replica_keys

Creates, updates, deletes or gets a replica_key resource or lists replica_keys in a region

Overview

Name	replica_keys
Type	Resource
Description	The AWS::KMS::ReplicaKey resource specifies a multi-region replica AWS KMS key in AWS Key Management Service (AWS KMS).
Id	awscc.kms.replica_keys

Fields

get (all properties)

Name	Datatype	Description
description	string	A description of the AWS KMS key. Use a description that helps you to distinguish this AWS KMS key from others in the account, such as its intended use.
pending_window_in_days	integer	Specifies the number of days in the waiting period before AWS KMS deletes an AWS KMS key that has been removed from a CloudFormation stack. Enter a value between 7 and 30 days. The default value is 30 days.
key_policy	object	The key policy that authorizes use of the AWS KMS key. The key policy must observe the following rules.
primary_key_arn	string	Identifies the primary AWS KMS key to create a replica of. Specify the Amazon Resource Name (ARN) of the AWS KMS key. You cannot specify an alias or key ID. For help finding the ARN, see Finding the Key ID and ARN in the AWS Key Management Service Developer Guide.
enabled	boolean	Specifies whether the AWS KMS key is enabled. Disabled AWS KMS keys cannot be used in cryptographic operations.
key_id	string
arn	string
▶tags	array	An array of key-value pairs to apply to this resource.
region	string	AWS region.

list (identifiers only)

Name	Datatype	Description
key_id	string
region	string	AWS region.

For more information, see AWS::KMS::ReplicaKey.

Methods

Name	Resource	Accessible by	Required Params
create_resource	replica_keys	INSERT	PrimaryKeyArn, KeyPolicy, region
delete_resource	replica_keys	DELETE	Identifier, region
update_resource	replica_keys	UPDATE	Identifier, PatchDocument, region
list_resources	replica_keys_list_only	SELECT	region
get_resource	replica_keys	SELECT	Identifier, region

SELECT examples

get (all properties)

Gets all properties from an individual replica_key.

SELECT
  region,
  description,
  pending_window_in_days,
  key_policy,
  primary_key_arn,
  enabled,
  key_id,
  arn,
  tags
FROM awscc.kms.replica_keys
WHERE
  region = '{{ region }}' AND
  Identifier = '{{ key_id }}';

list (identifiers only)

Lists all replica_keys in a region.

SELECT
  region,
  key_id
FROM awscc.kms.replica_keys_list_only
WHERE
  region = '{{ region }}';

INSERT example

Use the following StackQL query and manifest file to create a new replica_key resource, using stack-deploy.

Required Properties

/*+ create */
INSERT INTO awscc.kms.replica_keys (
  KeyPolicy,
  PrimaryKeyArn,
  region
)
SELECT
  '{{ key_policy }}',
  '{{ primary_key_arn }}',
  '{{ region }}'
RETURNING
  ErrorCode,
  EventTime,
  Identifier,
  Operation,
  OperationStatus,
  RequestToken,
  ResourceModel,
  RetryAfter,
  StatusMessage,
  TypeName
;

All Properties

/*+ create */
INSERT INTO awscc.kms.replica_keys (
  Description,
  PendingWindowInDays,
  KeyPolicy,
  PrimaryKeyArn,
  Enabled,
  Tags,
  region
)
SELECT
  '{{ description }}',
  '{{ pending_window_in_days }}',
  '{{ key_policy }}',
  '{{ primary_key_arn }}',
  '{{ enabled }}',
  '{{ tags }}',
  '{{ region }}'
RETURNING
  ErrorCode,
  EventTime,
  Identifier,
  Operation,
  OperationStatus,
  RequestToken,
  ResourceModel,
  RetryAfter,
  StatusMessage,
  TypeName
;

Manifest

version: 1
name: stack name
description: stack description
providers:
- aws
globals:
- name: region
  value: '{{ vars.AWS_REGION }}'
resources:
- name: replica_key
  props:
    - name: description
      value: '{{ description }}'
    - name: pending_window_in_days
      value: '{{ pending_window_in_days }}'
    - name: key_policy
      value: {}
    - name: primary_key_arn
      value: '{{ primary_key_arn }}'
    - name: enabled
      value: '{{ enabled }}'
    - name: tags
      value:
        - value: '{{ value }}'
          key: '{{ key }}'

UPDATE example

Use the following StackQL query and manifest file to update a replica_key resource, using stack-deploy.

/*+ update */
UPDATE awscc.kms.replica_keys
SET PatchDocument = string('{{ {
    "Description": description,
    "PendingWindowInDays": pending_window_in_days,
    "KeyPolicy": key_policy,
    "Enabled": enabled,
    "Tags": tags
} | generate_patch_document }}')
WHERE
  region = '{{ region }}' AND
  Identifier = '{{ key_id }}'
RETURNING
  ErrorCode,
  EventTime,
  Identifier,
  Operation,
  OperationStatus,
  RequestToken,
  ResourceModel,
  RetryAfter,
  StatusMessage,
  TypeName
;

DELETE example

/*+ delete */
DELETE FROM awscc.kms.replica_keys
WHERE
  Identifier = '{{ key_id }}' AND
  region = '{{ region }}'
RETURNING
  ErrorCode,
  EventTime,
  Identifier,
  Operation,
  OperationStatus,
  RequestToken,
  ResourceModel,
  RetryAfter,
  StatusMessage,
  TypeName
;

Additional Parameters

Mutable resources in the Cloud Control provider support additional optional parameters which can be supplied with INSERT, UPDATE, or DELETE operations. These include:

Parameter	Description
ClientToken	A unique identifier to ensure the idempotency of the resource request. This allows the provider to accurately distinguish between retries and new requests. A client token is valid for 36 hours once used. After that, a resource request with the same client token is treated as a new request. If you do not specify a client token, one is generated for inclusion in the request.
RoleArn	The ARN of the IAM role used to perform this resource operation. The role specified must have the permissions required for this operation. If you do not specify a role, a temporary session is created using your AWS user credentials.
TypeVersionId	For private resource types, the type version to use in this resource operation. If you do not specify a resource version, the default version is used.

Permissions

To operate on the replica_keys resource, the following permissions are required:

Read

kms:DescribeKey,
kms:GetKeyPolicy,
kms:ListResourceTags

Create

kms:ReplicateKey,
kms:CreateKey,
kms:DescribeKey,
kms:DisableKey,
kms:TagResource

Update

kms:DescribeKey,
kms:DisableKey,
kms:EnableKey,
kms:PutKeyPolicy,
kms:TagResource,
kms:UntagResource,
kms:UpdateKeyDescription

List

kms:ListKeys,
kms:DescribeKey

Delete

kms:DescribeKey,
kms:ScheduleKeyDeletion