# Complete AWS KMS Example Configuration in this directory creates: - Complete KMS key example with key policy, aliases, and grants - External KMS key example - Default KMS key example with default policy - Disable KMS key example ## Usage To run this example you need to execute: ```bash $ terraform init $ terraform plan $ terraform apply ``` Note that this example may create resources which will incur monetary charges on your AWS bill. Run `terraform destroy` when you no longer need these resources. ## Requirements | Name | Version | | ---- | ------- | | [terraform](#requirement\_terraform) | >= 1.5.7 | | [aws](#requirement\_aws) | >= 6.28 | ## Providers | Name | Version | | ---- | ------- | | [aws](#provider\_aws) | >= 6.28 | ## Modules | Name | Source | Version | | ---- | ------ | ------- | | [kms\_complete](#module\_kms\_complete) | ../.. | n/a | | [kms\_default](#module\_kms\_default) | ../.. | n/a | | [kms\_disabled](#module\_kms\_disabled) | ../.. | n/a | | [kms\_dnssec\_signing](#module\_kms\_dnssec\_signing) | ../.. | n/a | | [kms\_external](#module\_kms\_external) | ../.. | n/a | | [kms\_primary](#module\_kms\_primary) | ../.. | n/a | | [kms\_primary\_external](#module\_kms\_primary\_external) | ../.. | n/a | | [kms\_replica](#module\_kms\_replica) | ../.. | n/a | | [kms\_replica\_external](#module\_kms\_replica\_external) | ../.. | n/a | ## Resources | Name | Type | | ---- | ---- | | [aws_iam_role.lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | ## Inputs No inputs. ## Outputs | Name | Description | | ---- | ----------- | | [complete\_aliases](#output\_complete\_aliases) | A map of aliases created and their attributes | | [complete\_external\_key\_expiration\_model](#output\_complete\_external\_key\_expiration\_model) | Whether the key material expires. Empty when pending key material import, otherwise `KEY_MATERIAL_EXPIRES` or `KEY_MATERIAL_DOES_NOT_EXPIRE` | | [complete\_external\_key\_state](#output\_complete\_external\_key\_state) | The state of the CMK | | [complete\_external\_key\_usage](#output\_complete\_external\_key\_usage) | The cryptographic operations for which you can use the CMK | | [complete\_grants](#output\_complete\_grants) | A map of grants created and their attributes | | [complete\_key\_arn](#output\_complete\_key\_arn) | The Amazon Resource Name (ARN) of the key | | [complete\_key\_id](#output\_complete\_key\_id) | The globally unique identifier for the key | | [complete\_key\_policy](#output\_complete\_key\_policy) | The IAM resource policy set on the key | | [default\_aliases](#output\_default\_aliases) | A map of aliases created and their attributes | | [default\_external\_key\_expiration\_model](#output\_default\_external\_key\_expiration\_model) | Whether the key material expires. Empty when pending key material import, otherwise `KEY_MATERIAL_EXPIRES` or `KEY_MATERIAL_DOES_NOT_EXPIRE` | | [default\_external\_key\_state](#output\_default\_external\_key\_state) | The state of the CMK | | [default\_external\_key\_usage](#output\_default\_external\_key\_usage) | The cryptographic operations for which you can use the CMK | | [default\_grants](#output\_default\_grants) | A map of grants created and their attributes | | [default\_key\_arn](#output\_default\_key\_arn) | The Amazon Resource Name (ARN) of the key | | [default\_key\_id](#output\_default\_key\_id) | The globally unique identifier for the key | | [default\_key\_policy](#output\_default\_key\_policy) | The IAM resource policy set on the key | | [external\_aliases](#output\_external\_aliases) | A map of aliases created and their attributes | | [external\_external\_key\_expiration\_model](#output\_external\_external\_key\_expiration\_model) | Whether the key material expires. Empty when pending key material import, otherwise `KEY_MATERIAL_EXPIRES` or `KEY_MATERIAL_DOES_NOT_EXPIRE` | | [external\_external\_key\_state](#output\_external\_external\_key\_state) | The state of the CMK | | [external\_external\_key\_usage](#output\_external\_external\_key\_usage) | The cryptographic operations for which you can use the CMK | | [external\_grants](#output\_external\_grants) | A map of grants created and their attributes | | [external\_key\_arn](#output\_external\_key\_arn) | The Amazon Resource Name (ARN) of the key | | [external\_key\_id](#output\_external\_key\_id) | The globally unique identifier for the key | | [external\_key\_policy](#output\_external\_key\_policy) | The IAM resource policy set on the key | | [replica\_aliases](#output\_replica\_aliases) | A map of aliases created and their attributes | | [replica\_external\_aliases](#output\_replica\_external\_aliases) | A map of aliases created and their attributes | | [replica\_external\_arn](#output\_replica\_external\_arn) | The Amazon Resource Name (ARN) of the key | | [replica\_external\_grants](#output\_replica\_external\_grants) | A map of grants created and their attributes | | [replica\_external\_key\_expiration\_model](#output\_replica\_external\_key\_expiration\_model) | Whether the key material expires. Empty when pending key material import, otherwise `KEY_MATERIAL_EXPIRES` or `KEY_MATERIAL_DOES_NOT_EXPIRE` | | [replica\_external\_key\_id](#output\_replica\_external\_key\_id) | The globally unique identifier for the key | | [replica\_external\_key\_policy](#output\_replica\_external\_key\_policy) | The IAM resource policy set on the key | | [replica\_external\_key\_state](#output\_replica\_external\_key\_state) | The state of the CMK | | [replica\_external\_key\_usage](#output\_replica\_external\_key\_usage) | The cryptographic operations for which you can use the CMK | | [replica\_grants](#output\_replica\_grants) | A map of grants created and their attributes | | [replica\_key\_arn](#output\_replica\_key\_arn) | The Amazon Resource Name (ARN) of the key | | [replica\_key\_expiration\_model](#output\_replica\_key\_expiration\_model) | Whether the key material expires. Empty when pending key material import, otherwise `KEY_MATERIAL_EXPIRES` or `KEY_MATERIAL_DOES_NOT_EXPIRE` | | [replica\_key\_id](#output\_replica\_key\_id) | The globally unique identifier for the key | | [replica\_key\_policy](#output\_replica\_key\_policy) | The IAM resource policy set on the key | | [replica\_key\_state](#output\_replica\_key\_state) | The state of the CMK | | [replica\_key\_usage](#output\_replica\_key\_usage) | The cryptographic operations for which you can use the CMK | Apache-2.0 Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-aws-kms/blob/master/LICENSE).

Changes from upstream