aws-cdk-lib 2.174.0__py3-none-any.whl → 2.175.0__py3-none-any.whl

aws_cdk/aws_kms/__init__.py

@@ -252,6 +252,26 @@ key = kms.Key(self, "MyKey",
 > It is highly recommended that the key policy grants access to the account root, rather than specific principals.
 > See https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html for more information.
 
+### Signing and Verification key policies
+
+Creating signatures and verifying them with KMS requires specific permissions.
+The respective policies can be attached to a principal via the `grantSign` and `grantVerify` methods.
+
+```python
+key = kms.Key(self, "MyKey")
+user = iam.User(self, "MyUser")
+key.grant_sign(user) # Adds 'kms:Sign' to the principal's policy
+key.grant_verify(user)
+```
+
+If both sign and verify permissions are required, they can be applied with one method called `grantSignVerify`.
+
+```python
+key = kms.Key(self, "MyKey")
+user = iam.User(self, "MyUser")
+key.grant_sign_verify(user)
+```
+
 ### HMAC specific key policies
 
 HMAC keys have a different key policy than other KMS keys. They have a policy for generating and for verifying a MAC.
@@ -2006,6 +2026,30 @@ class IKey(_IResource_c80c4260, typing_extensions.Protocol):
         '''
         ...
 
+    @jsii.member(jsii_name="grantSign")
+    def grant_sign(self, grantee: _IGrantable_71c4f5de) -> _Grant_a7ae64f8:
+        '''Grant sign permissions using this key to the given principal.
+
+        :param grantee: -
+        '''
+        ...
+
+    @jsii.member(jsii_name="grantSignVerify")
+    def grant_sign_verify(self, grantee: _IGrantable_71c4f5de) -> _Grant_a7ae64f8:
+        '''Grant sign and verify permissions using this key to the given principal.
+
+        :param grantee: -
+        '''
+        ...
+
+    @jsii.member(jsii_name="grantVerify")
+    def grant_verify(self, grantee: _IGrantable_71c4f5de) -> _Grant_a7ae64f8:
+        '''Grant verify permissions using this key to the given principal.
+
+        :param grantee: -
+        '''
+        ...
+
     @jsii.member(jsii_name="grantVerifyMac")
     def grant_verify_mac(self, grantee: _IGrantable_71c4f5de) -> _Grant_a7ae64f8:
         '''Grant permissions to verifying MACs to the given principal.
@@ -2129,6 +2173,39 @@ class _IKeyProxy(
             check_type(argname="argument grantee", value=grantee, expected_type=type_hints["grantee"])
         return typing.cast(_Grant_a7ae64f8, jsii.invoke(self, "grantGenerateMac", [grantee]))
 
+    @jsii.member(jsii_name="grantSign")
+    def grant_sign(self, grantee: _IGrantable_71c4f5de) -> _Grant_a7ae64f8:
+        '''Grant sign permissions using this key to the given principal.
+
+        :param grantee: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__17bf7cf2a33c9cdda910f2942efab62c58f1c1a7a7dd9458dde25eeca2f4682d)
+            check_type(argname="argument grantee", value=grantee, expected_type=type_hints["grantee"])
+        return typing.cast(_Grant_a7ae64f8, jsii.invoke(self, "grantSign", [grantee]))
+
+    @jsii.member(jsii_name="grantSignVerify")
+    def grant_sign_verify(self, grantee: _IGrantable_71c4f5de) -> _Grant_a7ae64f8:
+        '''Grant sign and verify permissions using this key to the given principal.
+
+        :param grantee: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__c990d684da172804daae0cf29edc7427216184b33a70a020885b86aa21a224d2)
+            check_type(argname="argument grantee", value=grantee, expected_type=type_hints["grantee"])
+        return typing.cast(_Grant_a7ae64f8, jsii.invoke(self, "grantSignVerify", [grantee]))
+
+    @jsii.member(jsii_name="grantVerify")
+    def grant_verify(self, grantee: _IGrantable_71c4f5de) -> _Grant_a7ae64f8:
+        '''Grant verify permissions using this key to the given principal.
+
+        :param grantee: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__5f56ca61f2a3a6b4719a05ed3f1c1897c7b914146a2f92ae8dd0313130d7111c)
+            check_type(argname="argument grantee", value=grantee, expected_type=type_hints["grantee"])
+        return typing.cast(_Grant_a7ae64f8, jsii.invoke(self, "grantVerify", [grantee]))
+
     @jsii.member(jsii_name="grantVerifyMac")
     def grant_verify_mac(self, grantee: _IGrantable_71c4f5de) -> _Grant_a7ae64f8:
         '''Grant permissions to verifying MACs to the given principal.
@@ -2442,6 +2519,39 @@ class Key(
             check_type(argname="argument grantee", value=grantee, expected_type=type_hints["grantee"])
         return typing.cast(_Grant_a7ae64f8, jsii.invoke(self, "grantGenerateMac", [grantee]))
 
+    @jsii.member(jsii_name="grantSign")
+    def grant_sign(self, grantee: _IGrantable_71c4f5de) -> _Grant_a7ae64f8:
+        '''Grant sign permissions using this key to the given principal.
+
+        :param grantee: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__6461815f1d37e6ba54e3cbf1944f9dfd4919e6778f163b7d761b4addf454e443)
+            check_type(argname="argument grantee", value=grantee, expected_type=type_hints["grantee"])
+        return typing.cast(_Grant_a7ae64f8, jsii.invoke(self, "grantSign", [grantee]))
+
+    @jsii.member(jsii_name="grantSignVerify")
+    def grant_sign_verify(self, grantee: _IGrantable_71c4f5de) -> _Grant_a7ae64f8:
+        '''Grant sign and verify permissions using this key to the given principal.
+
+        :param grantee: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__c9dd17cfd9ba136ab5eb61bfd08f31dab5e9e96d93c1a2e94c0610a4b97524bd)
+            check_type(argname="argument grantee", value=grantee, expected_type=type_hints["grantee"])
+        return typing.cast(_Grant_a7ae64f8, jsii.invoke(self, "grantSignVerify", [grantee]))
+
+    @jsii.member(jsii_name="grantVerify")
+    def grant_verify(self, grantee: _IGrantable_71c4f5de) -> _Grant_a7ae64f8:
+        '''Grant verify permissions using this key to the given principal.
+
+        :param grantee: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__6177dbf335c9d10ef7ab31fb9b38bda2e2a5301aaa124f44ce6112399ec6d8a6)
+            check_type(argname="argument grantee", value=grantee, expected_type=type_hints["grantee"])
+        return typing.cast(_Grant_a7ae64f8, jsii.invoke(self, "grantVerify", [grantee]))
+
     @jsii.member(jsii_name="grantVerifyMac")
     def grant_verify_mac(self, grantee: _IGrantable_71c4f5de) -> _Grant_a7ae64f8:
         '''Grant permissions to verifying MACs to the given principal.
@@ -3277,6 +3387,39 @@ class Alias(
             check_type(argname="argument grantee", value=grantee, expected_type=type_hints["grantee"])
         return typing.cast(_Grant_a7ae64f8, jsii.invoke(self, "grantGenerateMac", [grantee]))
 
+    @jsii.member(jsii_name="grantSign")
+    def grant_sign(self, grantee: _IGrantable_71c4f5de) -> _Grant_a7ae64f8:
+        '''Grant sign permissions using this key to the given principal.
+
+        :param grantee: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__9930639ecbcd35ed216f2d886dc8190db34758bfddca534c0b1a15eec5b03bd4)
+            check_type(argname="argument grantee", value=grantee, expected_type=type_hints["grantee"])
+        return typing.cast(_Grant_a7ae64f8, jsii.invoke(self, "grantSign", [grantee]))
+
+    @jsii.member(jsii_name="grantSignVerify")
+    def grant_sign_verify(self, grantee: _IGrantable_71c4f5de) -> _Grant_a7ae64f8:
+        '''Grant sign and verify permissions using this key to the given principal.
+
+        :param grantee: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__fa123781beb7a446099dc1bd3f1e2905a09dd2781b09e4876768625072421ff6)
+            check_type(argname="argument grantee", value=grantee, expected_type=type_hints["grantee"])
+        return typing.cast(_Grant_a7ae64f8, jsii.invoke(self, "grantSignVerify", [grantee]))
+
+    @jsii.member(jsii_name="grantVerify")
+    def grant_verify(self, grantee: _IGrantable_71c4f5de) -> _Grant_a7ae64f8:
+        '''Grant verify permissions using this key to the given principal.
+
+        :param grantee: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__b324b24cb913496e78f2a43c74194efd7b11966ae5d2d3b1a5d17611af6d6fca)
+            check_type(argname="argument grantee", value=grantee, expected_type=type_hints["grantee"])
+        return typing.cast(_Grant_a7ae64f8, jsii.invoke(self, "grantVerify", [grantee]))
+
     @jsii.member(jsii_name="grantVerifyMac")
     def grant_verify_mac(self, grantee: _IGrantable_71c4f5de) -> _Grant_a7ae64f8:
         '''Grant permissions to verifying MACs to the given principal.
@@ -3649,6 +3792,24 @@ def _typecheckingstub__678d44f30b3f7854df209779d1ab6c27a0eac432204e7f4ac90a02792
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__17bf7cf2a33c9cdda910f2942efab62c58f1c1a7a7dd9458dde25eeca2f4682d(
+    grantee: _IGrantable_71c4f5de,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__c990d684da172804daae0cf29edc7427216184b33a70a020885b86aa21a224d2(
+    grantee: _IGrantable_71c4f5de,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__5f56ca61f2a3a6b4719a05ed3f1c1897c7b914146a2f92ae8dd0313130d7111c(
+    grantee: _IGrantable_71c4f5de,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__e10fb25b1b8146054e097c61432d71d4ae4493eb15e2a482f90f513e686b24ee(
     grantee: _IGrantable_71c4f5de,
 ) -> None:
@@ -3755,6 +3916,24 @@ def _typecheckingstub__440bf3733f200027c74618bbc6f89d59b060f4aa9d88bb6dbfb057771
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__6461815f1d37e6ba54e3cbf1944f9dfd4919e6778f163b7d761b4addf454e443(
+    grantee: _IGrantable_71c4f5de,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__c9dd17cfd9ba136ab5eb61bfd08f31dab5e9e96d93c1a2e94c0610a4b97524bd(
+    grantee: _IGrantable_71c4f5de,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__6177dbf335c9d10ef7ab31fb9b38bda2e2a5301aaa124f44ce6112399ec6d8a6(
+    grantee: _IGrantable_71c4f5de,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__de56bfcabbb83e3ba315f07ba084787bd71e82306a46ddc61555bc4f07b77538(
     grantee: _IGrantable_71c4f5de,
 ) -> None:
@@ -3867,6 +4046,24 @@ def _typecheckingstub__a08117fd4a61f5dbdfb60de37f9aafd66666c36ccbd553402d5504cdd
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__9930639ecbcd35ed216f2d886dc8190db34758bfddca534c0b1a15eec5b03bd4(
+    grantee: _IGrantable_71c4f5de,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__fa123781beb7a446099dc1bd3f1e2905a09dd2781b09e4876768625072421ff6(
+    grantee: _IGrantable_71c4f5de,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__b324b24cb913496e78f2a43c74194efd7b11966ae5d2d3b1a5d17611af6d6fca(
+    grantee: _IGrantable_71c4f5de,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__889887809ebfcb10b086b9443331082b607fe1c8b476e14ebc492583598f19a2(
     grantee: _IGrantable_71c4f5de,
 ) -> None: