KMS

A list of aliases to create. Note - due to the use of `toset()`, values must be static strings and not computed values

Determines whether the alias name is used as a prefix

A flag to indicate whether to bypass the key policy lockout safety check. Setting this value to true increases the risk that the KMS key becomes unmanageable

A map of aliases to create. Values provided via the `name` key of the map can be computed from upstream resources

Determines whether resources will be created (affects all resources)

Determines whether an external CMK (externally provided material) will be created or a standard CMK (AWS provided material)

Determines whether a replica standard CMK will be created (AWS provided material)

Determines whether a replica external CMK will be created (externally provided material)

ID of the KMS Custom Key Store where the key will be stored instead of KMS (eg CloudHSM).

Specifies whether the key contains a symmetric key or an asymmetric key pair and the encryption algorithms or signing algorithms that the key supports. Valid values: `SYMMETRIC_DEFAULT`, `RSA_2048`, `RSA_3072`, `RSA_4096`, `HMAC_256`, `ECC_NIST_P256`, `ECC_NIST_P384`, `ECC_NIST_P521`, or `ECC_SECG_P…

The waiting period, specified in number of days. After the waiting period ends, AWS KMS deletes the KMS key. If you specify a value, it must be between `7` and `30`, inclusive. If you do not specify a value, it defaults to `30`

The description of the key as viewed in AWS console

Specifies whether to enable the default key policy. Defaults to `true`

Specifies whether key rotation is enabled. Defaults to `true`

Determines whether the KMS policy used for Route53 DNSSEC signing is enabled

A map of grant definitions to create

Specifies whether the key is enabled. Defaults to `true`

A list of IAM ARNs for [key administrators](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-default-allow-administrators)

A list of IAM ARNs for [key asymmetric public encryption users](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-users-crypto)

A list of IAM ARNs for [key asymmetric sign and verify users](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-users-crypto)

A list of IAM ARNs for [key HMAC users](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-users-crypto)

Base64 encoded 256-bit symmetric encryption key material to import. The CMK is permanently associated with this key material. External key only

A list of IAM ARNs for those who will have full key permissions (`kms:*`)

A list of IAM ARNs for [AWSServiceRoleForAutoScaling roles](https://docs.aws.amazon.com/autoscaling/ec2/userguide/key-policy-requirements-EBS-encryption.html#policy-example-cmk-access)

A list of IAM ARNs for [key service users](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-service-integration)

Specifies whether the key contains a symmetric key or an asymmetric key pair and the encryption algorithms or signing algorithms that the key supports. Valid values: SYMMETRIC_DEFAULT, RSA_2048, RSA_3072, RSA_4096, HMAC_224, HMAC_256, HMAC_384, HMAC_512, ECC_NIST_P256, ECC_NIST_P384, ECC_NIST_P521, …

A map of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) for custom permission usage

A list of IAM ARNs for [key symmetric encryption users](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-users-crypto)

Specifies the intended use of the key. Valid values: `ENCRYPT_DECRYPT` or `SIGN_VERIFY`. Defaults to `ENCRYPT_DECRYPT`

A list of IAM ARNs for [key users](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-default-allow-users)

Indicates whether the KMS key is a multi-Region (`true`) or regional (`false`) key. Defaults to `false`

List of IAM policy documents that are merged together into the exported document. In merging, statements with non-blank `sid`s will override statements with the same `sid`

A valid policy JSON document. Although this is a key policy, not an IAM policy, an `aws_iam_policy_document`, in the form that designates a principal, can be used

The primary external key arn of a multi-region replica external key

The primary key arn of a multi-region replica key

Region where the resource(s) will be managed. Defaults to the Region set in the provider configuration

Custom period of time between each rotation date. Must be a number between 90 and 2560 (inclusive)

A list of maps containing `account_ids` and Route53 `hosted_zone_arn` that will be allowed to sign DNSSEC records

List of IAM policy documents that are merged together into the exported document. Statements must have unique `sid`s

A map of tags to add to all resources

A map of aliases created and their attributes

Whether the key material expires. Empty when pending key material import, otherwise `KEY_MATERIAL_EXPIRES` or `KEY_MATERIAL_DOES_NOT_EXPIRE`

The state of the CMK

The cryptographic operations for which you can use the CMK

A map of grants created and their attributes

The Amazon Resource Name (ARN) of the key

The globally unique identifier for the key

The IAM resource policy set on the key

The region for the key