@SdkInternalApi
    final CreateAccessGrantResult executeCreateAccessGrant(CreateAccessGrantRequest createAccessGrantRequest) {

        ExecutionContext executionContext = createExecutionContext(createAccessGrantRequest);
        AWSRequestMetrics awsRequestMetrics = executionContext.getAwsRequestMetrics();
        awsRequestMetrics.startEvent(Field.ClientExecuteTime);
        Request<CreateAccessGrantRequest> request = null;
        Response<CreateAccessGrantResult> response = null;

        try {
            awsRequestMetrics.startEvent(Field.RequestMarshallTime);
            try {
                request = new CreateAccessGrantRequestMarshaller().marshall(super.beforeMarshalling(createAccessGrantRequest));
                // Binds the request metrics to the current request.
                request.setAWSRequestMetrics(awsRequestMetrics);
                request.addHandlerContext(HandlerContextKey.CLIENT_ENDPOINT, endpoint);
                request.addHandlerContext(HandlerContextKey.ENDPOINT_OVERRIDDEN, isEndpointOverridden());
                request.addHandlerContext(HandlerContextKey.SIGNING_REGION, getSigningRegion());
                request.addHandlerContext(HandlerContextKey.SERVICE_ID, "S3 Control");
                request.addHandlerContext(HandlerContextKey.OPERATION_NAME, "CreateAccessGrant");
                request.addHandlerContext(HandlerContextKey.ADVANCED_CONFIG, advancedConfig);

            } finally {
                awsRequestMetrics.endEvent(Field.RequestMarshallTime);
            }

            URI endpointTraitHost = null;
            if (!clientConfiguration.isDisableHostPrefixInjection()) {
                ValidationUtils.assertStringNotEmpty(createAccessGrantRequest.getAccountId(), "AccountId");
                HostnameValidator.validateHostnameCompliant(createAccessGrantRequest.getAccountId(), "AccountId", "createAccessGrantRequest");

                String hostPrefix = "{AccountId}.";
                String resolvedHostPrefix = String.format("%s.", createAccessGrantRequest.getAccountId());

                endpointTraitHost = UriResourcePathUtils.updateUriHost(endpoint, resolvedHostPrefix);
            }

            StaxResponseHandler<CreateAccessGrantResult> responseHandler = new com.amazonaws.services.s3control.internal.S3ControlStaxResponseHandler<CreateAccessGrantResult>(
                    new CreateAccessGrantResultStaxUnmarshaller());

            response = invoke(request, responseHandler, executionContext, null, endpointTraitHost);

            return response.getAwsResponse();

        } finally {

            endClientExecution(awsRequestMetrics, request, response);
        }
    }
<p>
Creates an access grant that gives a grantee access to your S3 data. The grantee can be an IAM user or role or a
directory user, or group. Before you can create a grant, you must have an S3 Access Grants instance in the same
Region as the S3 data. You can create an S3 Access Grants instance using the <a
href="https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_CreateAccessGrantsInstance.html"
>CreateAccessGrantsInstance</a>. You must also have registered at least one S3 data location in your S3 Access
Grants instance using <a
href="https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_CreateAccessGrantsLocation.html"
>CreateAccessGrantsLocation</a>.
</p>
<dl>
<dt>Permissions</dt>
<dd>
<p>
You must have the <code>s3:CreateAccessGrant</code> permission to use this operation.
</p>
</dd>
<dt>Additional Permissions</dt>
<dd>
<p>
For any directory identity - <code>sso:DescribeInstance</code> and <code>sso:DescribeApplication</code>
</p>
<p>
For directory users - <code>identitystore:DescribeUser</code>
</p>
<p>
For directory groups - <code>identitystore:DescribeGroup</code>
</p>
</dd>
</dl>

@param createAccessGrantRequest
@return Result of the CreateAccessGrant operation returned by the service.
@sample AWSS3Control.CreateAccessGrant
@see <a href="http://docs.aws.amazon.com/goto/WebAPI/s3control-2018-08-20/CreateAccessGrant" target="_top">AWS
     API Documentation</a>
aws-java-sdk-s3control/src/main/java/com/amazonaws/services/s3control/AWSS3ControlClient.java