Alias

class aws_cdk.aws_kms.Alias(scope, id, *, alias_name, target_key, removal_policy=None)

Bases: aws_cdk.core.Resource

Defines a display name for a customer master key (CMK) in AWS Key Management Service (AWS KMS).

Using an alias to refer to a key can help you simplify key management. For example, when rotating keys, you can just update the alias mapping instead of tracking and changing key IDs. For more information, see Working with Aliases in the AWS Key Management Service Developer Guide.

You can also add an alias for a key by calling key.addAlias(alias).

resource: :resource:: AWS::KMS::Alias

__init__(scope, id, *, alias_name, target_key, removal_policy=None)
Parameters
  • scope (Construct) –

  • id (str) –

  • alias_name (str) – The name of the alias. The name must start with alias followed by a forward slash, such as alias/. You can’t specify aliases that begin with alias/AWS. These aliases are reserved.

  • target_key (IKey) – The ID of the key for which you are creating the alias. Specify the key’s globally unique identifier or Amazon Resource Name (ARN). You can’t specify another alias.

  • removal_policy (Optional[RemovalPolicy]) – Policy to apply when the alias is removed from this stack. Default: - The alias will be deleted

Return type

None

Methods

add_alias(alias)

Defines a new alias for the key.

Parameters

alias (str) –

Return type

Alias

add_to_resource_policy(statement, allow_no_op=None)

Adds a statement to the KMS key resource policy.

Parameters
Return type

AddToResourcePolicyResult

grant(grantee, *actions)

Grant the indicated permissions on this key to the given principal.

Parameters
Return type

Grant

grant_decrypt(grantee)

Grant decryption permisisons using this key to the given principal.

Parameters

grantee (IGrantable) –

Return type

Grant

grant_encrypt(grantee)

Grant encryption permisisons using this key to the given principal.

Parameters

grantee (IGrantable) –

Return type

Grant

grant_encrypt_decrypt(grantee)

Grant encryption and decryption permisisons using this key to the given principal.

Parameters

grantee (IGrantable) –

Return type

Grant

to_string()

Returns a string representation of this construct.

Return type

str

Attributes

alias_name

The name of the alias.

Return type

str

alias_target_key

The Key to which the Alias refers.

Return type

IKey

key_arn

The ARN of the key.

Return type

str

key_id

1234abcd-12ab-34cd-56ef-1234567890ab).

Type

The ID of the key (the part that looks something like

Return type

str

node

The construct tree node associated with this construct.

Return type

ConstructNode

stack

The stack in which this resource is defined.

Return type

Stack

Static Methods

classmethod from_alias_attributes(scope, id, *, alias_name, alias_target_key)

Import an existing KMS Alias defined outside the CDK app.

Parameters
  • scope (Construct) – The parent creating construct (usually this).

  • id (str) – The construct’s name.

  • alias_name (str) – Specifies the alias name. This value must begin with alias/ followed by a name (i.e. alias/ExampleAlias)

  • alias_target_key (IKey) – The customer master key (CMK) to which the Alias refers.

Return type

IAlias

classmethod from_alias_name(scope, id, alias_name)

Import an existing KMS Alias defined outside the CDK app, by the alias name.

This method should be used instead of ‘fromAliasAttributes’ when the underlying KMS Key ARN is not available. This Alias will not have a direct reference to the KMS Key, so addAlias and grant* methods are not supported.

Parameters
  • scope (Construct) – The parent creating construct (usually this).

  • id (str) – The construct’s name.

  • alias_name (str) – The full name of the KMS Alias (e.g., ‘alias/aws/s3’, ‘alias/myKeyAlias’).

Return type

IAlias

classmethod is_construct(x)

Return whether the given object is a Construct.

Parameters

x (Any) –

Return type

bool