Skip to content

Commit 50c613a

Browse files
committed
docs(sns): add IAM action details to grantPublish and grantSubscribe
Added details about which IAM actions are granted by grantPublish (sns:Publish + KMS permissions for encrypted topics) and grantSubscribe (sns:Subscribe) to help users understand the exact permissions being granted. Closes #35736
1 parent 08b9280 commit 50c613a

File tree

1 file changed

+16
-4
lines changed

1 file changed

+16
-4
lines changed

packages/aws-cdk-lib/aws-sns/lib/topic-base.ts

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -70,12 +70,18 @@ export interface ITopic extends IResource, notifications.INotificationRuleTarget
7070
addToResourcePolicy(statement: iam.PolicyStatement): iam.AddToResourcePolicyResult;
7171

7272
/**
73-
* Grant topic publishing permissions to the given identity
73+
* Grant topic publishing permissions to the given identity.
74+
*
75+
* This grants the `sns:Publish` action on this topic. If the topic is encrypted
76+
* with a customer-managed KMS key, it also grants `kms:Decrypt` and
77+
* `kms:GenerateDataKey*` on the key.
7478
*/
7579
grantPublish(identity: iam.IGrantable): iam.Grant;
7680

7781
/**
78-
* Grant topic subscribing permissions to the given identity
82+
* Grant topic subscribing permissions to the given identity.
83+
*
84+
* This grants the `sns:Subscribe` action on this topic.
7985
*/
8086
grantSubscribe(identity: iam.IGrantable): iam.Grant;
8187
}
@@ -224,7 +230,11 @@ export abstract class TopicBase extends Resource implements ITopic, IEncryptedRe
224230
}
225231

226232
/**
227-
* Grant topic publishing permissions to the given identity
233+
* Grant topic publishing permissions to the given identity.
234+
*
235+
* This grants the `sns:Publish` action on this topic. If the topic is encrypted
236+
* with a customer-managed KMS key, it also grants `kms:Decrypt` and
237+
* `kms:GenerateDataKey*` on the key.
228238
*
229239
* The use of this method is discouraged. Please use `grants.publish()` instead.
230240
*
@@ -235,7 +245,9 @@ export abstract class TopicBase extends Resource implements ITopic, IEncryptedRe
235245
}
236246

237247
/**
238-
* Grant topic subscribing permissions to the given identity
248+
* Grant topic subscribing permissions to the given identity.
249+
*
250+
* This grants the `sns:Subscribe` action on this topic.
239251
*
240252
* The use of this method is discouraged. Please use `grants.subscribe()` instead.
241253
*

0 commit comments

Comments
 (0)