1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73

variable "description" {
  description = "Description for the KMS key"
  type        = string
  default     = "Managed by Terraform"
}

variable "key_usage" {
  description = "Key usage — ENCRYPT_DECRYPT or SIGN_VERIFY"
  type        = string
  default     = "ENCRYPT_DECRYPT"
}

variable "customer_master_key_spec" {
  description = "Key spec — SYMMETRIC_DEFAULT, RSA_2048, RSA_4096, ECC_NIST_P256, etc."
  type        = string
  default     = "SYMMETRIC_DEFAULT"
}

variable "enable_key_rotation" {
  description = "Enable automatic annual key rotation"
  type        = bool
  default     = true
}

variable "deletion_window_in_days" {
  description = "Days before key deletion after destruction (7–30)"
  type        = number
  default     = 30
}

variable "multi_region" {
  description = "Create a multi-region primary key"
  type        = bool
  default     = false
}

variable "policy" {
  description = "JSON key policy document (optional — uses AWS default if null)"
  type        = string
  default     = null
}

variable "grants" {
  description = "Map of KMS grants to create"
  type = map(object({
    grantee_principal  = string
    operations         = list(string)
    retiring_principal = optional(string, null)
    constraints = optional(object({
      encryption_context_equals = optional(map(string), null)
      encryption_context_subset = optional(map(string), null)
    }), null)
  }))
  default = {}
}

variable "aliases" {
  description = "List of alias names (without alias/ prefix)"
  type        = list(string)
  default     = []
}

variable "cross_account_principals" {
  description = "List of external account principals allowed to use the key"
  type        = list(string)
  default     = []
}

variable "tags" {
  description = "Resource tags to apply to all resources"
  type        = map(string)
  default     = {}
}