Key
Manages a single-Region or multi-Region primary KMS key.
NOTE on KMS Key Policy: KMS Key Policy can be configured in either the standalone resource
aws.kms.KeyPolicyor with the parameterpolicyin this resource. Configuring with both will cause inconsistencies and may overwrite configuration.
Example Usage
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.kms.Key;
import com.pulumi.aws.kms.KeyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var key = new Key("key", KeyArgs.builder()
.deletionWindowInDays(10)
.description("KMS key 1")
.build());
}
}Import
KMS Keys can be imported using the id, e.g.,
$ pulumi import aws:kms/key:Key a 1234abcd-12ab-34cd-56ef-1234567890abProperties
A flag to indicate whether to bypass the key policy lockout safety check. Setting this value to true increases the risk that the KMS key becomes unmanageable. Do not set this value to true indiscriminately. For more information, refer to the scenario in the Default Key Policy section in the AWS Key Management Service Developer Guide. The default value is false.
Specifies whether the key contains a symmetric key or an asymmetric key pair and the encryption algorithms or signing algorithms that the key supports. Valid values: SYMMETRIC_DEFAULT, RSA_2048, RSA_3072, RSA_4096, HMAC_256, ECC_NIST_P256, ECC_NIST_P384, ECC_NIST_P521, or ECC_SECG_P256K1. Defaults to SYMMETRIC_DEFAULT. For help with choosing a key spec, see the AWS KMS Developer Guide.
ID of the KMS Custom Key Store where the key will be stored instead of KMS (eg CloudHSM).
The waiting period, specified in number of days. After the waiting period ends, AWS KMS deletes the KMS key. If you specify a value, it must be between 7 and 30, inclusive. If you do not specify a value, it defaults to 30. If the KMS key is a multi-Region primary key with replicas, the waiting period begins when the last of its replica keys is deleted. Otherwise, the waiting period begins immediately.
The description of the key as viewed in AWS console.
Specifies whether key rotation is enabled. Defaults to false.
Indicates whether the KMS key is a multi-Region (true) or regional (false) key. Defaults to false.