Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Vercel Provider
  4. API Docs
  5. KmsProjectGrant
Viewing docs for Vercel v5.21.1
published on Thursday, Oct 15, 2026 by Pulumiverse
Schema (JSON)
pulumiverse/pulumi-vercel

vercel.KmsProjectGrant

vercel logo vercel logo
Viewing docs for Vercel v5.21.1
published on Thursday, Oct 15, 2026 by Pulumiverse
Schema (JSON)
pulumiverse/pulumi-vercel

    Provides a Vercel KMS project grant.

    Note: Vercel KMS is currently in beta. Its resources, data sources, and the underlying API may change in backwards-incompatible ways in future releases of the provider.

    A project grant authorizes a Vercel project to request signed JWTs from a KMS issuer in the listed environments, optionally with additional token claims.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as vercel from "@pulumiverse/vercel";

const example = new vercel.Project("example", {name: "example-project"});
const exampleKmsIssuer = new vercel.KmsIssuer("example", {name: "my-issuer"});
const exampleKmsProjectGrant = new vercel.KmsProjectGrant("example", {
    issuerId: exampleKmsIssuer.id,
    projectId: example.id,
    environments: [
        "production",
        "preview",
    ],
    tokenClaims: JSON.stringify({
        aud: "https://example.com",
    }),
});

    import pulumi
import json
import pulumiverse_vercel as vercel

example = vercel.Project("example", name="example-project")
example_kms_issuer = vercel.KmsIssuer("example", name="my-issuer")
example_kms_project_grant = vercel.KmsProjectGrant("example",
    issuer_id=example_kms_issuer.id,
    project_id=example.id,
    environments=[
        "production",
        "preview",
    ],
    token_claims=json.dumps({
        "aud": "https://example.com",
    }))

    package main

import (
	"encoding/json"

	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	"github.com/pulumiverse/pulumi-vercel/sdk/v5/go/vercel"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := vercel.NewProject(ctx, "example", &vercel.ProjectArgs{
			Name: pulumi.String("example-project"),
		})
		if err != nil {
			return err
		}
		exampleKmsIssuer, err := vercel.NewKmsIssuer(ctx, "example", &vercel.KmsIssuerArgs{
			Name: pulumi.String("my-issuer"),
		})
		if err != nil {
			return err
		}
		tmpJSON0, err := json.Marshal(map[string]interface{}{
			"aud": "https://example.com",
		})
		if err != nil {
			return err
		}
		json0 := string(tmpJSON0)
		_, err = vercel.NewKmsProjectGrant(ctx, "example", &vercel.KmsProjectGrantArgs{
			IssuerId:  exampleKmsIssuer.ID(),
			ProjectId: example.ID(),
			Environments: pulumi.StringArray{
				pulumi.String("production"),
				pulumi.String("preview"),
			},
			TokenClaims: pulumi.String(json0),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using System.Text.Json;
using Pulumi;
using Vercel = Pulumiverse.Vercel;

return await Deployment.RunAsync(() => 
{
    var example = new Vercel.Project("example", new()
    {
        Name = "example-project",
    });

    var exampleKmsIssuer = new Vercel.KmsIssuer("example", new()
    {
        Name = "my-issuer",
    });

    var exampleKmsProjectGrant = new Vercel.KmsProjectGrant("example", new()
    {
        IssuerId = exampleKmsIssuer.Id,
        ProjectId = example.Id,
        Environments = new[]
        {
            "production",
            "preview",
        },
        TokenClaims = JsonSerializer.Serialize(new Dictionary<string, object?>
        {
            ["aud"] = "https://example.com",
        }),
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumiverse.vercel.Project;
import com.pulumiverse.vercel.ProjectArgs;
import com.pulumiverse.vercel.KmsIssuer;
import com.pulumiverse.vercel.KmsIssuerArgs;
import com.pulumiverse.vercel.KmsProjectGrant;
import com.pulumiverse.vercel.KmsProjectGrantArgs;
import static com.pulumi.codegen.internal.Serialization.*;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new Project("example", ProjectArgs.builder()
            .name("example-project")
            .build());

        var exampleKmsIssuer = new KmsIssuer("exampleKmsIssuer", KmsIssuerArgs.builder()
            .name("my-issuer")
            .build());

        var exampleKmsProjectGrant = new KmsProjectGrant("exampleKmsProjectGrant", KmsProjectGrantArgs.builder()
            .issuerId(exampleKmsIssuer.id())
            .projectId(example.id())
            .environments(            
                "production",
                "preview")
            .tokenClaims(serializeJson(
                jsonObject(
                    jsonProperty("aud", "https://example.com")
                )))
            .build());

    }
}

    resources:
  example:
    type: vercel:Project
    properties:
      name: example-project
  exampleKmsIssuer:
    type: vercel:KmsIssuer
    name: example
    properties:
      name: my-issuer
  exampleKmsProjectGrant:
    type: vercel:KmsProjectGrant
    name: example
    properties:
      issuerId: ${exampleKmsIssuer.id}
      projectId: ${example.id}
      environments:
        - production
        - preview
      tokenClaims:
        fn::toJSON:
          aud: https://example.com

    Example coming soon!

    Create KmsProjectGrant Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new KmsProjectGrant(name: string, args: KmsProjectGrantArgs, opts?: CustomResourceOptions);
    @overload
def KmsProjectGrant(resource_name: str,
                    args: KmsProjectGrantArgs,
                    opts: Optional[ResourceOptions] = None)

@overload
def KmsProjectGrant(resource_name: str,
                    opts: Optional[ResourceOptions] = None,
                    environments: Optional[Sequence[str]] = None,
                    issuer_id: Optional[str] = None,
                    project_id: Optional[str] = None,
                    team_id: Optional[str] = None,
                    token_claims: Optional[str] = None)
    func NewKmsProjectGrant(ctx *Context, name string, args KmsProjectGrantArgs, opts ...ResourceOption) (*KmsProjectGrant, error)
    public KmsProjectGrant(string name, KmsProjectGrantArgs args, CustomResourceOptions? opts = null)
    public KmsProjectGrant(String name, KmsProjectGrantArgs args)
public KmsProjectGrant(String name, KmsProjectGrantArgs args, CustomResourceOptions options)

    type: vercel:KmsProjectGrant
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vercel_kms_project_grant" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args KmsProjectGrantArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args KmsProjectGrantArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args KmsProjectGrantArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args KmsProjectGrantArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args KmsProjectGrantArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var kmsProjectGrantResource = new Vercel.KmsProjectGrant("kmsProjectGrantResource", new()
{
    Environments = new[]
    {
        "string",
    },
    IssuerId = "string",
    ProjectId = "string",
    TeamId = "string",
    TokenClaims = "string",
});

    example, err := vercel.NewKmsProjectGrant(ctx, "kmsProjectGrantResource", &vercel.KmsProjectGrantArgs{
	Environments: pulumi.StringArray{
		pulumi.String("string"),
	},
	IssuerId:    pulumi.String("string"),
	ProjectId:   pulumi.String("string"),
	TeamId:      pulumi.String("string"),
	TokenClaims: pulumi.String("string"),
})

    resource "vercel_kms_project_grant" "kmsProjectGrantResource" {
  lifecycle {
    create_before_destroy = true
  }
  environments = ["string"]
  issuer_id    = "string"
  project_id   = "string"
  team_id      = "string"
  token_claims = "string"
}

    var kmsProjectGrantResource = new KmsProjectGrant("kmsProjectGrantResource", KmsProjectGrantArgs.builder()
    .environments("string")
    .issuerId("string")
    .projectId("string")
    .teamId("string")
    .tokenClaims("string")
    .build());

    kms_project_grant_resource = vercel.KmsProjectGrant("kmsProjectGrantResource",
    environments=["string"],
    issuer_id="string",
    project_id="string",
    team_id="string",
    token_claims="string")

    const kmsProjectGrantResource = new vercel.KmsProjectGrant("kmsProjectGrantResource", {
    environments: ["string"],
    issuerId: "string",
    projectId: "string",
    teamId: "string",
    tokenClaims: "string",
});

    type: vercel:KmsProjectGrant
properties:
    environments:
        - string
    issuerId: string
    projectId: string
    teamId: string
    tokenClaims: string

    KmsProjectGrant Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The KmsProjectGrant resource accepts the following input properties:

    Environments List<string>
    The environments in which the project may request signed tokens (for example production, preview).
    IssuerId string
    The ID of the issuer this policy is attached to.
    ProjectId string
    The ID of the Vercel project being granted access.
    TeamId string
    The ID of the team the issuer exists under. Required when configuring a team resource if a default team has not been set in the provider.
    TokenClaims string
    Additional claims KMS should include in signed JWTs for this policy, as a JSON-encoded object.
    Environments []string
    The environments in which the project may request signed tokens (for example production, preview).
    IssuerId string
    The ID of the issuer this policy is attached to.
    ProjectId string
    The ID of the Vercel project being granted access.
    TeamId string
    The ID of the team the issuer exists under. Required when configuring a team resource if a default team has not been set in the provider.
    TokenClaims string
    Additional claims KMS should include in signed JWTs for this policy, as a JSON-encoded object.
    environments list(string)
    The environments in which the project may request signed tokens (for example production, preview).
    issuer_id string
    The ID of the issuer this policy is attached to.
    project_id string
    The ID of the Vercel project being granted access.
    team_id string
    The ID of the team the issuer exists under. Required when configuring a team resource if a default team has not been set in the provider.
    token_claims string
    Additional claims KMS should include in signed JWTs for this policy, as a JSON-encoded object.
    environments List<String>
    The environments in which the project may request signed tokens (for example production, preview).
    issuerId String
    The ID of the issuer this policy is attached to.
    projectId String
    The ID of the Vercel project being granted access.
    teamId String
    The ID of the team the issuer exists under. Required when configuring a team resource if a default team has not been set in the provider.
    tokenClaims String
    Additional claims KMS should include in signed JWTs for this policy, as a JSON-encoded object.
    environments string[]
    The environments in which the project may request signed tokens (for example production, preview).
    issuerId string
    The ID of the issuer this policy is attached to.
    projectId string
    The ID of the Vercel project being granted access.
    teamId string
    The ID of the team the issuer exists under. Required when configuring a team resource if a default team has not been set in the provider.
    tokenClaims string
    Additional claims KMS should include in signed JWTs for this policy, as a JSON-encoded object.
    environments Sequence[str]
    The environments in which the project may request signed tokens (for example production, preview).
    issuer_id str
    The ID of the issuer this policy is attached to.
    project_id str
    The ID of the Vercel project being granted access.
    team_id str
    The ID of the team the issuer exists under. Required when configuring a team resource if a default team has not been set in the provider.
    token_claims str
    Additional claims KMS should include in signed JWTs for this policy, as a JSON-encoded object.
    environments List<String>
    The environments in which the project may request signed tokens (for example production, preview).
    issuerId String
    The ID of the issuer this policy is attached to.
    projectId String
    The ID of the Vercel project being granted access.
    teamId String
    The ID of the team the issuer exists under. Required when configuring a team resource if a default team has not been set in the provider.
    tokenClaims String
    Additional claims KMS should include in signed JWTs for this policy, as a JSON-encoded object.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the KmsProjectGrant resource produces the following output properties:

    CreatedAt string
    The time the policy was created.
    Id string
    The provider-assigned unique ID for this managed resource.
    UpdatedAt string
    The time the policy was last updated.
    CreatedAt string
    The time the policy was created.
    Id string
    The provider-assigned unique ID for this managed resource.
    UpdatedAt string
    The time the policy was last updated.
    created_at string
    The time the policy was created.
    id string
    The provider-assigned unique ID for this managed resource.
    updated_at string
    The time the policy was last updated.
    createdAt String
    The time the policy was created.
    id String
    The provider-assigned unique ID for this managed resource.
    updatedAt String
    The time the policy was last updated.
    createdAt string
    The time the policy was created.
    id string
    The provider-assigned unique ID for this managed resource.
    updatedAt string
    The time the policy was last updated.
    created_at str
    The time the policy was created.
    id str
    The provider-assigned unique ID for this managed resource.
    updated_at str
    The time the policy was last updated.
    createdAt String
    The time the policy was created.
    id String
    The provider-assigned unique ID for this managed resource.
    updatedAt String
    The time the policy was last updated.

    Look up Existing KmsProjectGrant Resource

    Get an existing KmsProjectGrant resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: KmsProjectGrantState, opts?: CustomResourceOptions): KmsProjectGrant
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        created_at: Optional[str] = None,
        environments: Optional[Sequence[str]] = None,
        issuer_id: Optional[str] = None,
        project_id: Optional[str] = None,
        team_id: Optional[str] = None,
        token_claims: Optional[str] = None,
        updated_at: Optional[str] = None) -> KmsProjectGrant
    func GetKmsProjectGrant(ctx *Context, name string, id IDInput, state *KmsProjectGrantState, opts ...ResourceOption) (*KmsProjectGrant, error)
    public static KmsProjectGrant Get(string name, Input<string> id, KmsProjectGrantState? state, CustomResourceOptions? opts = null)
    public static KmsProjectGrant get(String name, Output<String> id, KmsProjectGrantState state, CustomResourceOptions options)
    resources:  _:    type: vercel:KmsProjectGrant    get:      id: ${id}
    import {
  to = vercel_kms_project_grant.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    CreatedAt string
    The time the policy was created.
    Environments List<string>
    The environments in which the project may request signed tokens (for example production, preview).
    IssuerId string
    The ID of the issuer this policy is attached to.
    ProjectId string
    The ID of the Vercel project being granted access.
    TeamId string
    The ID of the team the issuer exists under. Required when configuring a team resource if a default team has not been set in the provider.
    TokenClaims string
    Additional claims KMS should include in signed JWTs for this policy, as a JSON-encoded object.
    UpdatedAt string
    The time the policy was last updated.
    CreatedAt string
    The time the policy was created.
    Environments []string
    The environments in which the project may request signed tokens (for example production, preview).
    IssuerId string
    The ID of the issuer this policy is attached to.
    ProjectId string
    The ID of the Vercel project being granted access.
    TeamId string
    The ID of the team the issuer exists under. Required when configuring a team resource if a default team has not been set in the provider.
    TokenClaims string
    Additional claims KMS should include in signed JWTs for this policy, as a JSON-encoded object.
    UpdatedAt string
    The time the policy was last updated.
    created_at string
    The time the policy was created.
    environments list(string)
    The environments in which the project may request signed tokens (for example production, preview).
    issuer_id string
    The ID of the issuer this policy is attached to.
    project_id string
    The ID of the Vercel project being granted access.
    team_id string
    The ID of the team the issuer exists under. Required when configuring a team resource if a default team has not been set in the provider.
    token_claims string
    Additional claims KMS should include in signed JWTs for this policy, as a JSON-encoded object.
    updated_at string
    The time the policy was last updated.
    createdAt String
    The time the policy was created.
    environments List<String>
    The environments in which the project may request signed tokens (for example production, preview).
    issuerId String
    The ID of the issuer this policy is attached to.
    projectId String
    The ID of the Vercel project being granted access.
    teamId String
    The ID of the team the issuer exists under. Required when configuring a team resource if a default team has not been set in the provider.
    tokenClaims String
    Additional claims KMS should include in signed JWTs for this policy, as a JSON-encoded object.
    updatedAt String
    The time the policy was last updated.
    createdAt string
    The time the policy was created.
    environments string[]
    The environments in which the project may request signed tokens (for example production, preview).
    issuerId string
    The ID of the issuer this policy is attached to.
    projectId string
    The ID of the Vercel project being granted access.
    teamId string
    The ID of the team the issuer exists under. Required when configuring a team resource if a default team has not been set in the provider.
    tokenClaims string
    Additional claims KMS should include in signed JWTs for this policy, as a JSON-encoded object.
    updatedAt string
    The time the policy was last updated.
    created_at str
    The time the policy was created.
    environments Sequence[str]
    The environments in which the project may request signed tokens (for example production, preview).
    issuer_id str
    The ID of the issuer this policy is attached to.
    project_id str
    The ID of the Vercel project being granted access.
    team_id str
    The ID of the team the issuer exists under. Required when configuring a team resource if a default team has not been set in the provider.
    token_claims str
    Additional claims KMS should include in signed JWTs for this policy, as a JSON-encoded object.
    updated_at str
    The time the policy was last updated.
    createdAt String
    The time the policy was created.
    environments List<String>
    The environments in which the project may request signed tokens (for example production, preview).
    issuerId String
    The ID of the issuer this policy is attached to.
    projectId String
    The ID of the Vercel project being granted access.
    teamId String
    The ID of the team the issuer exists under. Required when configuring a team resource if a default team has not been set in the provider.
    tokenClaims String
    Additional claims KMS should include in signed JWTs for this policy, as a JSON-encoded object.
    updatedAt String
    The time the policy was last updated.

    Import

    The pulumi import command can be used, for example:

    If importing into a personal account, or with a team configured on the provider, use the issuer id and project id.

    $ pulumi import vercel:index/kmsProjectGrant:KmsProjectGrant example iss_xxxxxxxxxxxxxxxxxxxxxxxxxxxx/prj_xxxxxxxxxxxxxxxxxxxxxxxxxxxx

    Alternatively, you can import via the team_id, issuer id and project id.

    • team_id can be found in the team settings tab in the Vercel UI.
    $ pulumi import vercel:index/kmsProjectGrant:KmsProjectGrant example team_xxxxxxxxxxxxxxxxxxxxxxxx/iss_xxxxxxxxxxxxxxxxxxxxxxxxxxxx/prj_xxxxxxxxxxxxxxxxxxxxxxxxxxxx

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    vercel pulumiverse/pulumi-vercel
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vercel Terraform Provider.
    vercel logo vercel logo
    Viewing docs for Vercel v5.21.1
    published on Thursday, Oct 15, 2026 by Pulumiverse
    Schema (JSON)
    pulumiverse/pulumi-vercel

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial