docs: def create_grant(key_id, grantee_principal, retiring_principal=None,
                   operations=None, constraints=None, grant_tokens=None,
                   region=None, key=None, keyid=None, profile=None):
      '''
      Adds a grant to a key to specify who can access the key and under what
      conditions.
  
      CLI example::
  
          salt myminion boto_kms.create_grant 'alias/mykey' 'arn:aws:iam::1111111:/role/myrole' operations='["Encrypt","Decrypt"]'
      '''
      conn = _get_conn(region=region, key=key, keyid=keyid, profile=profile)
  
      if key_id.startswith('alias/'):
          key_id = _get_key_id(key_id)
      r = {}
      try:
          r['grant'] = conn.create_grant(
              key_id,
              grantee_principal,
              retiring_principal=retiring_principal,
              operations=operations,
              constraints=constraints,
              grant_tokens=grant_tokens
          )
      except boto.exception.BotoServerError as e:
          r['error'] = __utils__['boto.get_error'](e)
      return r