ExternalKey

Manages a KMS Customer Master Key that uses external key material. To instead manage a KMS Customer Master Key where AWS automatically generates and potentially rotates key material, see the aws.kms.Key resource.

Note: All arguments including the key material will be stored in the raw state as plain-text.

Example Usage

using Pulumi;
using Aws = Pulumi.Aws;

class MyStack : Stack
{
    public MyStack()
    {
        var example = new Aws.Kms.ExternalKey("example", new Aws.Kms.ExternalKeyArgs
        {
            Description = "KMS EXTERNAL for AMI encryption",
        });
    }

}

package main

import (
    "github.com/pulumi/pulumi-aws/sdk/v2/go/aws/kms"
    "github.com/pulumi/pulumi/sdk/v2/go/pulumi"
)

func main() {
    pulumi.Run(func(ctx *pulumi.Context) error {
        _, err := kms.NewExternalKey(ctx, "example", &kms.ExternalKeyArgs{
            Description: pulumi.String("KMS EXTERNAL for AMI encryption"),
        })
        if err != nil {
            return err
        }
        return nil
    })
}

import pulumi
import pulumi_aws as aws

example = aws.kms.ExternalKey("example", description="KMS EXTERNAL for AMI encryption")

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = new aws.kms.ExternalKey("example", {
    description: "KMS EXTERNAL for AMI encryption",
});

Create a ExternalKey Resource

new ExternalKey(name: string, args?: ExternalKeyArgs, opts?: CustomResourceOptions);

def ExternalKey(resource_name, opts=None, deletion_window_in_days=None, description=None, enabled=None, key_material_base64=None, policy=None, tags=None, valid_to=None, __props__=None);

func NewExternalKey(ctx *Context, name string, args *ExternalKeyArgs, opts ...ResourceOption) (*ExternalKey, error)

public ExternalKey(string name, ExternalKeyArgs? args = null, CustomResourceOptions? opts = null)

name string: The unique name of the resource.
args ExternalKeyArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
opts ResourceOptions: A bag of options that control this resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args ExternalKeyArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args ExternalKeyArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

ExternalKey Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Programming Model docs.

Inputs

The ExternalKey resource accepts the following input properties:

DeletionWindowInDays int: Duration in days after which the key is deleted after destruction of the resource. Must be between 7 and 30 days. Defaults to 30.
Description string: Description of the key.
Enabled bool: Specifies whether the key is enabled. Keys pending import can only be false. Imported keys default to true unless expired.
KeyMaterialBase64 string: Base64 encoded 256-bit symmetric encryption key material to import. The CMK is permanently associated with this key material. The same key material can be reimported, but you cannot import different key material.
Policy string: A key policy JSON document. If you do not provide a key policy, AWS KMS attaches a default key policy to the CMK.
Tags Dictionary<string, string>: A key-value map of tags to assign to the key.
ValidTo string: Time at which the imported key material expires. When the key material expires, AWS KMS deletes the key material and the CMK becomes unusable. If not specified, key material does not expire. Valid values: RFC3339 time string (YYYY-MM-DDTHH:MM:SSZ)

DeletionWindowInDays int: Duration in days after which the key is deleted after destruction of the resource. Must be between 7 and 30 days. Defaults to 30.
Description string: Description of the key.
Enabled bool: Specifies whether the key is enabled. Keys pending import can only be false. Imported keys default to true unless expired.
KeyMaterialBase64 string: Base64 encoded 256-bit symmetric encryption key material to import. The CMK is permanently associated with this key material. The same key material can be reimported, but you cannot import different key material.
Policy string: A key policy JSON document. If you do not provide a key policy, AWS KMS attaches a default key policy to the CMK.
Tags map[string]string: A key-value map of tags to assign to the key.
ValidTo string: Time at which the imported key material expires. When the key material expires, AWS KMS deletes the key material and the CMK becomes unusable. If not specified, key material does not expire. Valid values: RFC3339 time string (YYYY-MM-DDTHH:MM:SSZ)

deletionWindowInDays number: Duration in days after which the key is deleted after destruction of the resource. Must be between 7 and 30 days. Defaults to 30.
description string: Description of the key.
enabled boolean: Specifies whether the key is enabled. Keys pending import can only be false. Imported keys default to true unless expired.
keyMaterialBase64 string: Base64 encoded 256-bit symmetric encryption key material to import. The CMK is permanently associated with this key material. The same key material can be reimported, but you cannot import different key material.
policy string: A key policy JSON document. If you do not provide a key policy, AWS KMS attaches a default key policy to the CMK.
tags {[key: string]: string}: A key-value map of tags to assign to the key.
validTo string: Time at which the imported key material expires. When the key material expires, AWS KMS deletes the key material and the CMK becomes unusable. If not specified, key material does not expire. Valid values: RFC3339 time string (YYYY-MM-DDTHH:MM:SSZ)

deletion_window_in_days float: Duration in days after which the key is deleted after destruction of the resource. Must be between 7 and 30 days. Defaults to 30.
description str: Description of the key.
enabled bool: Specifies whether the key is enabled. Keys pending import can only be false. Imported keys default to true unless expired.
key_material_base64 str: Base64 encoded 256-bit symmetric encryption key material to import. The CMK is permanently associated with this key material. The same key material can be reimported, but you cannot import different key material.
policy str: A key policy JSON document. If you do not provide a key policy, AWS KMS attaches a default key policy to the CMK.
tags Dict[str, str]: A key-value map of tags to assign to the key.
valid_to str: Time at which the imported key material expires. When the key material expires, AWS KMS deletes the key material and the CMK becomes unusable. If not specified, key material does not expire. Valid values: RFC3339 time string (YYYY-MM-DDTHH:MM:SSZ)

Outputs

All input properties are implicitly available as output properties. Additionally, the ExternalKey resource produces the following output properties:

Arn string: The Amazon Resource Name (ARN) of the key.
ExpirationModel string: Whether the key material expires. Empty when pending key material import, otherwise KEY_MATERIAL_EXPIRES or KEY_MATERIAL_DOES_NOT_EXPIRE.
Id string: The provider-assigned unique ID for this managed resource.
KeyState string: The state of the CMK.
KeyUsage string: The cryptographic operations for which you can use the CMK.

Arn string: The Amazon Resource Name (ARN) of the key.
ExpirationModel string: Whether the key material expires. Empty when pending key material import, otherwise KEY_MATERIAL_EXPIRES or KEY_MATERIAL_DOES_NOT_EXPIRE.
Id string: The provider-assigned unique ID for this managed resource.
KeyState string: The state of the CMK.
KeyUsage string: The cryptographic operations for which you can use the CMK.

arn string: The Amazon Resource Name (ARN) of the key.
expirationModel string: Whether the key material expires. Empty when pending key material import, otherwise KEY_MATERIAL_EXPIRES or KEY_MATERIAL_DOES_NOT_EXPIRE.
id string: The provider-assigned unique ID for this managed resource.
keyState string: The state of the CMK.
keyUsage string: The cryptographic operations for which you can use the CMK.

arn str: The Amazon Resource Name (ARN) of the key.
expiration_model str: Whether the key material expires. Empty when pending key material import, otherwise KEY_MATERIAL_EXPIRES or KEY_MATERIAL_DOES_NOT_EXPIRE.
id str: The provider-assigned unique ID for this managed resource.
key_state str: The state of the CMK.
key_usage str: The cryptographic operations for which you can use the CMK.

Look up an Existing ExternalKey Resource

Get an existing ExternalKey resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: ExternalKeyState, opts?: CustomResourceOptions): ExternalKey

static get(resource_name, id, opts=None, arn=None, deletion_window_in_days=None, description=None, enabled=None, expiration_model=None, key_material_base64=None, key_state=None, key_usage=None, policy=None, tags=None, valid_to=None, __props__=None);

func GetExternalKey(ctx *Context, name string, id IDInput, state *ExternalKeyState, opts ...ResourceOption) (*ExternalKey, error)

public static ExternalKey Get(string name, Input<string> id, ExternalKeyState? state, CustomResourceOptions? opts = null)

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

Arn string: The Amazon Resource Name (ARN) of the key.
DeletionWindowInDays int: Duration in days after which the key is deleted after destruction of the resource. Must be between 7 and 30 days. Defaults to 30.
Description string: Description of the key.
Enabled bool: Specifies whether the key is enabled. Keys pending import can only be false. Imported keys default to true unless expired.
ExpirationModel string: Whether the key material expires. Empty when pending key material import, otherwise KEY_MATERIAL_EXPIRES or KEY_MATERIAL_DOES_NOT_EXPIRE.
KeyMaterialBase64 string: Base64 encoded 256-bit symmetric encryption key material to import. The CMK is permanently associated with this key material. The same key material can be reimported, but you cannot import different key material.
KeyState string: The state of the CMK.
KeyUsage string: The cryptographic operations for which you can use the CMK.
Policy string: A key policy JSON document. If you do not provide a key policy, AWS KMS attaches a default key policy to the CMK.
Tags Dictionary<string, string>: A key-value map of tags to assign to the key.
ValidTo string: Time at which the imported key material expires. When the key material expires, AWS KMS deletes the key material and the CMK becomes unusable. If not specified, key material does not expire. Valid values: RFC3339 time string (YYYY-MM-DDTHH:MM:SSZ)

Arn string: The Amazon Resource Name (ARN) of the key.
DeletionWindowInDays int: Duration in days after which the key is deleted after destruction of the resource. Must be between 7 and 30 days. Defaults to 30.
Description string: Description of the key.
Enabled bool: Specifies whether the key is enabled. Keys pending import can only be false. Imported keys default to true unless expired.
ExpirationModel string: Whether the key material expires. Empty when pending key material import, otherwise KEY_MATERIAL_EXPIRES or KEY_MATERIAL_DOES_NOT_EXPIRE.
KeyMaterialBase64 string: Base64 encoded 256-bit symmetric encryption key material to import. The CMK is permanently associated with this key material. The same key material can be reimported, but you cannot import different key material.
KeyState string: The state of the CMK.
KeyUsage string: The cryptographic operations for which you can use the CMK.
Policy string: A key policy JSON document. If you do not provide a key policy, AWS KMS attaches a default key policy to the CMK.
Tags map[string]string: A key-value map of tags to assign to the key.
ValidTo string: Time at which the imported key material expires. When the key material expires, AWS KMS deletes the key material and the CMK becomes unusable. If not specified, key material does not expire. Valid values: RFC3339 time string (YYYY-MM-DDTHH:MM:SSZ)

arn string: The Amazon Resource Name (ARN) of the key.
deletionWindowInDays number: Duration in days after which the key is deleted after destruction of the resource. Must be between 7 and 30 days. Defaults to 30.
description string: Description of the key.
enabled boolean: Specifies whether the key is enabled. Keys pending import can only be false. Imported keys default to true unless expired.
expirationModel string: Whether the key material expires. Empty when pending key material import, otherwise KEY_MATERIAL_EXPIRES or KEY_MATERIAL_DOES_NOT_EXPIRE.
keyMaterialBase64 string: Base64 encoded 256-bit symmetric encryption key material to import. The CMK is permanently associated with this key material. The same key material can be reimported, but you cannot import different key material.
keyState string: The state of the CMK.
keyUsage string: The cryptographic operations for which you can use the CMK.
policy string: A key policy JSON document. If you do not provide a key policy, AWS KMS attaches a default key policy to the CMK.
tags {[key: string]: string}: A key-value map of tags to assign to the key.
validTo string: Time at which the imported key material expires. When the key material expires, AWS KMS deletes the key material and the CMK becomes unusable. If not specified, key material does not expire. Valid values: RFC3339 time string (YYYY-MM-DDTHH:MM:SSZ)

arn str: The Amazon Resource Name (ARN) of the key.
deletion_window_in_days float: Duration in days after which the key is deleted after destruction of the resource. Must be between 7 and 30 days. Defaults to 30.
description str: Description of the key.
enabled bool: Specifies whether the key is enabled. Keys pending import can only be false. Imported keys default to true unless expired.
expiration_model str: Whether the key material expires. Empty when pending key material import, otherwise KEY_MATERIAL_EXPIRES or KEY_MATERIAL_DOES_NOT_EXPIRE.
key_material_base64 str: Base64 encoded 256-bit symmetric encryption key material to import. The CMK is permanently associated with this key material. The same key material can be reimported, but you cannot import different key material.
key_state str: The state of the CMK.
key_usage str: The cryptographic operations for which you can use the CMK.
policy str: A key policy JSON document. If you do not provide a key policy, AWS KMS attaches a default key policy to the CMK.
tags Dict[str, str]: A key-value map of tags to assign to the key.
valid_to str: Time at which the imported key material expires. When the key material expires, AWS KMS deletes the key material and the CMK becomes unusable. If not specified, key material does not expire. Valid values: RFC3339 time string (YYYY-MM-DDTHH:MM:SSZ)

Package Details

Repository: https://github.com/pulumi/pulumi-aws
License: Apache-2.0
Notes: This Pulumi package is based on the aws Terraform Provider.

The Pulumi Platform

Get Started

Migrate to Pulumi

Solutions for All Teams and Engineers

Any Code

Any Cloud