KeyProps
- class aws_cdk.aws_kms.KeyProps(*, admins=None, alias=None, description=None, enabled=None, enable_key_rotation=None, key_spec=None, key_usage=None, multi_region=None, pending_window=None, policy=None, removal_policy=None, rotation_period=None)
Bases:
object
Construction properties for a KMS Key object.
- Parameters:
admins (
Optional
[Sequence
[IPrincipal
]]) – A list of principals to add as key administrators to the key policy. Key administrators have permissions to manage the key (e.g., change permissions, revoke), but do not have permissions to use the key in cryptographic operations (e.g., encrypt, decrypt). These principals will be added to the default key policy (if none specified), or to the specified policy (if provided). Default: []alias (
Optional
[str
]) – Initial alias to add to the key. More aliases can be added later by callingaddAlias
. Default: - No alias is added for the key.description (
Optional
[str
]) – A description of the key. Use a description that helps your users decide whether the key is appropriate for a particular task. Default: - No description.enabled (
Optional
[bool
]) – Indicates whether the key is available for use. Default: - Key is enabled.enable_key_rotation (
Optional
[bool
]) – Indicates whether AWS KMS rotates the key. Default: falsekey_spec (
Optional
[KeySpec
]) – The cryptographic configuration of the key. The valid value depends on usage of the key. IMPORTANT: If you change this property of an existing key, the existing key is scheduled for deletion and a new key is created with the specified value. Default: KeySpec.SYMMETRIC_DEFAULTkey_usage (
Optional
[KeyUsage
]) – The cryptographic operations for which the key can be used. IMPORTANT: If you change this property of an existing key, the existing key is scheduled for deletion and a new key is created with the specified value. Default: KeyUsage.ENCRYPT_DECRYPTmulti_region (
Optional
[bool
]) – Creates a multi-Region primary key that you can replicate in other AWS Regions. You can’t change themultiRegion
value after the KMS key is created. IMPORTANT: If you change the value of themultiRegion
property on an existing KMS key, the update request fails, regardless of the value of the UpdateReplacePolicy attribute. This prevents you from accidentally deleting a KMS key by changing an immutable property value. Default: falsepending_window (
Optional
[Duration
]) – Specifies the number of days in the waiting period before AWS KMS deletes a CMK that has been removed from a CloudFormation stack. When you remove a customer master key (CMK) from a CloudFormation stack, AWS KMS schedules the CMK for deletion and starts the mandatory waiting period. The PendingWindowInDays property determines the length of waiting period. During the waiting period, the key state of CMK is Pending Deletion, which prevents the CMK from being used in cryptographic operations. When the waiting period expires, AWS KMS permanently deletes the CMK. Enter a value between 7 and 30 days. Default: - 30 dayspolicy (
Optional
[PolicyDocument
]) – Custom policy document to attach to the KMS key. NOTE - If the@aws-cdk/aws-kms:defaultKeyPolicies
feature flag is set (the default for new projects), this policy will override the default key policy and become the only key policy for the key. If the feature flag is not set, this policy will be appended to the default key policy. Default: - A policy document with permissions for the account root to administer the key will be created.removal_policy (
Optional
[RemovalPolicy
]) – Whether the encryption key should be retained when it is removed from the Stack. This is useful when one wants to retain access to data that was encrypted with a key that is being retired. Default: RemovalPolicy.Retainrotation_period (
Optional
[Duration
]) – The period between each automatic rotation. Default: - set by CFN to 365 days.
- ExampleMetadata:
infused
Example:
import aws_cdk.aws_kms as kms source_output = codepipeline.Artifact() target_bucket = s3.Bucket(self, "MyBucket") key = kms.Key(self, "EnvVarEncryptKey", description="sample key" ) pipeline = codepipeline.Pipeline(self, "MyPipeline") deploy_action = codepipeline_actions.S3DeployAction( action_name="S3Deploy", bucket=target_bucket, input=source_output, encryption_key=key ) deploy_stage = pipeline.add_stage( stage_name="Deploy", actions=[deploy_action] )
Attributes
- admins
A list of principals to add as key administrators to the key policy.
Key administrators have permissions to manage the key (e.g., change permissions, revoke), but do not have permissions to use the key in cryptographic operations (e.g., encrypt, decrypt).
These principals will be added to the default key policy (if none specified), or to the specified policy (if provided).
- Default:
[]
- alias
Initial alias to add to the key.
More aliases can be added later by calling
addAlias
.- Default:
No alias is added for the key.
- description
A description of the key.
Use a description that helps your users decide whether the key is appropriate for a particular task.
- Default:
No description.
- enable_key_rotation
Indicates whether AWS KMS rotates the key.
- Default:
false
- enabled
Indicates whether the key is available for use.
- Default:
Key is enabled.
- key_spec
The cryptographic configuration of the key. The valid value depends on usage of the key.
IMPORTANT: If you change this property of an existing key, the existing key is scheduled for deletion and a new key is created with the specified value.
- Default:
KeySpec.SYMMETRIC_DEFAULT
- key_usage
The cryptographic operations for which the key can be used.
IMPORTANT: If you change this property of an existing key, the existing key is scheduled for deletion and a new key is created with the specified value.
- Default:
KeyUsage.ENCRYPT_DECRYPT
- multi_region
Creates a multi-Region primary key that you can replicate in other AWS Regions.
You can’t change the
multiRegion
value after the KMS key is created.IMPORTANT: If you change the value of the
multiRegion
property on an existing KMS key, the update request fails, regardless of the value of the UpdateReplacePolicy attribute. This prevents you from accidentally deleting a KMS key by changing an immutable property value.
- pending_window
Specifies the number of days in the waiting period before AWS KMS deletes a CMK that has been removed from a CloudFormation stack.
When you remove a customer master key (CMK) from a CloudFormation stack, AWS KMS schedules the CMK for deletion and starts the mandatory waiting period. The PendingWindowInDays property determines the length of waiting period. During the waiting period, the key state of CMK is Pending Deletion, which prevents the CMK from being used in cryptographic operations. When the waiting period expires, AWS KMS permanently deletes the CMK.
Enter a value between 7 and 30 days.
- policy
Custom policy document to attach to the KMS key.
NOTE - If the
@aws-cdk/aws-kms:defaultKeyPolicies
feature flag is set (the default for new projects), this policy will override the default key policy and become the only key policy for the key. If the feature flag is not set, this policy will be appended to the default key policy.- Default:
A policy document with permissions for the account root to
administer the key will be created.
- removal_policy
Whether the encryption key should be retained when it is removed from the Stack.
This is useful when one wants to retain access to data that was encrypted with a key that is being retired.
- Default:
RemovalPolicy.Retain
- rotation_period
The period between each automatic rotation.
- Default:
set by CFN to 365 days.