@pulumi/aws
Version:
A Pulumi package for creating and managing Amazon Web Services (AWS) cloud resources.
407 lines • 15 kB
JavaScript
"use strict";
// *** WARNING: this file was generated by pulumi-language-nodejs. ***
// *** Do not edit by hand unless you're certain you know what you are doing! ***
Object.defineProperty(exports, "__esModule", { value: true });
exports.Key = void 0;
const pulumi = require("@pulumi/pulumi");
const utilities = require("../utilities");
/**
* Manages a single-Region or multi-Region primary KMS key.
*
* > **NOTE on KMS Key Policy:** KMS Key Policy can be configured in either the standalone resource `aws.kms.KeyPolicy`
* or with the parameter `policy` in this resource.
* Configuring with both will cause inconsistencies and may overwrite configuration.
*
* ## Example Usage
*
* ### Symmetric Encryption KMS Key
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const current = aws.getCallerIdentity({});
* const example = new aws.kms.Key("example", {
* description: "An example symmetric encryption KMS key",
* enableKeyRotation: true,
* deletionWindowInDays: 20,
* policy: JSON.stringify({
* Version: "2012-10-17",
* Id: "key-default-1",
* Statement: [
* {
* Sid: "Enable IAM User Permissions",
* Effect: "Allow",
* Principal: {
* AWS: current.then(current => `arn:aws:iam::${current.accountId}:root`),
* },
* Action: "kms:*",
* Resource: "*",
* },
* {
* Sid: "Allow administration of the key",
* Effect: "Allow",
* Principal: {
* AWS: current.then(current => `arn:aws:iam::${current.accountId}:user/Alice`),
* },
* Action: [
* "kms:ReplicateKey",
* "kms:Create*",
* "kms:Describe*",
* "kms:Enable*",
* "kms:List*",
* "kms:Put*",
* "kms:Update*",
* "kms:Revoke*",
* "kms:Disable*",
* "kms:Get*",
* "kms:Delete*",
* "kms:ScheduleKeyDeletion",
* "kms:CancelKeyDeletion",
* ],
* Resource: "*",
* },
* {
* Sid: "Allow use of the key",
* Effect: "Allow",
* Principal: {
* AWS: current.then(current => `arn:aws:iam::${current.accountId}:user/Bob`),
* },
* Action: [
* "kms:DescribeKey",
* "kms:Encrypt",
* "kms:Decrypt",
* "kms:ReEncrypt*",
* "kms:GenerateDataKey",
* "kms:GenerateDataKeyWithoutPlaintext",
* ],
* Resource: "*",
* },
* ],
* }),
* });
* ```
*
* ### Symmetric Encryption KMS Key With Standalone Policy Resource
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const current = aws.getCallerIdentity({});
* const example = new aws.kms.Key("example", {
* description: "An example symmetric encryption KMS key",
* enableKeyRotation: true,
* deletionWindowInDays: 20,
* });
* const exampleKeyPolicy = new aws.kms.KeyPolicy("example", {
* keyId: example.id,
* policy: JSON.stringify({
* Version: "2012-10-17",
* Id: "key-default-1",
* Statement: [{
* Sid: "Enable IAM User Permissions",
* Effect: "Allow",
* Principal: {
* AWS: current.then(current => `arn:aws:iam::${current.accountId}:root`),
* },
* Action: "kms:*",
* Resource: "*",
* }],
* }),
* });
* ```
*
* ### Asymmetric KMS Key
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const current = aws.getCallerIdentity({});
* const example = new aws.kms.Key("example", {
* description: "RSA-3072 asymmetric KMS key for signing and verification",
* customerMasterKeySpec: "RSA_3072",
* keyUsage: "SIGN_VERIFY",
* enableKeyRotation: false,
* policy: JSON.stringify({
* Version: "2012-10-17",
* Id: "key-default-1",
* Statement: [
* {
* Sid: "Enable IAM User Permissions",
* Effect: "Allow",
* Principal: {
* AWS: current.then(current => `arn:aws:iam::${current.accountId}:root`),
* },
* Action: "kms:*",
* Resource: "*",
* },
* {
* Sid: "Allow administration of the key",
* Effect: "Allow",
* Principal: {
* AWS: current.then(current => `arn:aws:iam::${current.accountId}:role/Admin`),
* },
* Action: [
* "kms:Create*",
* "kms:Describe*",
* "kms:Enable*",
* "kms:List*",
* "kms:Put*",
* "kms:Update*",
* "kms:Revoke*",
* "kms:Disable*",
* "kms:Get*",
* "kms:Delete*",
* "kms:ScheduleKeyDeletion",
* "kms:CancelKeyDeletion",
* ],
* Resource: "*",
* },
* {
* Sid: "Allow use of the key",
* Effect: "Allow",
* Principal: {
* AWS: current.then(current => `arn:aws:iam::${current.accountId}:role/Developer`),
* },
* Action: [
* "kms:Sign",
* "kms:Verify",
* "kms:DescribeKey",
* ],
* Resource: "*",
* },
* ],
* }),
* });
* ```
*
* ### HMAC KMS key
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const current = aws.getCallerIdentity({});
* const example = new aws.kms.Key("example", {
* description: "HMAC_384 key for tokens",
* customerMasterKeySpec: "HMAC_384",
* keyUsage: "GENERATE_VERIFY_MAC",
* enableKeyRotation: false,
* policy: JSON.stringify({
* Version: "2012-10-17",
* Id: "key-default-1",
* Statement: [
* {
* Sid: "Enable IAM User Permissions",
* Effect: "Allow",
* Principal: {
* AWS: current.then(current => `arn:aws:iam::${current.accountId}:root`),
* },
* Action: "kms:*",
* Resource: "*",
* },
* {
* Sid: "Allow administration of the key",
* Effect: "Allow",
* Principal: {
* AWS: current.then(current => `arn:aws:iam::${current.accountId}:role/Admin`),
* },
* Action: [
* "kms:Create*",
* "kms:Describe*",
* "kms:Enable*",
* "kms:List*",
* "kms:Put*",
* "kms:Update*",
* "kms:Revoke*",
* "kms:Disable*",
* "kms:Get*",
* "kms:Delete*",
* "kms:ScheduleKeyDeletion",
* "kms:CancelKeyDeletion",
* ],
* Resource: "*",
* },
* {
* Sid: "Allow use of the key",
* Effect: "Allow",
* Principal: {
* AWS: current.then(current => `arn:aws:iam::${current.accountId}:role/Developer`),
* },
* Action: [
* "kms:GenerateMac",
* "kms:VerifyMac",
* "kms:DescribeKey",
* ],
* Resource: "*",
* },
* ],
* }),
* });
* ```
*
* ### Multi-Region Primary Key
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const current = aws.getCallerIdentity({});
* const example = new aws.kms.Key("example", {
* description: "An example multi-Region primary key",
* multiRegion: true,
* enableKeyRotation: true,
* deletionWindowInDays: 10,
* policy: JSON.stringify({
* Version: "2012-10-17",
* Id: "key-default-1",
* Statement: [
* {
* Sid: "Enable IAM User Permissions",
* Effect: "Allow",
* Principal: {
* AWS: current.then(current => `arn:aws:iam::${current.accountId}:root`),
* },
* Action: "kms:*",
* Resource: "*",
* },
* {
* Sid: "Allow administration of the key",
* Effect: "Allow",
* Principal: {
* AWS: current.then(current => `arn:aws:iam::${current.accountId}:user/Alice`),
* },
* Action: [
* "kms:ReplicateKey",
* "kms:Create*",
* "kms:Describe*",
* "kms:Enable*",
* "kms:List*",
* "kms:Put*",
* "kms:Update*",
* "kms:Revoke*",
* "kms:Disable*",
* "kms:Get*",
* "kms:Delete*",
* "kms:ScheduleKeyDeletion",
* "kms:CancelKeyDeletion",
* ],
* Resource: "*",
* },
* {
* Sid: "Allow use of the key",
* Effect: "Allow",
* Principal: {
* AWS: current.then(current => `arn:aws:iam::${current.accountId}:user/Bob`),
* },
* Action: [
* "kms:DescribeKey",
* "kms:Encrypt",
* "kms:Decrypt",
* "kms:ReEncrypt*",
* "kms:GenerateDataKey",
* "kms:GenerateDataKeyWithoutPlaintext",
* ],
* Resource: "*",
* },
* ],
* }),
* });
* ```
*
* ## Import
*
* ### Identity Schema
*
* #### Required
*
* * `id` - (String) ID of the KMS key.
*
* #### Optional
*
* * `account_id` (String) AWS Account where this resource is managed.
*
* * `region` (String) Region where this resource is managed.
*
* Using `pulumi import`, import KMS Keys using the `id`. For example:
*
* console
*
* % pulumi import aws_kms_key.a 1234abcd-12ab-34cd-56ef-1234567890ab
*/
class Key extends pulumi.CustomResource {
/**
* Get an existing Key resource's state with the given name, ID, and optional extra
* properties used to qualify the lookup.
*
* @param name The _unique_ name of the resulting resource.
* @param id The _unique_ provider ID of the resource to lookup.
* @param state Any extra arguments used during the lookup.
* @param opts Optional settings to control the behavior of the CustomResource.
*/
static get(name, id, state, opts) {
return new Key(name, state, { ...opts, id: id });
}
/**
* Returns true if the given object is an instance of Key. This is designed to work even
* when multiple copies of the Pulumi SDK have been loaded into the same process.
*/
static isInstance(obj) {
if (obj === undefined || obj === null) {
return false;
}
return obj['__pulumiType'] === Key.__pulumiType;
}
constructor(name, argsOrState, opts) {
let resourceInputs = {};
opts = opts || {};
if (opts.id) {
const state = argsOrState;
resourceInputs["arn"] = state?.arn;
resourceInputs["bypassPolicyLockoutSafetyCheck"] = state?.bypassPolicyLockoutSafetyCheck;
resourceInputs["customKeyStoreId"] = state?.customKeyStoreId;
resourceInputs["customerMasterKeySpec"] = state?.customerMasterKeySpec;
resourceInputs["deletionWindowInDays"] = state?.deletionWindowInDays;
resourceInputs["description"] = state?.description;
resourceInputs["enableKeyRotation"] = state?.enableKeyRotation;
resourceInputs["isEnabled"] = state?.isEnabled;
resourceInputs["keyId"] = state?.keyId;
resourceInputs["keyUsage"] = state?.keyUsage;
resourceInputs["multiRegion"] = state?.multiRegion;
resourceInputs["policy"] = state?.policy;
resourceInputs["region"] = state?.region;
resourceInputs["rotationPeriodInDays"] = state?.rotationPeriodInDays;
resourceInputs["tags"] = state?.tags;
resourceInputs["tagsAll"] = state?.tagsAll;
resourceInputs["xksKeyId"] = state?.xksKeyId;
}
else {
const args = argsOrState;
resourceInputs["bypassPolicyLockoutSafetyCheck"] = args?.bypassPolicyLockoutSafetyCheck;
resourceInputs["customKeyStoreId"] = args?.customKeyStoreId;
resourceInputs["customerMasterKeySpec"] = args?.customerMasterKeySpec;
resourceInputs["deletionWindowInDays"] = args?.deletionWindowInDays;
resourceInputs["description"] = args?.description;
resourceInputs["enableKeyRotation"] = args?.enableKeyRotation;
resourceInputs["isEnabled"] = args?.isEnabled;
resourceInputs["keyUsage"] = args?.keyUsage;
resourceInputs["multiRegion"] = args?.multiRegion;
resourceInputs["policy"] = args?.policy;
resourceInputs["region"] = args?.region;
resourceInputs["rotationPeriodInDays"] = args?.rotationPeriodInDays;
resourceInputs["tags"] = args?.tags;
resourceInputs["xksKeyId"] = args?.xksKeyId;
resourceInputs["arn"] = undefined /*out*/;
resourceInputs["keyId"] = undefined /*out*/;
resourceInputs["tagsAll"] = undefined /*out*/;
}
opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
super(Key.__pulumiType, name, resourceInputs, opts);
}
}
exports.Key = Key;
/** @internal */
Key.__pulumiType = 'aws:kms/key:Key';
//# sourceMappingURL=key.js.map