public GrantConstraints getConstraints() {
        return this.constraints;
    }
<p>
Specifies a grant constraint.
</p>
<important>
<p>
Do not include confidential or sensitive information in this field. This field may be displayed in plaintext in
CloudTrail logs and other output.
</p>
</important>
<p>
KMS supports the <code>EncryptionContextEquals</code> and <code>EncryptionContextSubset</code> grant constraints,
which allow the permissions in the grant only when the encryption context in the request matches (
<code>EncryptionContextEquals</code>) or includes (<code>EncryptionContextSubset</code>) the encryption context
specified in the constraint.
</p>
<p>
The encryption context grant constraints are supported only on <a
href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-grant-operations">grant
operations</a> that include an <code>EncryptionContext</code> parameter, such as cryptographic operations on
symmetric encryption KMS keys. Grants with grant constraints can include the <a>DescribeKey</a> and
<a>RetireGrant</a> operations, but the constraint doesn't apply to these operations. If a grant with a grant
constraint includes the <code>CreateGrant</code> operation, the constraint requires that any grants created with
the <code>CreateGrant</code> permission have an equally strict or stricter encryption context constraint.
</p>
<p>
You cannot use an encryption context grant constraint for cryptographic operations with asymmetric KMS keys or
HMAC KMS keys. Operations with these keys don't support an encryption context.
</p>
<p>
Each constraint value can include up to 8 encryption context pairs. The encryption context value in each
constraint cannot exceed 384 characters. For information about grant constraints, see <a
href="https://docs.aws.amazon.com/kms/latest/developerguide/create-grant-overview.html#grant-constraints">Using
grant constraints</a> in the <i>Key Management Service Developer Guide</i>. For more information about encryption
context, see <a
href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a>
in the <i> <i>Key Management Service Developer Guide</i> </i>.
</p>

@return Specifies a grant constraint.</p> <important>
        <p>
        Do not include confidential or sensitive information in this field. This field may be displayed in
        plaintext in CloudTrail logs and other output.
        </p>
        </important>
        <p>
        KMS supports the <code>EncryptionContextEquals</code> and <code>EncryptionContextSubset</code> grant
        constraints, which allow the permissions in the grant only when the encryption context in the request
        matches (<code>EncryptionContextEquals</code>) or includes (<code>EncryptionContextSubset</code>) the
        encryption context specified in the constraint.
        </p>
        <p>
        The encryption context grant constraints are supported only on <a
        href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-grant-operations">grant
        operations</a> that include an <code>EncryptionContext</code> parameter, such as cryptographic operations
        on symmetric encryption KMS keys. Grants with grant constraints can include the <a>DescribeKey</a> and
        <a>RetireGrant</a> operations, but the constraint doesn't apply to these operations. If a grant with a
        grant constraint includes the <code>CreateGrant</code> operation, the constraint requires that any grants
        created with the <code>CreateGrant</code> permission have an equally strict or stricter encryption
        context constraint.
        </p>
        <p>
        You cannot use an encryption context grant constraint for cryptographic operations with asymmetric KMS
        keys or HMAC KMS keys. Operations with these keys don't support an encryption context.
        </p>
        <p>
        Each constraint value can include up to 8 encryption context pairs. The encryption context value in each
        constraint cannot exceed 384 characters. For information about grant constraints, see <a href=
        "https://docs.aws.amazon.com/kms/latest/developerguide/create-grant-overview.html#grant-constraints"
        >Using grant constraints</a> in the <i>Key Management Service Developer Guide</i>. For more information
        about encryption context, see <a
        href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption
        context</a> in the <i> <i>Key Management Service Developer Guide</i> </i>.
aws-java-sdk-kms/src/main/java/com/amazonaws/services/kms/model/CreateGrantRequest.java