tessl/npm-pulumi--aws

A Pulumi package for creating and managing Amazon Web Services (AWS) cloud resources with infrastructure-as-code.

—

Pending

Quality

Pending

Does it follow best practices?

Impact

Pending

No eval scenarios have been run

Overview

Eval results

Files

KMS - Key Management Service

Name: tessl/npm-pulumi--aws
Author: tessl

AWS KMS creates and controls cryptographic keys for encrypting data.

Common Tasks

Create encryption key with automatic rotation

const key = new aws.kms.Key("app-key", {
    description: "Application encryption key",
    enableKeyRotation: true,
    deletionWindowInDays: 10,
});

Create key alias for easy reference

new aws.kms.Alias("app-key-alias", {
    name: "alias/app-key",
    targetKeyId: key.id,
});

Create key with custom policy for cross-account access

const key = new aws.kms.Key("shared-key", {
    description: "Shared encryption key",
    policy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Sid: "Enable IAM User Permissions",
            Effect: "Allow",
            Principal: { AWS: "arn:aws:iam::123456789012:root" },
            Action: "kms:*",
            Resource: "*",
        }],
    }),
});

Core Resources

Key

KMS encryption keys.

class Key extends pulumi.CustomResource {
    constructor(name: string, args?: KeyArgs, opts?: pulumi.CustomResourceOptions);

    readonly arn: pulumi.Output<string>;
    readonly keyId: pulumi.Output<string>;
}

interface KeyArgs {
    description?: pulumi.Input<string>;
    keyUsage?: pulumi.Input<"ENCRYPT_DECRYPT" | "SIGN_VERIFY">;
    customerMasterKeySpec?: pulumi.Input<string>;
    policy?: pulumi.Input<string>;
    deletionWindowInDays?: pulumi.Input<number>;
    isEnabled?: pulumi.Input<boolean>;
    enableKeyRotation?: pulumi.Input<boolean>;
    multiRegion?: pulumi.Input<boolean>;
    tags?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
}

Example: Create encryption key with rotation

const key = new aws.kms.Key("app-key", {
    description: "Application encryption key",
    deletionWindowInDays: 10,
    enableKeyRotation: true,
    tags: {
        Environment: "production",
        Purpose: "data-encryption",
    },
});

Alias

Key aliases for easier key reference.

class Alias extends pulumi.CustomResource {
    constructor(name: string, args: AliasArgs, opts?: pulumi.CustomResourceOptions);
}

interface AliasArgs {
    name?: pulumi.Input<string>;
    targetKeyId: pulumi.Input<string>;
}

Example: Create alias for key

new aws.kms.Alias("app-key-alias", {
    name: "alias/app-key",
    targetKeyId: key.id,
});

Usage Example

const key = new aws.kms.Key("app-key", {
    description: "Application encryption key",
    deletionWindowInDays: 10,
    enableKeyRotation: true,
});

new aws.kms.Alias("app-key-alias", {
    name: "alias/app-key",
    targetKeyId: key.id,
});

export const keyArn = key.arn;