aws · mergify · Nov 20, 2025 · Nov 20, 2025 · Nov 20, 2025 · Nov 20, 2025
diff --git a/packages/aws-cdk-lib/aws-apigateway/lib/api-key.ts b/packages/aws-cdk-lib/aws-apigateway/lib/api-key.ts
@@ -104,7 +104,7 @@ abstract class ApiKeyBase extends Resource implements IApiKey {
   /**
    * Collection of grant methods for an ApiKey
    */
-  public readonly grants = ApiKeyGrants._fromApiKey(this);
+  public readonly grants = ApiKeyGrants.fromApiKey(this);
 
   /**
    * Permits the IAM principal all read operations through this key

diff --git a/packages/aws-cdk-lib/aws-appmesh/lib/virtual-gateway.ts b/packages/aws-cdk-lib/aws-appmesh/lib/virtual-gateway.ts
@@ -107,7 +107,7 @@ abstract class VirtualGatewayBase extends cdk.Resource implements IVirtualGatewa
   /**
    * Collection of grant methods for a VirtualGateway
    */
-  public readonly grants: VirtualGatewayGrants = VirtualGatewayGrants._fromVirtualGateway(this);
+  public readonly grants: VirtualGatewayGrants = VirtualGatewayGrants.fromVirtualGateway(this);
 
   public get virtualGatewayRef(): VirtualGatewayReference {
     return {

diff --git a/packages/aws-cdk-lib/aws-appmesh/test/virtual-gateway.test.ts b/packages/aws-cdk-lib/aws-appmesh/test/virtual-gateway.test.ts
@@ -968,7 +968,7 @@ describe('virtual gateway', () => {
 
     // WHEN
     const user = new iam.User(stack, 'test');
-    VirtualGatewayGrants._fromVirtualGateway(gateway).streamAggregatedResources(user);
+    VirtualGatewayGrants.fromVirtualGateway(gateway).streamAggregatedResources(user);
 
     // THEN
     Template.fromStack(stack).hasResourceProperties('AWS::IAM::Policy', {

diff --git a/packages/aws-cdk-lib/aws-cloudfront/lib/distribution.ts b/packages/aws-cdk-lib/aws-cloudfront/lib/distribution.ts
@@ -333,7 +333,7 @@ export class Distribution extends Resource implements IDistribution {
         return grant(this, grantee, ...actions);
       }
       public grantCreateInvalidation(grantee: iam.IGrantable): iam.Grant {
-        return DistributionGrants._fromDistribution(this).createInvalidation(grantee);
+        return DistributionGrants.fromDistribution(this).createInvalidation(grantee);
       }
     }();
   }
@@ -346,7 +346,7 @@ export class Distribution extends Resource implements IDistribution {
   /**
    * Collection of grant methods for a Distribution
    */
-  public readonly grants = DistributionGrants._fromDistribution(this);
+  public readonly grants = DistributionGrants.fromDistribution(this);
 
   private readonly httpVersion: HttpVersion;
   private readonly defaultBehavior: CacheBehavior;

diff --git a/packages/aws-cdk-lib/aws-cloudfront/lib/web-distribution.ts b/packages/aws-cdk-lib/aws-cloudfront/lib/web-distribution.ts
@@ -788,15 +788,15 @@ export class CloudFrontWebDistribution extends cdk.Resource implements IDistribu
         return iam.Grant.addToPrincipal({ grantee, actions, resourceArns: [formatDistributionArn(this)] });
       }
       public grantCreateInvalidation(identity: iam.IGrantable): iam.Grant {
-        return DistributionGrants._fromDistribution(this).createInvalidation(identity);
+        return DistributionGrants.fromDistribution(this).createInvalidation(identity);
       }
     }();
   }
 
   /**
    * Collection of grant methods for a Distribution
    */
-  public readonly grants = DistributionGrants._fromDistribution(this);
+  public readonly grants = DistributionGrants.fromDistribution(this);
 
   /**
    * The logging bucket for this CloudFront distribution.

diff --git a/packages/aws-cdk-lib/aws-cloudfront/test/distribution.test.ts b/packages/aws-cdk-lib/aws-cloudfront/test/distribution.test.ts
@@ -1283,7 +1283,7 @@ test('grants createInvalidation to L1', () => {
   });
 
   DistributionGrants.
-    _fromDistribution(distribution.node.defaultChild as CfnDistribution)
+    fromDistribution(distribution.node.defaultChild as CfnDistribution)
     .createInvalidation(role);
 
   Template.fromStack(stack).hasResourceProperties('AWS::IAM::Policy', {

diff --git a/packages/aws-cdk-lib/aws-codecommit/lib/repository.ts b/packages/aws-cdk-lib/aws-codecommit/lib/repository.ts
@@ -257,7 +257,7 @@ abstract class RepositoryBase extends Resource implements IRepository {
   /**
    * Collection of grant methods for a Repository
    */
-  public readonly grants = RepositoryGrants._fromRepository(this);
+  public readonly grants = RepositoryGrants.fromRepository(this);
 
   public get repositoryRef(): RepositoryReference {
     return {

diff --git a/packages/aws-cdk-lib/aws-codeguruprofiler/lib/profiling-group.ts b/packages/aws-cdk-lib/aws-codeguruprofiler/lib/profiling-group.ts
@@ -75,7 +75,7 @@ abstract class ProfilingGroupBase extends Resource implements IProfilingGroup {
   /**
    * Collection of grant methods for a ProfilingGroup
    */
-  public readonly grants = ProfilingGroupGrants._fromProfilingGroup(this);
+  public readonly grants = ProfilingGroupGrants.fromProfilingGroup(this);
 
   public get profilingGroupRef(): ProfilingGroupReference {
     return {

diff --git a/packages/aws-cdk-lib/aws-ecs/lib/cluster.ts b/packages/aws-cdk-lib/aws-ecs/lib/cluster.ts
@@ -239,7 +239,7 @@ export class Cluster extends Resource implements ICluster {
   /**
    * Collection of grant methods for a Cluster
    */
-  public readonly grants = ClusterGrants._fromCluster(this);
+  public readonly grants = ClusterGrants.fromCluster(this);
 
   /**
    * The names of both ASG and Fargate capacity providers associated with the cluster.

diff --git a/packages/aws-cdk-lib/aws-elasticsearch/lib/domain.ts b/packages/aws-cdk-lib/aws-elasticsearch/lib/domain.ts
@@ -957,7 +957,7 @@ abstract class DomainBase extends cdk.Resource implements IDomain {
   /**
    * Collection of grant methods for a Domain
    */
-  public readonly grants = DomainGrants._fromDomain(this);
+  public readonly grants = DomainGrants.fromDomain(this);
 
   public get domainRef(): DomainReference {
     return {

diff --git a/packages/aws-cdk-lib/aws-events/lib/event-bus.ts b/packages/aws-cdk-lib/aws-events/lib/event-bus.ts
@@ -234,7 +234,7 @@ abstract class EventBusBase extends Resource implements IEventBus, iam.IResource
   /**
    * Collection of grant methods for an EventBus
    */
-  public readonly grants = EventBusGrants._fromEventBus(this);
+  public readonly grants = EventBusGrants.fromEventBus(this);
 
   public get eventBusRef(): EventBusReference {
     return {
@@ -382,7 +382,7 @@ export class EventBus extends EventBusBase {
     // FIXME Doing this hack because this method is static, and we don't have an actual instance of
     //  IEventBusRef to use here for the grants.
     const eventBus = EventBus.fromEventBusName(new Stack(), 'dummy', 'dummy');
-    return EventBusGrants._fromEventBus(eventBus).allPutEvents(grantee);
+    return EventBusGrants.fromEventBus(eventBus).allPutEvents(grantee);
   }
 
   private static eventBusProps(defaultEventBusName: string, props: EventBusProps = {}) {

diff --git a/packages/aws-cdk-lib/aws-iam/lib/role-grants.ts b/packages/aws-cdk-lib/aws-iam/lib/role-grants.ts
@@ -9,10 +9,8 @@ import { ValidationError } from '../../core';
 export class RoleGrants {
   /**
    * Creates grants for IRoleRef
-   *
-   * @internal
    */
-  public static _fromRole(role: IRoleRef): RoleGrants {
+  public static fromRole(role: IRoleRef): RoleGrants {
     return new RoleGrants(role);
   }
 

diff --git a/packages/aws-cdk-lib/aws-iam/lib/role.ts b/packages/aws-cdk-lib/aws-iam/lib/role.ts
@@ -483,7 +483,7 @@ export class Role extends Resource implements IRole {
   /**
    * Collection of grant methods for a Role
    */
-  public readonly grants = RoleGrants._fromRole(this);
+  public readonly grants = RoleGrants.fromRole(this);
 
   private defaultPolicy?: Policy;
   private readonly managedPolicies: IManagedPolicy[] = [];

diff --git a/packages/aws-cdk-lib/aws-kinesisfirehose/lib/delivery-stream.ts b/packages/aws-cdk-lib/aws-kinesisfirehose/lib/delivery-stream.ts
@@ -98,7 +98,7 @@ abstract class DeliveryStreamBase extends cdk.Resource implements IDeliveryStrea
   /**
    * Collection of grant methods for a DeliveryStream
    */
-  public readonly grants = DeliveryStreamGrants._fromDeliveryStream(this);
+  public readonly grants = DeliveryStreamGrants.fromDeliveryStream(this);
 
   /**
    * Network connections between Amazon Data Firehose and other resources, i.e. Redshift cluster.

diff --git a/packages/aws-cdk-lib/aws-logs/lib/log-group.ts b/packages/aws-cdk-lib/aws-logs/lib/log-group.ts
@@ -142,7 +142,7 @@ abstract class LogGroupBase extends Resource implements ILogGroup {
   /**
    * Collection of grant methods for a LogGroup
    */
-  public readonly grants = LogGroupGrants._fromLogGroup(this);
+  public readonly grants = LogGroupGrants.fromLogGroup(this);
 
   private policy?: ResourcePolicy;
 

diff --git a/packages/aws-cdk-lib/aws-opensearchservice/lib/domain.ts b/packages/aws-cdk-lib/aws-opensearchservice/lib/domain.ts
@@ -990,7 +990,7 @@ abstract class DomainBase extends cdk.Resource implements IDomain {
   /**
    * Collection of grant methods for a Domain
    */
-  public readonly grants = DomainGrants._fromDomain(this);
+  public readonly grants = DomainGrants.fromDomain(this);
 
   public get domainRef(): DomainReference {
     return {

diff --git a/packages/aws-cdk-lib/aws-scheduler/lib/schedule-group.ts b/packages/aws-cdk-lib/aws-scheduler/lib/schedule-group.ts
@@ -147,7 +147,7 @@ abstract class ScheduleGroupBase extends Resource implements IScheduleGroup {
   /**
    * Collection of grant methods for a ScheduleGroup
    */
-  public readonly grants = ScheduleGroupGrants._fromScheduleGroup(this);
+  public readonly grants = ScheduleGroupGrants.fromScheduleGroup(this);
 
   public get scheduleGroupRef(): ScheduleGroupReference {
     return {

diff --git a/packages/aws-cdk-lib/aws-sns/lib/topic-base.ts b/packages/aws-cdk-lib/aws-sns/lib/topic-base.ts
@@ -97,7 +97,7 @@ export abstract class TopicBase extends Resource implements ITopic, IEncryptedRe
   /**
    * Collection of grant methods for a Topic
    */
-  public readonly grants: TopicGrants = TopicGrants._fromTopic(this);
+  public readonly grants: TopicGrants = TopicGrants.fromTopic(this);
 
   /**
    * Controls automatic creation of policy objects.

diff --git a/packages/aws-cdk-lib/aws-sns/test/sns.test.ts b/packages/aws-cdk-lib/aws-sns/test/sns.test.ts
@@ -312,7 +312,7 @@ describe('Topic', () => {
     const user = new iam.User(stack, 'User');
 
     // WHEN
-    TopicGrants._fromTopic(topic).publish(user);
+    TopicGrants.fromTopic(topic).publish(user);
 
     // THEN
     let template = Template.fromStack(stack);

diff --git a/packages/aws-cdk-lib/aws-sqs/lib/queue-base.ts b/packages/aws-cdk-lib/aws-sqs/lib/queue-base.ts
@@ -141,7 +141,7 @@ export abstract class QueueBase extends Resource implements IQueue, IEncryptedRe
   /**
    * Collection of grant methods for a Queue
    */
-  public readonly grants = QueueGrants._fromQueue(this);
+  public readonly grants = QueueGrants.fromQueue(this);
 
   /**
    * Controls automatic creation of policy objects.

diff --git a/tools/@aws-cdk/spec2cdk/lib/cdk/grants-module.ts b/tools/@aws-cdk/spec2cdk/lib/cdk/grants-module.ts
@@ -158,12 +158,11 @@ export class GrantsModule extends Module {
       }
 
       const factoryMethod = classType.addMethod({
-        name: `_from${resource.name}`,
+        name: `from${resource.name}`,
         static: true,
         returnType: Type.fromName(this, `${classType.name}`),
         docs: {
           summary: `Creates grants for ${className}`,
-          remarks: '@internal',
         },
       });
 

diff --git a/tools/@aws-cdk/spec2cdk/test/__snapshots__/grants.test.ts.snap b/tools/@aws-cdk/spec2cdk/test/__snapshots__/grants.test.ts.snap
@@ -35,10 +35,8 @@ interface TopicGrantsProps {
 export class TopicGrants {
   /**
    * Creates grants for TopicGrants
-   *
-   * @internal
    */
-  public static _fromTopic(resource: sns.ITopicRef): TopicGrants {
+  public static fromTopic(resource: sns.ITopicRef): TopicGrants {
     return new TopicGrants({
       resource: resource,
       encryptedResource: (iam.GrantableResources.isEncryptedResource(resource) ? resource : undefined),