ZoneSigningOptions
- class aws_cdk.aws_route53.ZoneSigningOptions(*, kms_key, key_signing_key_name=None)
Bases:
object
Options for enabling key signing from a hosted zone.
- Parameters:
kms_key (
IKey
) – The customer-managed KMS key that that will be used to sign the records. The KMS Key must be unique for each KSK within a hosted zone. Additionally, the KMS key must be an asymetric customer-managed key using the ECC_NIST_P256 algorithm.key_signing_key_name (
Optional
[str
]) – The name for the key signing key. This name must be unique within a hosted zone. Default: an autogenerated name
- ExampleMetadata:
infused
Example:
kms_key = kms.Key(self, "KmsCMK", key_spec=kms.KeySpec.ECC_NIST_P256, key_usage=kms.KeyUsage.SIGN_VERIFY ) hosted_zone = route53.HostedZone(self, "HostedZone", zone_name="example.com" ) # Enable DNSSEC signing for the zone hosted_zone.enable_dnssec(kms_key=kms_key)
Attributes
- key_signing_key_name
The name for the key signing key.
This name must be unique within a hosted zone.
- Default:
an autogenerated name
- kms_key
The customer-managed KMS key that that will be used to sign the records.
The KMS Key must be unique for each KSK within a hosted zone. Additionally, the KMS key must be an asymetric customer-managed key using the ECC_NIST_P256 algorithm.