policy_grants

Creates, updates, deletes or gets a policy_grant resource or lists policy_grants in a region

Overview

Name	policy_grants
Type	Resource
Description	Policy Grant in AWS DataZone is an explicit authorization assignment that allows a specific principal (user, group, or project) to perform particular actions (such as creating glossary terms, managing projects, or accessing resources) on governed resources within a certain scope (like a Domain Unit or Project). Policy Grants are essentially the mechanism by which DataZone enforces fine-grained, role-based access control beyond what is possible through AWS IAM alone.
Id	awscc.datazone.policy_grants

Fields

get (all properties)

Name	Datatype	Description
entity_type	string
policy_type	string
created_by	string	Specifies the user who created the policy grant member.
created_at	string	Specifies the timestamp at which policy grant member was created.
grant_id	string	The unique identifier of the policy grant returned by the AddPolicyGrant API
entity_identifier	string
detail	object
principal	object
domain_identifier	string
region	string	AWS region.

list (identifiers only)

Name	Datatype	Description
entity_type	string
policy_type	string
grant_id	string	The unique identifier of the policy grant returned by the AddPolicyGrant API
entity_identifier	string
domain_identifier	string
region	string	AWS region.

For more information, see AWS::DataZone::PolicyGrant.

Methods

Name	Resource	Accessible by	Required Params
create_resource	policy_grants	INSERT	DomainIdentifier, EntityIdentifier, EntityType, PolicyType, region
delete_resource	policy_grants	DELETE	Identifier, region
list_resources	policy_grants_list_only	SELECT	region
get_resource	policy_grants	SELECT	Identifier, region

SELECT examples

get (all properties)

Gets all properties from an individual policy_grant.

SELECT
  region,
  entity_type,
  policy_type,
  created_by,
  created_at,
  grant_id,
  entity_identifier,
  detail,
  principal,
  domain_identifier
FROM awscc.datazone.policy_grants
WHERE
  region = '{{ region }}' AND
  Identifier = '{{ domain_identifier }}|{{ grant_id }}|{{ entity_identifier }}|{{ entity_type }}|{{ policy_type }}';

list (identifiers only)

Lists all policy_grants in a region.

SELECT
  region,
  domain_identifier,
  grant_id,
  entity_identifier,
  entity_type,
  policy_type
FROM awscc.datazone.policy_grants_list_only
WHERE
  region = '{{ region }}';

INSERT example

Use the following StackQL query and manifest file to create a new policy_grant resource, using stack-deploy.

Required Properties

/*+ create */
INSERT INTO awscc.datazone.policy_grants (
  EntityType,
  PolicyType,
  EntityIdentifier,
  DomainIdentifier,
  region
)
SELECT
  '{{ entity_type }}',
  '{{ policy_type }}',
  '{{ entity_identifier }}',
  '{{ domain_identifier }}',
  '{{ region }}'
RETURNING
  ErrorCode,
  EventTime,
  Identifier,
  Operation,
  OperationStatus,
  RequestToken,
  ResourceModel,
  RetryAfter,
  StatusMessage,
  TypeName
;

All Properties

/*+ create */
INSERT INTO awscc.datazone.policy_grants (
  EntityType,
  PolicyType,
  EntityIdentifier,
  Detail,
  Principal,
  DomainIdentifier,
  region
)
SELECT
  '{{ entity_type }}',
  '{{ policy_type }}',
  '{{ entity_identifier }}',
  '{{ detail }}',
  '{{ principal }}',
  '{{ domain_identifier }}',
  '{{ region }}'
RETURNING
  ErrorCode,
  EventTime,
  Identifier,
  Operation,
  OperationStatus,
  RequestToken,
  ResourceModel,
  RetryAfter,
  StatusMessage,
  TypeName
;

Manifest

version: 1
name: stack name
description: stack description
providers:
- aws
globals:
- name: region
  value: '{{ vars.AWS_REGION }}'
resources:
- name: policy_grant
  props:
    - name: entity_type
      value: '{{ entity_type }}'
    - name: policy_type
      value: '{{ policy_type }}'
    - name: entity_identifier
      value: '{{ entity_identifier }}'
    - name: detail
      value: null
    - name: principal
      value: null
    - name: domain_identifier
      value: '{{ domain_identifier }}'

DELETE example

/*+ delete */
DELETE FROM awscc.datazone.policy_grants
WHERE
  Identifier = '{{ domain_identifier }}|{{ grant_id }}|{{ entity_identifier }}|{{ entity_type }}|{{ policy_type }}' AND
  region = '{{ region }}'
RETURNING
  ErrorCode,
  EventTime,
  Identifier,
  Operation,
  OperationStatus,
  RequestToken,
  ResourceModel,
  RetryAfter,
  StatusMessage,
  TypeName
;

Additional Parameters

Mutable resources in the Cloud Control provider support additional optional parameters which can be supplied with INSERT, UPDATE, or DELETE operations. These include:

Parameter	Description
ClientToken	A unique identifier to ensure the idempotency of the resource request. This allows the provider to accurately distinguish between retries and new requests. A client token is valid for 36 hours once used. After that, a resource request with the same client token is treated as a new request. If you do not specify a client token, one is generated for inclusion in the request.
RoleArn	The ARN of the IAM role used to perform this resource operation. The role specified must have the permissions required for this operation. If you do not specify a role, a temporary session is created using your AWS user credentials.
TypeVersionId	For private resource types, the type version to use in this resource operation. If you do not specify a resource version, the default version is used.

Permissions

To operate on the policy_grants resource, the following permissions are required:

Read

datazone:ListPolicyGrants

Create

datazone:AddPolicyGrant,
datazone:ListPolicyGrants

List

datazone:ListPolicyGrants

Delete

datazone:RemovePolicyGrant,
datazone:ListPolicyGrants