Pass a KMS grant token when new grant permissions are needed immediately

Handle grant propagation without masking it through broader permanent permissions.

Source facts

AWS KMS follows eventual consistency, so a newly created grant may not be immediately available throughout the service. CreateGrant returns a grant token that supported operations can include to use the new permission immediately. RetireGrant accepts a token for a new grant; RevokeGrant does not.

Source: AWS Documentation.

Applicability

This guide addresses the interval immediately after grant creation, rather than a general retry policy for all access denials.

DSE recommendation

DSE recommends carrying the returned grant token through the application step that first needs the new permission. Keep the token associated with the correct key, grantee and operation. Distinguish a propagation-related failure from an incorrect grant or an explicit denial before retrying. Avoid adding a broad key-policy allowance to work around an incomplete grant workflow. Document cleanup and failure handling so temporary grants do not remain after an abandoned operation. Describe which component owns token handoff and which owns grant cleanup if the next operation fails. Keep those responsibilities together in the workflow review so retry handling does not leave an unexplained permission grant after the user-visible operation is abandoned.

Verification

Proposed verification: create a narrow grant on a disposable key and call the supported operation using the returned token. Exercise the intended retirement path and verify resulting permissions after propagation. Preserve error details and configuration identifiers without claiming that every AccessDenied error is caused by consistency.

Official reference

AWS Documentation. Reviewed October 20, 2026.