The Niche of CDK Grant ΦϒδΣΫτͬͯԿऀʁ 2025/07/11 @hassaku_63 AWS CDK Conference Japan 2025 presented by JAWS-UG 

݁࿦ Grant ΦϒδΣΫτͱ͸ʁ • grantXXX ϝιουʹڞ௨͢Δ໭Γ஋ͷܕʢҰ෦ྫ֎͋ΓʣͰ͋Γɺ಺෦࣮૷Ͱ࢖ΘΕ͍ͯΔܕ • ʮڐՄΛग़͢ओମʯʮڐՄΛड͚औΔ۩৅ʯ͔Βಠཱͨ͠ʮ෇༩͢Δݖݶʯͷ֓೦Λநग़ͨ͠΋ͷ • ݖݶ෇༩ͷ۩৅͕ΞΠσϯςΟςΟϕʔεͰ͋Δ͔ʗϦιʔεϕʔεͰ͋Δ͔ɹ͔Β΋ಠཱͨ֓͠೦ʢର֎తʹ͸ʣ (ex. ಛఆͷ Service Role ΁ͷݖݶ෇༩΍ɺS3 Public Access ͷઃఆ) ։ൃऀ͸ Grant ͷଘࡏΛҙࣝ͢Δඞཁ͕͋Δ͔ʁ • ௨ৗͷ IaC ςϯϓϨʔτ։ൃʹ͓͍ͯ͸ෆཁɻҙࣝతʹѻ͏΂͖ػձ͸ʢଟ෼ʣͳ͍ • ؔ࿈͢ΔΠϯλϑΣʔεͷ IGrantable ͷଘࡏ͚ͩย۱ʹஔ͍͓ͯ͘ͱΑ͍͔΋ • grantXXX ܥϝιουΛࣗ࡞͢Δ༻ࣄ͕͋Δਓ͸ɺ஌͓ͬͯ͘ͱศརʢ͔΋͠Εͳ͍ʣ 

ࠓ೔஻Δ͜ͱ 1. grantXXX ϝιουͱɺGrant ΦϒδΣΫτ / IGrantable ΠϯλϑΣʔε 2. ͲΜͳ༻ࣄΛ࣋ͭਓ͕ɺGrant Λҙࣝ͢Δͱྑ͍ʁ 3. ࢖༻ྫ 1. aws/aws-cdk ͷ಺෦࣮૷ΑΓ 2.खݩͰಈ͔ͤΔίʔυͷ঺հ ʢ஫ʣͨͿΜɺօ͞Μͷ໌೔͔Βͷ࣮຿ʹ͸໾ཱͪ·ͤΜ 

GrantXXX ϝιουͱɺ Grant / IGrantable 

grantXXX ϝιουͷΠϝʔδ myConstruct . grantXXX (target, options); 

grantXXX ϝιουͷΠϝʔδ myConstruct . grantXXX (target, options); ϨγʔόΦϒδΣΫτ ʢओޠʣ 

grantXXX ϝιουͷΠϝʔδ myConstruct . grantXXX (target, options); ϨγʔόΦϒδΣΫτ ʢओޠʣ ϝιουʢಈࢺ + ໨తޠʣ 

grantXXX ϝιουͷΠϝʔδ myConstruct . grantXXX (target, options); ϨγʔόΦϒδΣΫτ ʢओޠʣ Ҿ਺ʢ໨తޠ2ʣ ϝιουʢಈࢺ + ໨తޠʣ 

grantXXX ϝιουͷΠϝʔδ myConstruct . grantXXX (target, options); ϨγʔόΦϒδΣΫτ ʢओޠʣ Ҿ਺ʢ໨తޠ2ʣ ϝιουʢಈࢺ + ໨తޠʣ → myConstruct grants XXX permission to target 

grantXXX ϝιουͷΠϝʔδ myConstruct . grantXXX (target, options); ϨγʔόΦϒδΣΫτ ʢओޠʣ Ҿ਺ʢ໨తޠ2ʣ ϝιουʢಈࢺ + ໨తޠʣ → myConstruct grants XXX permission to target ڐՄ͞ΕΔଆ (grantee) ͷԿ͔͠ΒͰɺiam.IGrantable ΠϯλϑΣʔεͷ࣮૷Ϋϥεܕ ※యܕతͳͷ͸ IAM Role ΍ Service Role ͷඥ͚͕ͮՄೳͳ೚ҙͷϦιʔε 

(ex.) S3 όέοτʹର͢Δ Read ݖݶͷ෇༩ class Bucket - public grantRead(identity: IGrantable, objectsKeyPattern?: any): Grant myBucket myFunction ͓લ (IGrantable) ʹ ࢲΛ Read ͢Δ ڐՄΛ΍Ζ͏ ʮڐՄ͞ΕΔʯଆͷԿ͔͠Β = IGrantable ͷ࣮૷Ϋϥε ※಺෦తʹ͸ɺFunction ʹඥͮ͘ϓϦϯγύϧͰ͋Δ IAM Role (policy) ΁ͷ permission ௥Ճ͕ߦΘΕΔ 

grantXXX ϝιουͷ࣮૷Πϝʔδ ΞΠσϯςΟςΟϕʔεͳ ݖݶ෇༩ͷ৔߹ 

grantXXX ϝιουͷ࣮૷Πϝʔδ ΞΠσϯςΟςΟϕʔεͳ ݖݶ෇༩ͷ৔߹ 

Grant ΦϒδΣΫτͬͯʁ grantXXX ͷ໋໊نଇΛ࣋ͭϝιουͷ໭Γ஋ 

Grant ΦϒδΣΫτͬͯʁ grantXXX ͷ໋໊نଇΛ࣋ͭϝιουͷ໭Γ஋ Α͘ݟΔ΍ͭ ୈҰҾ਺ʢ෇༩͢Δ૬खʣ͸ IGrantable Λ࣮૷͢Δ೚ҙͷܕ 

Grant ΦϒδΣΫτͬͯʁ grantXXX ͷ໋໊نଇΛ࣋ͭϝιουͷ໭Γ஋ Grant ΦϒδΣΫτ (???) 

ͲΜͳ༻ࣄΛ࣋ͭਓ͕ɺ Grant Λҙࣝ͢Δͱྑ͍ʁ 

Grant Λҙࣝͨ͠Βخ͍͠ʢ͔΋͠Εͳ͍ʣ έʔε • CDK ίϯτϦϏϡʔλʔ • ෆಛఆ޲͚ͷڞ௨ϥΠϒϥϦ΍ Custom Construct Λ։ൃ͢Δਓ͕ɺ grantXXX ܥϝιουΛࣗ࡞͢Δ৔߹ʹҙࣝ͢Δ • ͋Δڞ༗Ϧιʔεʹର͢ΔݫີͳڐՄΛ෇༩͢Δํ๏Λఏڙ͍ͨ͠ • ڐՄΛ༩͑ΒΕΔଆ (grantee) ͷ۩৅ΛࣄલʹಛఆͰ͖ͳ͍ 

Grant Λҙࣝͨ͠Βخ͍͠ʢ͔΋͠Εͳ͍ʣ έʔε User Workload (1) User Workload (2) User Workload (n) ɾ ɾ ɾ Shared Service (ex. Πϕϯτϩάج൫) write log ೚ҙͷϫʔΫϩʔυ ෆಛఆͷΞϓϦ։ൃऀ͕ɺෆಛఆͷΞϓϦΛ ߏங͠ɺShared Service ʹॻ͖ࠐΈ ෆಛఆͷΞϓϦ͔Βͷ ॻ͖ࠐΈΛड͚෇͚Δڞ༗αʔϏε ʢྫ͑͹ɺOrg ؀ڥԼʹ͓͚Δ Log Archive ΞΧ΢ϯτͷϩάόέοτʣ 

Grant Λҙࣝͨ͠Βخ͍͠ʢ͔΋͠Εͳ͍ʣ έʔε User Workload (1) User Workload (2) User Workload (n) ɾ ɾ ɾ Shared Service (ex. Πϕϯτϩάج൫) write log ೚ҙͷϫʔΫϩʔυ ෆಛఆͷΞϓϦ։ൃऀ͕ɺෆಛఆͷΞϓϦΛ ߏங͠ɺShared Service ʹॻ͖ࠐΈ ෆಛఆͷΞϓϦ͔Βͷ ॻ͖ࠐΈΛड͚෇͚Δڞ༗αʔϏε ʢྫ͑͹ɺOrg ؀ڥԼʹ͓͚Δ Log Archive ΞΧ΢ϯτͷϩάόέοτʣ Shared Service ଆͷ Construct ʹ grant ϝιουΛੜ΍ͯ͠ɺ ͦͷ಺෦࣮૷Ͱ Grant Λ࢖༻͢Δ 

Grant Λҙࣝͨ͠Βخ͍͠ʢ͔΋͠Εͳ͍ʣ έʔε User Workload (1) User Workload (2) User Workload (n) ɾ ɾ ɾ Shared Service (ex. Πϕϯτϩάج൫) write log ຖ౓ಉ͡ permission ෇༩ͷ࣮૷Λ࠶ੜ࢈ ΋ͬͱγϯϓϧʹɺڞ௨Խͯ͠ɺ ؒҧ͍͕ൃੜ͠ͳ͍Α͏ʹ͍ͨ͠ 

Grant Λҙࣝͨ͠Βخ͍͠ʢ͔΋͠Εͳ͍ʣ έʔε User Workload (1) User Workload (2) User Workload (n) ɾ ɾ ɾ Shared Service (ex. Πϕϯτϩάج൫) write log ؀ڥ͝ͱͰΤϯυϙΠϯτ or ARN ͸ҟͳΔ͕ɺ ࣗ෼ࣗ਎ʹର͢Δ༻ࣄΛ࣋ͭΞϓϦ͕࣋ͭ΂͖ݖݶͷ ཁ݅͸ಉ͡ ϫʔΫϩʔυଆ͕ݖݶ෇༩ϩδοΫΛ౎౓࣮૷͢Δͷ͸ ඇޮ཰ͩ͠ɺ࣮૷ϛε͕ೖΓ͜Ή “Shared Service” Construct ʹର͢Δ “grant write” Λ ந৅Խͯ͠ɺϫʔΫϩʔυଆͰ࢖ͬͯ΋Β͏ 

Grant Λҙࣝͨ͠Βخ͍͠ʢ͔΋͠Εͳ͍ʣ έʔε Workload Stack ʢ஫ʣࡶ࣮૷ͳͷͰ ͋͘·ͰΞΠσΞͷ঺հఔ౓Ͱ 

Grant Λҙࣝͨ͠Βخ͍͠ʢ͔΋͠Εͳ͍ʣ έʔε Workload Stack σϓϩΠ؀ڥʹԠͨ͡ ISharedService Λऔಘ ݱࡏͷ؀ڥʹରԠͨ͠ ॻ͖ࠐΈύʔϛογϣϯΛ෇༩ 

Grant Λҙࣝͨ͠Βخ͍͠ʢ͔΋͠Εͳ͍ʣ έʔε Shared Service 

Grant Λҙࣝͨ͠Βخ͍͠ʢ͔΋͠Εͳ͍ʣ έʔε Shared Service ͜͜Ͱ௥Ճ͢΂͖ Policy Statement ͕ ෳࡶʹͳΔ৔߹͸ɺ Grant ͷѻ͍ํΛ஌͍ͬͯΔͱศར ʢಛʹɺ͜ͷػೳͷςετ༰қੑ؍఺ʣ 

࢖༻ྫ 

aws/aws-cdk-lib Bucket ͷجఈͰ͋Δ BucketBase Ϋϥεͷ “grantReplicationPermission” ϝιου S3 ͷϨϓϦέʔγϣϯߏ੒ʹ͓͍ͯɺϨϓϦέʔγϣϯͷ࣮ߦ࣌ʹ S3 ͕࢖༻͢Δ Service Role ʹରͯ͠ɺ ϨϓϦέʔγϣϯͷ࣮ߦʹඞཁͳݖݶΛ෇༩͢Δ΋ͷʢ࣮ଶͱͯ͠ඞཁͳݖݶ͕৭ʑ͋Δʣ ref: https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_s3.Bucket.html#grantwbrreplicationwbrpermissionidentity-props class BucketBase { public grantReplicationPermission( identity: IGrantable, props: GrantReplicationPermissionProps ): Grant { … } } 

aws/aws-cdk-lib PR #34138 (closes: #34119) Bucket ͷجఈͰ͋Δ BucketBase Ϋϥεͷ “grantReplicationPermission” ϝιου S3 ͷϨϓϦέʔγϣϯߏ੒ʹ͓͍ͯɺϨϓϦέʔγϣϯͷ࣮ߦ࣌ʹ S3 ͕࢖༻͢Δ Service Role ʹରͯ͠ɺ ϨϓϦέʔγϣϯͷ࣮ߦʹඞཁͳݖݶΛ෇༩͢Δ΋ͷʢ࣮ଶͱͯ͠ඞཁͳݖݶ͕৭ʑ͋Δʣ 

aws/aws-cdk-lib packages/aws-cdk-lib/aws-s3/test/bucket.test.ts ςετέʔε “grant permissions to custom replication role” ΑΓ 

No content

ϓϦϯγύϧ “replicationRole” ʹର͢Δ ݖݶ෇༩ϩδοΫ͕ɺ ҙਤ௨Γͷ݁Ռʹͳͬͨ͜ͱͷݕূ 

Example code (Gist) https://gist.github.com/hassaku63/79da57b244b3fddb48b416993376ce6c (CDK) ࣗ࡞ Construct ʹෳ߹తͳ ύʔϛογϣϯ෇༩Λߦ͏ ಠࣗͷ grant ϝιουΛ࣮૷ͯ͠ΈΔ 

Example code (Gist) https://gist.github.com/hassaku63/79da57b244b3fddb48b416993376ce6c (CDK) ࣗ࡞ Construct ʹෳ߹తͳ ύʔϛογϣϯ෇༩Λߦ͏ ಠࣗͷ grant ϝιουΛ࣮૷ͯ͠ΈΔ 

Point • ෳ߹తͳɺ͋Δ͍͸ݫີͳݖݶ෇༩Λ͍ͨ͠৔߹ʹ͸ grantXXX ܥϝιουΛࣗ࡞͢Δཧ༝͕͋Δ • ࣗ࡞ grantXXX ϝιουͷ಺෦Ͱ Grant.combine Λར༻ͯ͠ɺ ʮgrantXXX ʹΑΔݖݶͷ෇༩݁ՌʯΛ1ݸͷ Grant ΦϒδΣΫτʹ·ͱΊͯฦ͢ • grantXXX ϝιουͷ୯ମςετ͸ɺ໭Γ஋ͷ Grant Λௐ΂Ε͹ OK ʢ௨ৗͷ Stack/Construct ੜ੒͔Βͷ Template ϚονͰ΋OKʣ 

Speaker hassaku63 (Takuya Hashimoto) repeat-contributor of aws/aws-cdk hassaku_63 hassaku63