terraform-aws-kms-key

About

Terraform module to provision a KMS 🔑.

License

The MIT License (MIT)

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.

Source: <https://opensource.org/licenses/MIT>

See LICENSE for full details.

Authors

• Rafał Masiarek | website | email | github

Documentation

Requirements

Name	Version
terraform	>= 0.14
aws	>= 2.0.0

Modules

No modules.

Resources

Name	Type
aws_kms_key.this	resource

Inputs

Name	Description	Type	Default	Required
customer_master_key_spec	Specifies whether the key contains a symmetric key or an asymmetric key pair and the encryption algorithms or signing algorithms that the key supports. Valid values: SYMMETRIC_DEFAULT, RSA_2048, RSA_3072, RSA_4096, ECC_NIST_P256, ECC_NIST_P384, ECC_NIST_P521, or ECC_SECG_P256K1."	string	"SYMMETRIC_DEFAULT"	no
deletion_window_in_days	Duration in days after which the key is deleted after destruction of the resource	number	10	no
description	The description of the key as viewed in AWS console	string	""	no
enable_key_rotation	Specifies whether key rotation is enabled	bool	true	no
key_usage	Specifies the intended use of the key. Valid values: ENCRYPT_DECRYPT or SIGN_VERIFY.	string	"ENCRYPT_DECRYPT"	no
multi_region	Indicates whether the KMS key is a multi-Region. Valid values: true or false for single-region key.	bool	false	no
policy	A valid KMS policy JSON document. Note that if the policy document is not specific enough (but still valid), Terraform may view the policy as constantly changing in a terraform plan. In this case, please make sure you use the verbose/specific version of the policy.	string	""	no
tags	Map of tags to assign to KMS resource.	map(string)	{}	no

Outputs

Name	Description
key_arn	Key ARN
key_id	Key ID

Examples

module "app_prod_kms_label" {
  source   = "cloudposse/label/null"
  version = "v0.25.0"

  namespace  = "app"
  stage      = "prod"
  name       = "prod-kms"
  attributes = ["private"]
  delimiter  = "-"

  tags = {
    "BusinessUnit" = "XYZ",
  }
}


module "app_prod_kms_key" {
  source = "../../"

  description             = var.description
  deletion_window_in_days = var.deletion_window_in_days
  enable_key_rotation     = var.enable_key_rotation

  tags                    = module.app_prod_kms_label.tags
}