{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/pass-a-kms-grant-token-when-new-grant-permissions-are-needed-immediately/", "item": { "id": "https://update.dsesecurity.com/updates/pass-a-kms-grant-token-when-new-grant-permissions-are-needed-immediately/", "slug": "pass-a-kms-grant-token-when-new-grant-permissions-are-needed-immediately", "url": "https://update.dsesecurity.com/updates/pass-a-kms-grant-token-when-new-grant-permissions-are-needed-immediately/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/pass-a-kms-grant-token-when-new-grant-permissions-are-needed-immediately.md", "json": "https://update.dsesecurity.com/api/v1/posts/pass-a-kms-grant-token-when-new-grant-permissions-are-needed-immediately/" }, "title": "Pass a KMS grant token when new grant permissions are needed immediately", "summary": "Handle grant propagation without masking it through broader permanent permissions.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:13:39+00:00", "modified_at": "2026-10-20T18:34:29+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 245, "potentially_affected": "This guide addresses the interval immediately after grant creation, rather than a general retry policy for all access denials.", "dse_recommendation": "DSE recommends carrying the returned grant token through the application step that first needs the new permission.", "primary_source": { "name": "AWS Documentation", "url": "https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html", "published_on": null, "authority": "docs.aws.amazon.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Handle grant propagation without masking it through broader permanent permissions.

\n

Source facts

\n

AWS KMS follows eventual consistency, so a newly created grant may not be immediately available throughout the service. CreateGrant returns a grant token that supported operations can include to use the new permission immediately. RetireGrant accepts a token for a new grant; RevokeGrant does not.

\n

Source: AWS Documentation.

\n

Applicability

\n

This guide addresses the interval immediately after grant creation, rather than a general retry policy for all access denials.

\n

DSE recommendation

\n

DSE recommends carrying the returned grant token through the application step that first needs the new permission. Keep the token associated with the correct key, grantee and operation. Distinguish a propagation-related failure from an incorrect grant or an explicit denial before retrying. Avoid adding a broad key-policy allowance to work around an incomplete grant workflow. Document cleanup and failure handling so temporary grants do not remain after an abandoned operation. Describe which component owns token handoff and which owns grant cleanup if the next operation fails. Keep those responsibilities together in the workflow review so retry handling does not leave an unexplained permission grant after the user-visible operation is abandoned.

\n

Verification

\n

Proposed verification: create a narrow grant on a disposable key and call the supported operation using the returned token. Exercise the intended retirement path and verify resulting permissions after propagation. Preserve error details and configuration identifiers without claiming that every AccessDenied error is caused by consistency.

\n

Official reference

\n

AWS Documentation. Reviewed October 20, 2026.

", "content_text": "Handle grant propagation without masking it through broader permanent permissions.\nSource facts\nAWS KMS follows eventual consistency, so a newly created grant may not be immediately available throughout the service. CreateGrant returns a grant token that supported operations can include to use the new permission immediately. RetireGrant accepts a token for a new grant; RevokeGrant does not.\nSource: AWS Documentation.\nApplicability\nThis guide addresses the interval immediately after grant creation, rather than a general retry policy for all access denials.\nDSE recommendation\nDSE recommends carrying the returned grant token through the application step that first needs the new permission. Keep the token associated with the correct key, grantee and operation. Distinguish a propagation-related failure from an incorrect grant or an explicit denial before retrying. Avoid adding a broad key-policy allowance to work around an incomplete grant workflow. Document cleanup and failure handling so temporary grants do not remain after an abandoned operation. Describe which component owns token handoff and which owns grant cleanup if the next operation fails. Keep those responsibilities together in the workflow review so retry handling does not leave an unexplained permission grant after the user-visible operation is abandoned.\nVerification\nProposed verification: create a narrow grant on a disposable key and call the supported operation using the returned token. Exercise the intended retirement path and verify resulting permissions after propagation. Preserve error details and configuration identifiers without claiming that every AccessDenied error is caused by consistency.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.", "content_markdown": "Handle grant propagation without masking it through broader permanent permissions.\n\n## Source facts\n\nAWS KMS follows eventual consistency, so a newly created grant may not be immediately available throughout the service. CreateGrant returns a grant token that supported operations can include to use the new permission immediately. RetireGrant accepts a token for a new grant; RevokeGrant does not.\n\nSource: [AWS Documentation](https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html).\n\n## Applicability\n\nThis guide addresses the interval immediately after grant creation, rather than a general retry policy for all access denials.\n\n## DSE recommendation\n\nDSE recommends carrying the returned grant token through the application step that first needs the new permission. Keep the token associated with the correct key, grantee and operation. Distinguish a propagation-related failure from an incorrect grant or an explicit denial before retrying. Avoid adding a broad key-policy allowance to work around an incomplete grant workflow. Document cleanup and failure handling so temporary grants do not remain after an abandoned operation. Describe which component owns token handoff and which owns grant cleanup if the next operation fails. Keep those responsibilities together in the workflow review so retry handling does not leave an unexplained permission grant after the user-visible operation is abandoned.\n\n## Verification\n\nProposed verification: create a narrow grant on a disposable key and call the supported operation using the returned token. Exercise the intended retirement path and verify resulting permissions after propagation. Preserve error details and configuration identifiers without claiming that every AccessDenied error is caused by consistency.\n\n## Official reference\n\n[AWS Documentation](https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/pass-a-kms-grant-token-when-new-grant-permissions-are-needed-immediately/", "url": "https://update.dsesecurity.com/updates/pass-a-kms-grant-token-when-new-grant-permissions-are-needed-immediately/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/pass-a-kms-grant-token-when-new-grant-permissions-are-needed-immediately/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Pass a KMS grant token when new grant permissions are needed immediately", "item": "https://update.dsesecurity.com/updates/pass-a-kms-grant-token-when-new-grant-permissions-are-needed-immediately/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/pass-a-kms-grant-token-when-new-grant-permissions-are-needed-immediately/#article", "identifier": "https://update.dsesecurity.com/updates/pass-a-kms-grant-token-when-new-grant-permissions-are-needed-immediately/", "url": "https://update.dsesecurity.com/updates/pass-a-kms-grant-token-when-new-grant-permissions-are-needed-immediately/", "headline": "Pass a KMS grant token when new grant permissions are needed immediately", "description": "Handle grant propagation without masking it through broader permanent permissions.", "abstract": "Handle grant propagation without masking it through broader permanent permissions.", "articleBody": "Handle grant propagation without masking it through broader permanent permissions.\nSource facts\nAWS KMS follows eventual consistency, so a newly created grant may not be immediately available throughout the service. CreateGrant returns a grant token that supported operations can include to use the new permission immediately. RetireGrant accepts a token for a new grant; RevokeGrant does not.\nSource: AWS Documentation.\nApplicability\nThis guide addresses the interval immediately after grant creation, rather than a general retry policy for all access denials.\nDSE recommendation\nDSE recommends carrying the returned grant token through the application step that first needs the new permission. Keep the token associated with the correct key, grantee and operation. Distinguish a propagation-related failure from an incorrect grant or an explicit denial before retrying. Avoid adding a broad key-policy allowance to work around an incomplete grant workflow. Document cleanup and failure handling so temporary grants do not remain after an abandoned operation. Describe which component owns token handoff and which owns grant cleanup if the next operation fails. Keep those responsibilities together in the workflow review so retry handling does not leave an unexplained permission grant after the user-visible operation is abandoned.\nVerification\nProposed verification: create a narrow grant on a disposable key and call the supported operation using the returned token. Exercise the intended retirement path and verify resulting permissions after propagation. Preserve error details and configuration identifiers without claiming that every AccessDenied error is caused by consistency.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:13:39+00:00", "dateModified": "2026-10-20T18:34:29+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/pass-a-kms-grant-token-when-new-grant-permissions-are-needed-immediately/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/pass-a-kms-grant-token-when-new-grant-permissions-are-needed-immediately/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Pass a KMS grant token when new grant permissions are needed immediately" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 245, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "AWS Documentation", "url": "https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html" } } ] } }