Grants | EZGH Cloud

Let an EZGH product read a secret for one of its resources, see who can, and revoke access.

A grant lets an EZGH product read one of your secrets when it needs to, for one of its own resources, without anyone handing the product the value. The product keeps a reference to the secret and asks for the value each time. The first product to use grants will be MCP Central.

What a grant says

Field	Meaning
`consumer`	The product’s namespace, such as `mcp`.
`consumerResource`	The resource name of the product’s resource that may read the secret. It must be in the secret’s organization, in any project, and of a type that product uses secrets for.
`version`	`latest` or a version number. A grant for `latest` reads only `latest`; a grant for a number reads only that version.

A second grant for the same product and resource is 409 grant_exists.
A secret can have up to 100 grants.
EZGH can’t check that the product’s resource exists. A grant for a resource that doesn’t exist has no effect, and you can see and revoke it.
Destroying the version a grant is pinned to, or deleting the secret, stops the grant working.

Create and revoke grants

You create grants, usually in the product’s own console page when you choose a secret for a resource. Creating one needs secrets.grants.create and secrets.versions.access on the secret (see Permissions); see CreateSecretGrant. A secret’s grantCount and ListSecretGrants show who has access, and DeleteSecretGrant revokes a grant, which takes effect on the product’s next read.

ezgh secrets grants list prod/app
ezgh secrets grants revoke prod/app sgr_k3f9a0x2m7qp

The CLI lists and revokes grants; it doesn’t create them.

Billing

A product’s reads through a grant aren’t billed to you. The secret’s fields are still billed as usual under Pricing.

Trails

Every time a product reads a secret through a grant, Trails records a ResolveSecret event with the event source secrets.ezghcloud.com. Its userIdentity is an EzghService, with invokedBy set to the product (such as mcp.ezghcloud.com), and it names the secret, version, field, grant and the product’s resource. Values are never recorded.

A product can read a secret only through a grant that matches the secret, product, resource and version. Any other request is refused with the same 404 it gives for a secret that doesn’t exist, so a product learns nothing about secrets it has no grant for.