# CustomerManagedEncryptionConfiguration

Define a new CustomerManagedEncryptionConfiguration.

Extends: EncryptionConfiguration › CustomerManagedEncryptionConfiguration

- Source: [`aws-stepfunctions/lib/customer-managed-key-encryption-configuration.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-stepfunctions/lib/customer-managed-key-encryption-configuration.ts#L10)
- Type last changed: v2.160.0 · 24 Sep 2024

## Example

```ts
import * as kms from 'aws-cdk-lib/aws-kms';
import * as cdk from 'aws-cdk-lib';

const kmsKey = new kms.Key(this, 'Key');
const stateMachine = new sfn.StateMachine(this, 'StateMachineWithCMKEncryptionConfiguration', {
  stateMachineName: 'StateMachineWithCMKEncryptionConfiguration',
  definitionBody: sfn.DefinitionBody.fromChainable(sfn.Chain.start(new sfn.Pass(this, 'Pass'))),
  stateMachineType: sfn.StateMachineType.STANDARD,
  encryptionConfiguration: new sfn.CustomerManagedEncryptionConfiguration(kmsKey, cdk.Duration.seconds(60)),
});
```

## Initializer

```ts
new CustomerManagedEncryptionConfiguration(kmsKey: IKey, kmsDataKeyReusePeriodSeconds?: Duration)
```

## Properties

- `kmsDataKeyReusePeriodSeconds`: [Duration](/cdk/api/v2/docs/aws-cdk-lib.Duration.html) = Duration.seconds(300) — Maximum duration that Step Functions will reuse customer managed data keys. When the period expires, Step Functions will call GenerateDataKey.

  Must be between 60 and 900 seconds.

- `kmsKey`: [IKey](/cdk/api/v2/docs/aws-cdk-lib.aws_kms.IKey.html) — The symmetric customer managed KMS key for server-side encryption of the state machine definition, and execution history or activity inputs.

  **Default:** data is transparently encrypted using an AWS owned key

  Step Functions will reuse the key for a maximum of `kmsDataKeyReusePeriodSeconds`.

- `type`: string — Encryption option for the state machine or activity.

  Can be either CUSTOMER_MANAGED_KMS_KEY or AWS_OWNED_KEY.