AWS KMS Terraform module

Upstream version 4.2.0

1 control from CISA Cyber Essentials requirements

Terraform Module Source

cisacyberessentials.compliance.tf/terraform-aws-modules/kms/aws

Compliance Inputs Outputs Resources Diff (0)README

41 unique

Name	Type	Default	Description
Enforced · locked by active controls
enable_key_rotationkms_cmk_rotation_enabled	bool	true	Specifies whether key rotation is enabled. Defaults to `true`
Optional
aliases	list(string)	[]	A list of aliases to create. Note - due to the use of `toset()`, values must be static strings and not computed values
aliases_use_name_prefix	bool	false	Determines whether the alias name is used as a prefix
bypass_policy_lockout_safety_check	bool	null	A flag to indicate whether to bypass the key policy lockout safety check. Setting this value to true increases the risk that the KMS key becomes unmanageable
computed_aliases	map({...})	{}	A map of aliases to create. Values provided via the `name` key of the map can be computed from upstream resources
create	bool	true	Determines whether resources will be created (affects all resources)
create_external	bool	false	Determines whether an external CMK (externally provided material) will be created or a standard CMK (AWS provided material)
create_replica	bool	false	Determines whether a replica standard CMK will be created (AWS provided material)
create_replica_external	bool	false	Determines whether a replica external CMK will be created (externally provided material)
custom_key_store_id	string	null	ID of the KMS Custom Key Store where the key will be stored instead of KMS (eg CloudHSM).
customer_master_key_spec	string	null	Specifies whether the key contains a symmetric key or an asymmetric key pair and the encryption algorithms or signing algorithms that the key supports. Valid values: `SYMMETRIC_DEFAULT`, `RSA_2048`, `RSA_3072`, `RSA_4096`, `HMAC_256`, `ECC_NIST_P256`, `ECC_NIST_P384`, `ECC_NIST_P521`, or `ECC_SECG_P256K1`. Defaults to `SYMMETRIC_DEFAULT`
deletion_window_in_days	number	null	The waiting period, specified in number of days. After the waiting period ends, AWS KMS deletes the KMS key. If you specify a value, it must be between `7` and `30`, inclusive. If you do not specify a value, it defaults to `30`
description	string	null	The description of the key as viewed in AWS console
enable_default_policy	bool	true	Specifies whether to enable the default key policy. Defaults to `true`
enable_route53_dnssec	bool	false	Determines whether the KMS policy used for Route53 DNSSEC signing is enabled
grants	map({...})	null	A map of grant definitions to create
is_enabled	bool	null	Specifies whether the key is enabled. Defaults to `true`
key_administrators	list(string)	[]	A list of IAM ARNs for [key administrators](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-default-allow-administrators)
key_asymmetric_public_encryption_users	list(string)	[]	A list of IAM ARNs for [key asymmetric public encryption users](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-users-crypto)
key_asymmetric_sign_verify_users	list(string)	[]	A list of IAM ARNs for [key asymmetric sign and verify users](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-users-crypto)
key_hmac_users	list(string)	[]	A list of IAM ARNs for [key HMAC users](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-users-crypto)
key_material_base64	string	null	Base64 encoded 256-bit symmetric encryption key material to import. The CMK is permanently associated with this key material. External key only
key_owners	list(string)	[]	A list of IAM ARNs for those who will have full key permissions (`kms:*`)
key_service_roles_for_autoscaling	list(string)	[]	A list of IAM ARNs for [AWSServiceRoleForAutoScaling roles](https://docs.aws.amazon.com/autoscaling/ec2/userguide/key-policy-requirements-EBS-encryption.html#policy-example-cmk-access)
key_service_users	list(string)	[]	A list of IAM ARNs for [key service users](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-service-integration)
key_spec	string	null	Specifies whether the key contains a symmetric key or an asymmetric key pair and the encryption algorithms or signing algorithms that the key supports. Valid values: SYMMETRIC_DEFAULT, RSA_2048, RSA_3072, RSA_4096, HMAC_224, HMAC_256, HMAC_384, HMAC_512, ECC_NIST_P256, ECC_NIST_P384, ECC_NIST_P521, ECC_SECG_P256K1, ML_DSA_44, ML_DSA_65, ML_DSA_87, or SM2 (China Regions only). Defaults to SYMMETRIC_DEFAULT
key_statements	list({...})	null	A map of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) for custom permission usage
key_symmetric_encryption_users	list(string)	[]	A list of IAM ARNs for [key symmetric encryption users](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-users-crypto)
key_usage	string	null	Specifies the intended use of the key. Valid values: `ENCRYPT_DECRYPT` or `SIGN_VERIFY`. Defaults to `ENCRYPT_DECRYPT`
key_users	list(string)	[]	A list of IAM ARNs for [key users](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-default-allow-users)
multi_region	bool	false	Indicates whether the KMS key is a multi-Region (`true`) or regional (`false`) key. Defaults to `false`
override_policy_documents	list(string)	[]	List of IAM policy documents that are merged together into the exported document. In merging, statements with non-blank `sid`s will override statements with the same `sid`
policy	string	null	A valid policy JSON document. Although this is a key policy, not an IAM policy, an `aws_iam_policy_document`, in the form that designates a principal, can be used
primary_external_key_arn	string	null	The primary external key arn of a multi-region replica external key
primary_key_arn	string	null	The primary key arn of a multi-region replica key
region	string	null	Region where the resource(s) will be managed. Defaults to the Region set in the provider configuration
rotation_period_in_days	number	null	Custom period of time between each rotation date. Must be a number between 90 and 2560 (inclusive)
route53_dnssec_sources	list({...})	null	A list of maps containing `account_ids` and Route53 `hosted_zone_arn` that will be allowed to sign DNSSEC records
source_policy_documents	list(string)	[]	List of IAM policy documents that are merged together into the exported document. Statements must have unique `sid`s
tags	map(string)	{}	A map of tags to add to all resources
valid_to	string	null	Time at which the imported key material expires. When the key material expires, AWS KMS deletes the key material and the CMK becomes unusable. If not specified, key material does not expire