GranteeServicePrincipal">> => string(),
11001106% % <<"IssuingAccount">> => string(),
11011107% % <<"KeyId">> => string(),
11021108% % <<"Name">> => string(),
11031109% % <<"Operations">> => list(list(any())()),
1104- % % <<"RetiringPrincipal">> => string()
1110+ % % <<"RetiringPrincipal">> => string(),
1111+ % % <<"RetiringServicePrincipal">> => string()
11051112% % }
11061113-type grant_list_entry () :: #{binary () => any ()}.
11071114
@@ -2406,6 +2413,14 @@ create_custom_key_store(Client, Input, Options)
24062413% % delete it without
24072414% % changing your key policies or IAM policies.
24082415% %
2416+ % % You can create a grant for an Amazon Web Services principal (IAM user, IAM
2417+ % % role, or Amazon Web Services account) by
2418+ % % specifying the `GranteePrincipal' parameter. You can also create a
2419+ % % grant for an
2420+ % % Amazon Web Services service principal by specifying the
2421+ % % `GranteeServicePrincipal'
2422+ % % parameter.
2423+ % %
24092424% % For detailed information about grants, including grant terminology, see
24102425% % Grants in KMS:
24112426% % https://docs.aws.amazon.com/kms/latest/developerguide/grants.html in the
@@ -5255,8 +5270,8 @@ list_aliases(Client, Input, Options)
52555270% % @doc Gets a list of all grants for the specified KMS key.
52565271% %
52575272% % You must specify the KMS key in all requests. You can filter the grant
5258- % % list by grant ID or
5259- % % grantee principal.
5273+ % % list by grant ID,
5274+ % % grantee principal, or grantee service principal .
52605275% %
52615276% % For detailed information about grants, including grant terminology, see
52625277% % Grants in KMS:
@@ -5268,16 +5283,23 @@ list_aliases(Client, Input, Options)
52685283% % or CLI:
52695284% % https://docs.aws.amazon.com/kms/latest/developerguide/example_kms_CreateGrant_section.html.
52705285% %
5271- % % The `GranteePrincipal' field in the `ListGrants' response usually
5272- % % contains the
5273- % % user or role designated as the grantee principal in the grant. However,
5274- % % when the grantee
5275- % % principal in the grant is an Amazon Web Services service, the
5276- % % `GranteePrincipal' field contains
5277- % % the service
5278- % % principal:
5286+ % % When a grant is created with the `GranteePrincipal' field, the
5287+ % % `ListGrants'
5288+ % % response usually contains the user or role designated as the grantee
5289+ % % principal in the grant. However, if the grantee principal
5290+ % % is an Amazon Web Services service, the `GranteePrincipal' field
5291+ % % contains an Amazon Web Services service principal:
52795292% % https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-services,
5280- % % which might represent several different grantee principals.
5293+ % % which
5294+ % % might correspond to several different grantee principals, such as an IAM
5295+ % % user, IAM role, or Amazon Web Services account.
5296+ % %
5297+ % % When a grant is created with the `GranteeServicePrincipal' field, the
5298+ % % `ListGrants'
5299+ % % response always includes a `GranteeServicePrincipal' that indicates
5300+ % % the grantee is actually
5301+ % % an Amazon Web Services service principal:
5302+ % % https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-services.
52815303% %
52825304% % Cross-account use: Yes. To perform this operation on a KMS key in a
52835305% % different Amazon Web Services account, specify the key
@@ -5501,7 +5523,7 @@ list_resource_tags(Client, Input, Options)
55015523
55025524% % @doc Returns information about all grants in the Amazon Web Services
55035525% % account and Region that have the
5504- % % specified retiring principal.
5526+ % % specified retiring principal or retiring service principal .
55055527% %
55065528% % You can specify any principal in your Amazon Web Services account. The
55075529% % grants that are returned include
@@ -5536,7 +5558,8 @@ list_resource_tags(Client, Input, Options)
55365558% % (IAM policy) in your
55375559% % Amazon Web Services account.
55385560% %
5539- % % KMS authorizes `ListRetirableGrants' requests by evaluating the caller
5561+ % % When listing retirable grants by `RetiringPrincipal', KMS authorizes
5562+ % % `ListRetirableGrants' requests by evaluating the caller
55405563% % account's kms:ListRetirableGrants permissions. The authorized resource
55415564% % in
55425565% % `ListRetirableGrants' calls is the retiring principal specified in the
@@ -5545,6 +5568,9 @@ list_resource_tags(Client, Input, Options)
55455568% % to any KMS keys or
55465569% % grants that might be returned by the `ListRetirableGrants' call.
55475570% %
5571+ % % The `RetiringServicePrincipal' filter is only usable by callers in a
5572+ % % service principal.
5573+ % %
55485574% % Related operations:
55495575% %
55505576% % `CreateGrant'
@@ -5700,6 +5726,11 @@ put_key_policy(Client, Input, Options)
57005726% % https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html in
57015727% % the Key Management Service Developer Guide.
57025728% %
5729+ % % When using grants with `SourceArn' constraints for
5730+ % % `ReEncrypt' operations, the grants on both the source KMS key (for
5731+ % % `ReEncryptFrom') and the destination KMS key (for `ReEncryptTo')
5732+ % % must specify the same `SourceArn' value.
5733+ % %
57035734% % Cross-account use: Yes. The source KMS key and
57045735% % destination KMS key can be in different Amazon Web Services accounts.
57055736% % Either or both KMS keys can be in a
0 commit comments