Interface IKeyProps

Construction properties for a KMS Key object.

Namespace: Amazon.CDK.AWS.KMS

Assembly: Amazon.CDK.Lib.dll

Syntax (csharp)

public interface IKeyProps

Syntax (vb)

Public Interface IKeyProps

Remarks

ExampleMetadata: fixture=default infused

Examples

var cmk = new Key(this, "cmk", new KeyProps { });
            var claudeModel = BedrockFoundationModel.ANTHROPIC_CLAUDE_SONNET_V1_0;

            var variant1 = PromptVariant.Text(new TextPromptVariantProps {
                VariantName = "variant1",
                Model = claudeModel,
                PromptVariables = new [] { "topic" },
                PromptText = "This is my first text prompt. Please summarize our conversation on: {{topic}}.",
                InferenceConfiguration = PromptInferenceConfiguration.Text(new PromptInferenceConfigurationProps {
                    Temperature = 1,
                    TopP = 0.999,
                    MaxTokens = 2000
                })
            });

            var prompt1 = new Prompt(this, "prompt1", new PromptProps {
                PromptName = "prompt1",
                Description = "my first prompt",
                DefaultVariant = variant1,
                Variants = new [] { variant1 },
                KmsKey = cmk
            });

Synopsis

Properties

Admins	A list of principals to add as key administrators to the key policy.
Alias	Initial alias to add to the key.
Description	A description of the key.
EnableKeyRotation	Indicates whether AWS KMS rotates the key.
Enabled	Indicates whether the key is available for use.
KeySpec	The cryptographic configuration of the key. The valid value depends on usage of the key.
KeyUsage	The cryptographic operations for which the key can be used.
MultiRegion	Creates a multi-Region primary key that you can replicate in other AWS Regions.
PendingWindow	Specifies the number of days in the waiting period before AWS KMS deletes a CMK that has been removed from a CloudFormation stack.
Policy	Custom policy document to attach to the KMS key.
RemovalPolicy	Whether the encryption key should be retained when it is removed from the Stack.
RotationPeriod	The period between each automatic rotation.

Properties

Admins

A list of principals to add as key administrators to the key policy.

IPrincipal[]? Admins { get; }

Property Value

IPrincipal[]

Remarks

Key administrators have permissions to manage the key (e.g., change permissions, revoke), but do not have permissions to use the key in cryptographic operations (e.g., encrypt, decrypt).

These principals will be added to the default key policy (if none specified), or to the specified policy (if provided).

Default: []

Alias

Initial alias to add to the key.

string? Alias { get; }

Property Value

string

Remarks

More aliases can be added later by calling addAlias.

Default: - No alias is added for the key.

Description

A description of the key.

string? Description { get; }

Property Value

string

Remarks

Use a description that helps your users decide whether the key is appropriate for a particular task.

Default: - No description.

EnableKeyRotation

Indicates whether AWS KMS rotates the key.

bool? EnableKeyRotation { get; }

Property Value

bool?

Remarks

Default: false

Enabled

Indicates whether the key is available for use.

bool? Enabled { get; }

Property Value

bool?

Remarks

Default: - Key is enabled.

KeySpec

The cryptographic configuration of the key. The valid value depends on usage of the key.

KeySpec? KeySpec { get; }

Property Value

KeySpec?

Remarks

IMPORTANT: If you change this property of an existing key, the existing key is scheduled for deletion and a new key is created with the specified value.

Default: KeySpec.SYMMETRIC_DEFAULT

KeyUsage

The cryptographic operations for which the key can be used.

KeyUsage? KeyUsage { get; }

Property Value

KeyUsage?

Remarks

IMPORTANT: If you change this property of an existing key, the existing key is scheduled for deletion and a new key is created with the specified value.

Default: KeyUsage.ENCRYPT_DECRYPT

MultiRegion

Creates a multi-Region primary key that you can replicate in other AWS Regions.

bool? MultiRegion { get; }

Property Value

bool?

Remarks

You can't change the multiRegion value after the KMS key is created.

IMPORTANT: If you change the value of the multiRegion property on an existing KMS key, the update request fails, regardless of the value of the UpdateReplacePolicy attribute. This prevents you from accidentally deleting a KMS key by changing an immutable property value.

Default: false

See: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html

PendingWindow

Specifies the number of days in the waiting period before AWS KMS deletes a CMK that has been removed from a CloudFormation stack.

Duration? PendingWindow { get; }

Property Value

Duration

Remarks

When you remove a customer master key (CMK) from a CloudFormation stack, AWS KMS schedules the CMK for deletion and starts the mandatory waiting period. The PendingWindowInDays property determines the length of waiting period. During the waiting period, the key state of CMK is Pending Deletion, which prevents the CMK from being used in cryptographic operations. When the waiting period expires, AWS KMS permanently deletes the CMK.

Enter a value between 7 and 30 days.

Default: - 30 days

See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-kms-key.html#cfn-kms-key-pendingwindowindays

Policy

Custom policy document to attach to the KMS key.

PolicyDocument? Policy { get; }

Property Value

PolicyDocument

Remarks

NOTE - If the @aws-cdk/aws-kms:defaultKeyPolicies feature flag is set (the default for new projects), this policy will override the default key policy and become the only key policy for the key. If the feature flag is not set, this policy will be appended to the default key policy.

Default: - A policy document with permissions for the account root to administer the key will be created.

RemovalPolicy

Whether the encryption key should be retained when it is removed from the Stack.

RemovalPolicy? RemovalPolicy { get; }

Property Value

RemovalPolicy?

Remarks

This is useful when one wants to retain access to data that was encrypted with a key that is being retired.

Default: RemovalPolicy.Retain

RotationPeriod

The period between each automatic rotation.

Duration? RotationPeriod { get; }

Property Value

Duration

Remarks

Default: - set by CFN to 365 days.