Replica
Manages a KMS multi-Region replica key that uses external key material. See the AWS KMS Developer Guide for more information on importing key material into multi-Region keys.
Example Usage
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
const primary = new aws.kms.ExternalKey("primary", {
description: "Multi-Region primary key",
deletionWindowInDays: 30,
multiRegion: true,
enabled: true,
keyMaterialBase64: "...",
});
const replica = new aws.kms.ReplicaExternalKey("replica", {
description: "Multi-Region replica key",
deletionWindowInDays: 7,
primaryKeyArn: primaryAwsKmsExternal.arn,
keyMaterialBase64: "...",
});import pulumi
import pulumi_aws as aws
primary = aws.kms.ExternalKey("primary",
description="Multi-Region primary key",
deletion_window_in_days=30,
multi_region=True,
enabled=True,
key_material_base64="...")
replica = aws.kms.ReplicaExternalKey("replica",
description="Multi-Region replica key",
deletion_window_in_days=7,
primary_key_arn=primary_aws_kms_external["arn"],
key_material_base64="...")using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;
return await Deployment.RunAsync(() =>
{
var primary = new Aws.Kms.ExternalKey("primary", new()
{
Description = "Multi-Region primary key",
DeletionWindowInDays = 30,
MultiRegion = true,
Enabled = true,
KeyMaterialBase64 = "...",
});
var replica = new Aws.Kms.ReplicaExternalKey("replica", new()
{
Description = "Multi-Region replica key",
DeletionWindowInDays = 7,
PrimaryKeyArn = primaryAwsKmsExternal.Arn,
KeyMaterialBase64 = "...",
});
});package main
import (
"github.com/pulumi/pulumi-aws/sdk/v6/go/aws/kms"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := kms.NewExternalKey(ctx, "primary", &kms.ExternalKeyArgs{
Description: pulumi.String("Multi-Region primary key"),
DeletionWindowInDays: pulumi.Int(30),
MultiRegion: pulumi.Bool(true),
Enabled: pulumi.Bool(true),
KeyMaterialBase64: pulumi.String("..."),
})
if err != nil {
return err
}
_, err = kms.NewReplicaExternalKey(ctx, "replica", &kms.ReplicaExternalKeyArgs{
Description: pulumi.String("Multi-Region replica key"),
DeletionWindowInDays: pulumi.Int(7),
PrimaryKeyArn: pulumi.Any(primaryAwsKmsExternal.Arn),
KeyMaterialBase64: pulumi.String("..."),
})
if err != nil {
return err
}
return nil
})
}package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.kms.ExternalKey;
import com.pulumi.aws.kms.ExternalKeyArgs;
import com.pulumi.aws.kms.ReplicaExternalKey;
import com.pulumi.aws.kms.ReplicaExternalKeyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var primary = new ExternalKey("primary", ExternalKeyArgs.builder()
.description("Multi-Region primary key")
.deletionWindowInDays(30)
.multiRegion(true)
.enabled(true)
.keyMaterialBase64("...")
.build());
var replica = new ReplicaExternalKey("replica", ReplicaExternalKeyArgs.builder()
.description("Multi-Region replica key")
.deletionWindowInDays(7)
.primaryKeyArn(primaryAwsKmsExternal.arn())
.keyMaterialBase64("...")
.build());
}
}resources:
primary:
type: aws:kms:ExternalKey
properties:
description: Multi-Region primary key
deletionWindowInDays: 30
multiRegion: true
enabled: true
keyMaterialBase64: '...'
replica:
type: aws:kms:ReplicaExternalKey
properties:
description: Multi-Region replica key
deletionWindowInDays: 7
primaryKeyArn: ${primaryAwsKmsExternal.arn}
keyMaterialBase64: '...'Import
Using pulumi import, import KMS multi-Region replica keys using the id. For example:
$ pulumi import aws:kms/replicaExternalKey:ReplicaExternalKey example 1234abcd-12ab-34cd-56ef-1234567890abConstructors
Properties
A flag to indicate whether to bypass the key policy lockout safety check. Setting this value to true increases the risk that the KMS key becomes unmanageable. Do not set this value to true indiscriminately. For more information, refer to the scenario in the Default Key Policy section in the AWS Key Management Service Developer Guide. The default value is false.
The waiting period, specified in number of days. After the waiting period ends, AWS KMS deletes the KMS key. If you specify a value, it must be between 7 and 30, inclusive. If you do not specify a value, it defaults to 30.
A description of the KMS key.
Base64 encoded 256-bit symmetric encryption key material to import. The KMS key is permanently associated with this key material. The same key material can be reimported, but you cannot import different key material.
The key policy to attach to the KMS key. If you do not specify a key policy, AWS KMS attaches the default key policy to the KMS key.
The ARN of the multi-Region primary key to replicate. The primary key must be in a different AWS Region of the same AWS Partition. You can create only one replica of a given primary key in each AWS Region.
Time at which the imported key material expires. When the key material expires, AWS KMS deletes the key material and the key becomes unusable. If not specified, key material does not expire. Valid values: RFC3339 time string (YYYY-MM-DDTHH:MM:SSZ)