@pulumiverse/scaleway/keymanager/keyMaterial.d.ts

A Pulumi package for creating and managing Scaleway cloud resources.

import * as pulumi from "@pulumi/pulumi";
/**
 * Import externally generated key material into Key Manager to derive a new cryptographic key. The key's origin must be external.
 *
 * > **Security Best Practice:**
 * For enhanced security, we recommend using the `keyMaterialWo` and `saltWo` write-only arguments instead of the regular `keyMaterial` and `salt` arguments. This ensures your sensitive cryptographic material is never stored in Terraform state files, providing superior protection against accidental exposure. Write-Only arguments are supported in Terraform 1.11.0 and later.
 *
 * > **Note:** When using write-only arguments (`keyMaterialWo` and `saltWo`), you must also provide the corresponding version fields (`keyMaterialWoVersion` and `saltWoVersion`) to enable proper resource lifecycle management.
 *
 * ## Example Usage
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as random from "@pulumi/random";
 * import * as scaleway from "@pulumiverse/scaleway";
 * import * as std from "@pulumi/std";
 *
 * const main = new scaleway.keymanager.Key("main", {
 *     name: "my-external-key",
 *     description: "Key with externally imported material",
 *     usage: "symmetric_encryption",
 *     algorithm: "aes_256_gcm",
 *     origin: "external",
 *     region: "fr-par",
 * });
 * const keyMaterial = new random.index.Bytes("key_material", {length: 32});
 * const mainKeyMaterial = new scaleway.keymanager.KeyMaterial("main", {
 *     keyId: main.id,
 *     keyMaterialWo: std.base64encode({
 *         input: keyMaterial.base64,
 *     }).result,
 *     keyMaterialWoVersion: 1,
 * });
 * ```
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as random from "@pulumi/random";
 * import * as scaleway from "@pulumiverse/scaleway";
 * import * as std from "@pulumi/std";
 *
 * const main = new scaleway.keymanager.Key("main", {
 *     name: "my-external-key",
 *     description: "Key with externally imported material and salt",
 *     usage: "symmetric_encryption",
 *     algorithm: "aes_256_gcm",
 *     origin: "external",
 *     region: "fr-par",
 * });
 * const keyMaterial = new random.index.Bytes("key_material", {length: 32});
 * const salt = new random.index.Bytes("salt", {length: 16});
 * const mainKeyMaterial = new scaleway.keymanager.KeyMaterial("main", {
 *     keyId: main.id,
 *     keyMaterialWo: std.base64encode({
 *         input: keyMaterial.base64,
 *     }).result,
 *     keyMaterialWoVersion: 1,
 *     saltWo: std.base64encode({
 *         input: salt.base64,
 *     }).result,
 *     saltWoVersion: 1,
 * });
 * ```
 */
export declare class KeyMaterial extends pulumi.CustomResource {
    /**
     * Get an existing KeyMaterial resource's state with the given name, ID, and optional extra
     * properties used to qualify the lookup.
     *
     * @param name The _unique_ name of the resulting resource.
     * @param id The _unique_ provider ID of the resource to lookup.
     * @param state Any extra arguments used during the lookup.
     * @param opts Optional settings to control the behavior of the CustomResource.
     */
    static get(name: string, id: pulumi.Input<pulumi.ID>, state?: KeyMaterialState, opts?: pulumi.CustomResourceOptions): KeyMaterial;
    /**
     * Returns true if the given object is an instance of KeyMaterial.  This is designed to work even
     * when multiple copies of the Pulumi SDK have been loaded into the same process.
     */
    static isInstance(obj: any): obj is KeyMaterial;
    /**
     * The ID of the key to import key material into. The key's origin must be external (UUID format). Can be a plain UUID or a regional ID.
     */
    readonly keyId: pulumi.Output<string>;
    /**
     * The key material to import. The key material is a random sequence of bytes used to derive a cryptographic key. Can be provided as raw bytes or a base64-encoded string (the provider will automatically normalize the input).
     */
    readonly keyMaterial: pulumi.Output<string | undefined>;
    /**
     * **NOTE:** This field is write-only and its value will not be updated in state as part of read operations.
     * The key material to import in write-only mode. The key material is a random sequence of bytes used to derive a cryptographic key. Must be provided as a base64-encoded string. The key material will not be stored in the Terraform state. Either `keyMaterial` or `keyMaterialWo` must be specified.
     */
    readonly keyMaterialWo: pulumi.Output<string | undefined>;
    /**
     * Version number to track changes to the write-only key material. Increment this value to recreate the resource with new key material. Required when using `keyMaterialWo`.
     */
    readonly keyMaterialWoVersion: pulumi.Output<number | undefined>;
    /**
     * The current state of the key (enabled, disabled, pending_key_material).
     */
    readonly keyState: pulumi.Output<string>;
    /**
     * The origin of the key (should be 'external').
     */
    readonly origin: pulumi.Output<string>;
    /**
     * `region`) The region of the key. If not set, the region is derived from the keyId when possible or from the provider configuration.
     */
    readonly region: pulumi.Output<string>;
    /**
     * Optional salt for key derivation. A salt is random data added to key material to ensure unique derived keys, even if the input is similar. It helps strengthen security when the key material has low randomness (low entropy). Can be provided as raw bytes or a base64-encoded string (the provider will automatically normalize the input). Only one of `salt` or `saltWo` can be specified.
     */
    readonly salt: pulumi.Output<string | undefined>;
    /**
     * **NOTE:** This field is write-only and its value will not be updated in state as part of read operations.
     * Optional salt for key derivation in write-only mode. A salt is random data added to key material to ensure unique derived keys. Must be provided as a base64-encoded string. The salt will not be stored in the Terraform state. Only one of `salt` or `saltWo` can be specified.
     */
    readonly saltWo: pulumi.Output<string | undefined>;
    /**
     * Version number to track changes to the write-only salt. Increment this value to recreate the resource with new salt. Required when using `saltWo`.
     */
    readonly saltWoVersion: pulumi.Output<number | undefined>;
    /**
     * Create a KeyMaterial resource with the given unique name, arguments, and options.
     *
     * @param name The _unique_ name of the resource.
     * @param args The arguments to use to populate this resource's properties.
     * @param opts A bag of options that control this resource's behavior.
     */
    constructor(name: string, args: KeyMaterialArgs, opts?: pulumi.CustomResourceOptions);
}
/**
 * Input properties used for looking up and filtering KeyMaterial resources.
 */
export interface KeyMaterialState {
    /**
     * The ID of the key to import key material into. The key's origin must be external (UUID format). Can be a plain UUID or a regional ID.
     */
    keyId?: pulumi.Input<string | undefined>;
    /**
     * The key material to import. The key material is a random sequence of bytes used to derive a cryptographic key. Can be provided as raw bytes or a base64-encoded string (the provider will automatically normalize the input).
     */
    keyMaterial?: pulumi.Input<string | undefined>;
    /**
     * **NOTE:** This field is write-only and its value will not be updated in state as part of read operations.
     * The key material to import in write-only mode. The key material is a random sequence of bytes used to derive a cryptographic key. Must be provided as a base64-encoded string. The key material will not be stored in the Terraform state. Either `keyMaterial` or `keyMaterialWo` must be specified.
     */
    keyMaterialWo?: pulumi.Input<string | undefined>;
    /**
     * Version number to track changes to the write-only key material. Increment this value to recreate the resource with new key material. Required when using `keyMaterialWo`.
     */
    keyMaterialWoVersion?: pulumi.Input<number | undefined>;
    /**
     * The current state of the key (enabled, disabled, pending_key_material).
     */
    keyState?: pulumi.Input<string | undefined>;
    /**
     * The origin of the key (should be 'external').
     */
    origin?: pulumi.Input<string | undefined>;
    /**
     * `region`) The region of the key. If not set, the region is derived from the keyId when possible or from the provider configuration.
     */
    region?: pulumi.Input<string | undefined>;
    /**
     * Optional salt for key derivation. A salt is random data added to key material to ensure unique derived keys, even if the input is similar. It helps strengthen security when the key material has low randomness (low entropy). Can be provided as raw bytes or a base64-encoded string (the provider will automatically normalize the input). Only one of `salt` or `saltWo` can be specified.
     */
    salt?: pulumi.Input<string | undefined>;
    /**
     * **NOTE:** This field is write-only and its value will not be updated in state as part of read operations.
     * Optional salt for key derivation in write-only mode. A salt is random data added to key material to ensure unique derived keys. Must be provided as a base64-encoded string. The salt will not be stored in the Terraform state. Only one of `salt` or `saltWo` can be specified.
     */
    saltWo?: pulumi.Input<string | undefined>;
    /**
     * Version number to track changes to the write-only salt. Increment this value to recreate the resource with new salt. Required when using `saltWo`.
     */
    saltWoVersion?: pulumi.Input<number | undefined>;
}
/**
 * The set of arguments for constructing a KeyMaterial resource.
 */
export interface KeyMaterialArgs {
    /**
     * The ID of the key to import key material into. The key's origin must be external (UUID format). Can be a plain UUID or a regional ID.
     */
    keyId: pulumi.Input<string>;
    /**
     * The key material to import. The key material is a random sequence of bytes used to derive a cryptographic key. Can be provided as raw bytes or a base64-encoded string (the provider will automatically normalize the input).
     */
    keyMaterial?: pulumi.Input<string | undefined>;
    /**
     * **NOTE:** This field is write-only and its value will not be updated in state as part of read operations.
     * The key material to import in write-only mode. The key material is a random sequence of bytes used to derive a cryptographic key. Must be provided as a base64-encoded string. The key material will not be stored in the Terraform state. Either `keyMaterial` or `keyMaterialWo` must be specified.
     */
    keyMaterialWo?: pulumi.Input<string | undefined>;
    /**
     * Version number to track changes to the write-only key material. Increment this value to recreate the resource with new key material. Required when using `keyMaterialWo`.
     */
    keyMaterialWoVersion?: pulumi.Input<number | undefined>;
    /**
     * `region`) The region of the key. If not set, the region is derived from the keyId when possible or from the provider configuration.
     */
    region?: pulumi.Input<string | undefined>;
    /**
     * Optional salt for key derivation. A salt is random data added to key material to ensure unique derived keys, even if the input is similar. It helps strengthen security when the key material has low randomness (low entropy). Can be provided as raw bytes or a base64-encoded string (the provider will automatically normalize the input). Only one of `salt` or `saltWo` can be specified.
     */
    salt?: pulumi.Input<string | undefined>;
    /**
     * **NOTE:** This field is write-only and its value will not be updated in state as part of read operations.
     * Optional salt for key derivation in write-only mode. A salt is random data added to key material to ensure unique derived keys. Must be provided as a base64-encoded string. The salt will not be stored in the Terraform state. Only one of `salt` or `saltWo` can be specified.
     */
    saltWo?: pulumi.Input<string | undefined>;
    /**
     * Version number to track changes to the write-only salt. Increment this value to recreate the resource with new salt. Required when using `saltWo`.
     */
    saltWoVersion?: pulumi.Input<number | undefined>;
}
//# sourceMappingURL=keyMaterial.d.ts.map