kms

Creates a KMS Customer Managed Key with aliases, grants, and optional cross-account sharing.

Provisions a KMS CMK with automatic annual key rotation enabled by default, a configurable key policy (defaulting to account root with optional cross-account principals), named aliases, and fine-grained grants. Supports multi-region primary keys for cross-region replication scenarios.

Usage

module "kms" {
  source  = "hcassc.jfrog.io/iac-terraform-modules-virtual/security/kms/aws"
  version = "0.1.0"

  description = "S3 encryption key"
  aliases     = ["s3/data-lake"]

  cross_account_principals = [
    "arn:aws:iam::111122223333:root",
  ]
}

Requirements

Name	Version
terraform	~> 1.5
aws	~> 6.50

Providers

Name	Version
aws	6.50.0

Resources

Name	Type
aws_kms_alias.this	resource
aws_kms_grant.this	resource
aws_kms_key.this	resource

Inputs

Name	Description	Type	Default	Required
aliases	List of alias names (without alias/ prefix)	list(string)	[]	no
cross_account_principals	List of external account principals allowed to use the key	list(string)	[]	no
customer_master_key_spec	Key spec — SYMMETRIC_DEFAULT, RSA_2048, RSA_4096, ECC_NIST_P256, etc.	string	"SYMMETRIC_DEFAULT"	no
deletion_window_in_days	Days before key deletion after destruction (7–30)	number	30	no
description	Description for the KMS key	string	"Managed by Terraform"	no
enable_key_rotation	Enable automatic annual key rotation	bool	true	no
grants	Map of KMS grants to create	map(object({ grantee_principal = string operations = list(string) retiring_principal = optional(string, null) constraints = optional(object({ encryption_context_equals = optional(map(string), null) encryption_context_subset = optional(map(string), null) }), null) }))	{}	no
key_usage	Key usage — ENCRYPT_DECRYPT or SIGN_VERIFY	string	"ENCRYPT_DECRYPT"	no
multi_region	Create a multi-region primary key	bool	false	no
policy	JSON key policy document (optional — uses AWS default if null)	string	null	no
tags	Resource tags to apply to all resources	map(string)	{}	no

Outputs

Name	Description
alias_arns	Map of alias name to alias ARN
arn	KMS key ARN
grant_ids	Map of grant name to grant token
id	KMS key ID
key_id	KMS key ID (alias for id)