aws_kms_key

Provides a KMS customer master key.

Example Usage

resource "aws_kms_key" "a" {
  description             = "KMS key 1"
  deletion_window_in_days = 10
}

Argument Reference

The following arguments are supported:

• description - (Optional) The description of the key as viewed in AWS console.
• key_usage - (Optional) Specifies the intended use of the key. Defaults to ENCRYPT_DECRYPT, and only symmetric encryption and decryption are supported.
• policy - (Optional) A valid policy JSON document.
• deletion_window_in_days - (Optional) Duration in days after which the key is deleted after destruction of the resource, must be between 7 and 30 days. Defaults to 30 days.
• is_enabled - (Optional) Specifies whether the key is enabled. Defaults to true.
• enable_key_rotation - (Optional) Specifies whether key rotation is enabled. Defaults to false.
• tags - (Optional) A mapping of tags to assign to the object.

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• arn - The Amazon Resource Name (ARN) of the key.
• key_id - The globally unique identifier for the key.

Import

KMS Keys can be imported using the id, e.g.

$ terraform import aws_kms_key.a arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab