AWS KMS

AWS Key Management Service (AWS KMS) lets you create, manage, and control cryptographic keys across your applications and AWS services.

Requirements

Name	Version
terraform	>= 1.0
aws	>= 5.61

Providers

Name	Version
aws	>= 5.61

Modules

No modules.

Resources

Name	Type
aws_kms_alias.kms_alias	resource
aws_kms_key.kms	resource
aws_caller_identity.current	data source
aws_iam_policy_document.policy	data source
aws_partition.current	data source
aws_region.current	data source

Inputs

Name	Description	Type	Default	Required
bypass_policy_lockout_safety_check	A flag to indicate whether to bypass the key policy lockout safety check. Setting this value to true increases the risk that the KMS key becomes unmanageable	bool	null	no
create	Determines whether resources will be created (affects all resources)	bool	true	no
customer_master_key_spec	Specifies whether the key contains a symmetric key or an asymmetric key pair and the encryption algorithms or signing algorithms that the key supports. Valid values: SYMMETRIC_DEFAULT, RSA_2048, RSA_3072, RSA_4096, HMAC_256, ECC_NIST_P256, ECC_NIST_P384, ECC_NIST_P521, or ECC_SECG_P256K1. Defaults to SYMMETRIC_DEFAULT	string	"SYMMETRIC_DEFAULT"	no
deletion_window_in_days	The waiting period, specified in number of days. After the waiting period ends, AWS KMS deletes the KMS key. If you specify a value, it must be between 7 and 30, inclusive. If you do not specify a value, it defaults to 30	number	null	no
description	The description of the key as viewed in AWS console	string	null	no
enable_default_policy	Specifies whether to enable the default key policy. Defaults to true	bool	true	no
enable_key_rotation	Specifies whether key rotation is enabled. Defaults to true	bool	true	no
enable_route53_dnssec	Determines whether the KMS policy used for Route53 DNSSEC signing is enabled	bool	false	no
is_enabled	Specifies whether the key is enabled. Defaults to true	bool	null	no
key_administrators	A list of IAM ARNs for key administrators	list(string)	[]	no
key_asymmetric_public_encryption_users	A list of IAM ARNs for key asymmetric public encryption users	list(string)	[]	no
key_asymmetric_sign_verify_users	A list of IAM ARNs for key asymmetric sign and verify users	list(string)	[]	no
key_hmac_users	A list of IAM ARNs for key HMAC users	list(string)	[]	no
key_owners	A list of IAM ARNs for those who will have full key permissions (kms:*)	list(string)	[]	no
key_service_roles_for_autoscaling	A list of IAM ARNs for AWSServiceRoleForAutoScaling roles	list(string)	[]	no
key_service_users	A list of IAM ARNs for key service users	list(string)	[]	no
key_statements	A map of IAM policy statements for custom permission usage	any	{}	no
key_symmetric_encryption_users	A list of IAM ARNs for key symmetric encryption users	list(string)	[]	no
key_usage	Specifies the intended use of the key. Valid values: ENCRYPT_DECRYPT or SIGN_VERIFY. Defaults to ENCRYPT_DECRYPT	string	null	no
key_users	A list of IAM ARNs for key users	list(string)	[]	no
multi_region	Indicates whether the KMS key is a multi-Region (true) or regional (false) key. Defaults to false	bool	false	no
name	AWS Key Management Service parameters	string	"armonik-kms"	no
override_policy_documents	List of IAM policy documents that are merged together into the exported document. In merging, statements with non-blank sids will override statements with the same sid	list(string)	[]	no
policy	A valid policy JSON document. Although this is a key policy, not an IAM policy, an aws_iam_policy_document, in the form that designates a principal, can be used	string	null	no
route53_dnssec_sources	A list of maps containing account_ids and Route53 hosted_zone_arn that will be allowed to sign DNSSEC records	list(any)	[]	no
source_policy_documents	List of IAM policy documents that are merged together into the exported document. Statements must have unique sids	list(string)	[]	no
tags	A map of tags to add to all resources	map(string)	{}	no

Outputs

Name	Description
key_arn	The Amazon Resource Name (ARN) of the key
key_id	The globally unique identifier for the key
kms_alias	Alias KMS

Examples

• Complete AWS KMS Example
  • Requirements
  • Providers
  • Modules
  • Resources
  • Inputs
  • Outputs