shc connection grant

authorise a connection to mint a capability for a tenant

Synopsis

Grant a connection the right to mint a capability’s scoped sub-credential FOR another tenant. A connection-backed integration edge (-i s3=@<connection>) is denied unless a matching grant exists for the (connection, capability, grantee) triple.

—boundary attaches an OPTIONAL permissions-boundary policy (a file path or inline JSON): effective mint permissions = the app’s declared policy ∩ this boundary, enforced by the backend. Re-granting the same triple with a new —boundary re-scopes it.

shc connection grant <connection> [flags]

Examples

  shc connection grant aws-primary --capability s3-bucket --grantee acme
  shc connection grant aws-primary --capability aws-iam --grantee acme --boundary ./boundary.json

Options

      --boundary string     permissions-boundary policy: a JSON file path or inline JSON (optional)
      --capability string   capability to grant (e.g. s3-bucket)
      --grantee string      tenant authorised to mint against the connection
  -h, --help                help for grant
  -t, --tenant string       owning tenant (defaults to the active tenant)

Options inherited from parent commands

      --config stringArray   extra YAML config file to layer on top of auto-discovered config; repeatable, later files win
  -d, --debug                enable debug mode (default: $SHC_DEBUG)
  -e, --environment string   environment name (default: $SHC_ENVIRONMENT)
      --exclude string       comma-separated dotted paths to drop
      --fields string        comma-separated columns/keys to show (and their order)
      --filter string        comma-separated dotted paths to keep (drops everything else)
  -o, --output string        output format: tty|text|json|yaml (default: $SHC_OUTPUT)
  -s, --stack string         stack name (default: $SHC_STACK)
  -v, --verbose              verbose output (default: $SHC_VERBOSE)

shc connection grant