| 20 | |
| 21 | # snippet-start:[python.example_code.kms.GrantManager.decl] |
| 22 | class GrantManager: |
| 23 | def __init__(self, kms_client): |
| 24 | self.kms_client = kms_client |
| 25 | |
| 26 | @classmethod |
| 27 | def from_client(cls) -> "GrantManager": |
| 28 | """ |
| 29 | Creates a GrantManager instance with a default KMS client. |
| 30 | |
| 31 | :return: An instance of GrantManager initialized with the default KMS client. |
| 32 | """ |
| 33 | kms_client = boto3.client("kms") |
| 34 | return cls(kms_client) |
| 35 | |
| 36 | # snippet-end:[python.example_code.kms.GrantManager.decl] |
| 37 | |
| 38 | # snippet-start:[python.example_code.kms.CreateGrant] |
| 39 | def create_grant( |
| 40 | self, key_id: str, principal: str, operations: [str] |
| 41 | ) -> dict[str, str]: |
| 42 | """ |
| 43 | Creates a grant for a key that lets a principal generate a symmetric data |
| 44 | encryption key. |
| 45 | |
| 46 | :param key_id: The ARN or ID of the key. |
| 47 | :param principal: The principal to grant permission to. |
| 48 | :param operations: The operations to grant permission for. |
| 49 | :return: The grant that is created. |
| 50 | """ |
| 51 | try: |
| 52 | return self.kms_client.create_grant( |
| 53 | KeyId=key_id, |
| 54 | GranteePrincipal=principal, |
| 55 | Operations=operations, |
| 56 | ) |
| 57 | except ClientError as err: |
| 58 | logger.error( |
| 59 | "Couldn't create a grant on key %s. Here's why: %s", |
| 60 | key_id, |
| 61 | err.response["Error"]["Message"], |
| 62 | ) |
| 63 | raise |
| 64 | |
| 65 | # snippet-end:[python.example_code.kms.CreateGrant] |
| 66 | |
| 67 | # snippet-start:[python.example_code.kms.ListGrants] |
| 68 | def list_grants(self, key_id): |
| 69 | """ |
| 70 | Lists grants for a key. |
| 71 | |
| 72 | :param key_id: The ARN or ID of the key to query. |
| 73 | :return: The grants for the key. |
| 74 | """ |
| 75 | try: |
| 76 | paginator = self.kms_client.get_paginator("list_grants") |
| 77 | grants = [] |
| 78 | page_iterator = paginator.paginate(KeyId=key_id) |
| 79 | for page in page_iterator: |
no outgoing calls