Set by controls 1

Active controls fix these values.

• enable_key_rotationbool, set to trueSpecifies whether key rotation is enabled. Defaults to true

Optional 40

• aliaseslist(string), default []A list of aliases to create. Note - due to the use of toset(), values must be static strings and not computed values
• aliases_use_name_prefixbool, default falseDetermines whether the alias name is used as a prefix
• bypass_policy_lockout_safety_checkbool, default nullA flag to indicate whether to bypass the key policy lockout safety check. Setting this value to true increases the risk that the KMS key becomes unmanageable
• computed_aliasesmap({...}), default {}A map of aliases to create. Values provided via the name key of the map can be computed from upstream resources
• createbool, default trueDetermines whether resources will be created (affects all resources)
• create_externalbool, default falseDetermines whether an external CMK (externally provided material) will be created or a standard CMK (AWS provided material)
• create_replicabool, default falseDetermines whether a replica standard CMK will be created (AWS provided material)
• create_replica_externalbool, default falseDetermines whether a replica external CMK will be created (externally provided material)
• custom_key_store_idstring, default nullID of the KMS Custom Key Store where the key will be stored instead of KMS (eg CloudHSM).
• customer_master_key_specstring, default nullSpecifies whether the key contains a symmetric key or an asymmetric key pair and the encryption algorithms or signing algorithms that the key supports. Valid values: SYMMETRIC_DEFAULT, RSA_2048, RSA_3072, RSA_4096, HMAC_256, ECC_NIST_P256, ECC_NIST_P384, ECC_NIST_P521, or ECC_SECG_P256K1. Defaults to SYMMETRIC_DEFAULT
• deletion_window_in_daysnumber, default nullThe waiting period, specified in number of days. After the waiting period ends, AWS KMS deletes the KMS key. If you specify a value, it must be between 7 and 30, inclusive. If you do not specify a value, it defaults to 30
• descriptionstring, default nullThe description of the key as viewed in AWS console
• enable_default_policybool, default trueSpecifies whether to enable the default key policy. Defaults to true
• enable_route53_dnssecbool, default falseDetermines whether the KMS policy used for Route53 DNSSEC signing is enabled
• grantsmap({...}), default nullA map of grant definitions to create
• is_enabledbool, default nullSpecifies whether the key is enabled. Defaults to true
• key_administratorslist(string), default []A list of IAM ARNs for [key administrators](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-default-allow-administrators)
• key_asymmetric_public_encryption_userslist(string), default []A list of IAM ARNs for [key asymmetric public encryption users](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-users-crypto)
• key_asymmetric_sign_verify_userslist(string), default []A list of IAM ARNs for [key asymmetric sign and verify users](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-users-crypto)
• key_hmac_userslist(string), default []A list of IAM ARNs for [key HMAC users](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-users-crypto)
• key_material_base64string, default nullBase64 encoded 256-bit symmetric encryption key material to import. The CMK is permanently associated with this key material. External key only
• key_ownerslist(string), default []A list of IAM ARNs for those who will have full key permissions (kms:*)
• key_service_roles_for_autoscalinglist(string), default []A list of IAM ARNs for [AWSServiceRoleForAutoScaling roles](https://docs.aws.amazon.com/autoscaling/ec2/userguide/key-policy-requirements-EBS-encryption.html#policy-example-cmk-access)
• key_service_userslist(string), default []A list of IAM ARNs for [key service users](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-service-integration)
• key_specstring, default nullSpecifies whether the key contains a symmetric key or an asymmetric key pair and the encryption algorithms or signing algorithms that the key supports. Valid values: SYMMETRIC_DEFAULT, RSA_2048, RSA_3072, RSA_4096, HMAC_224, HMAC_256, HMAC_384, HMAC_512, ECC_NIST_P256, ECC_NIST_P384, ECC_NIST_P521, ECC_SECG_P256K1, ML_DSA_44, ML_DSA_65, ML_DSA_87, or SM2 (China Regions only). Defaults to SYMMETRIC_DEFAULT
• key_statementslist({...}), default nullA map of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) for custom permission usage
• key_symmetric_encryption_userslist(string), default []A list of IAM ARNs for [key symmetric encryption users](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-users-crypto)
• key_usagestring, default nullSpecifies the intended use of the key. Valid values: ENCRYPT_DECRYPT or SIGN_VERIFY. Defaults to ENCRYPT_DECRYPT
• key_userslist(string), default []A list of IAM ARNs for [key users](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-default-allow-users)
• multi_regionbool, default falseIndicates whether the KMS key is a multi-Region (true) or regional (false) key. Defaults to false
• override_policy_documentslist(string), default []List of IAM policy documents that are merged together into the exported document. In merging, statements with non-blank sids will override statements with the same sid
• policystring, default nullA valid policy JSON document. Although this is a key policy, not an IAM policy, an aws_iam_policy_document, in the form that designates a principal, can be used
• primary_external_key_arnstring, default nullThe primary external key arn of a multi-region replica external key
• primary_key_arnstring, default nullThe primary key arn of a multi-region replica key
• regionstring, default nullRegion where the resource(s) will be managed. Defaults to the Region set in the provider configuration
• rotation_period_in_daysnumber, default nullCustom period of time between each rotation date. Must be a number between 90 and 2560 (inclusive)
• route53_dnssec_sourceslist({...}), default nullA list of maps containing account_ids and Route53 hosted_zone_arn that will be allowed to sign DNSSEC records
• source_policy_documentslist(string), default []List of IAM policy documents that are merged together into the exported document. Statements must have unique sids
• tagsmap(string), default {}A map of tags to add to all resources
• valid_tostring, default nullTime at which the imported key material expires. When the key material expires, AWS KMS deletes the key material and the CMK becomes unusable. If not specified, key material does not expire