This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

aws_kms

account_id

Type: STRING

key_arn

Type: STRING

key_id

Type: STRING

key_metadata

Type: STRUCT
Provider name: KeyMetadata
Description: Metadata associated with the key.

  • arn
    Type: STRING
    Provider name: Arn
    Description: The Amazon Resource Name (ARN) of the KMS key. For examples, see Key Management Service (KMS) in the Example ARNs section of the Amazon Web Services General Reference.
  • aws_account_id
    Type: STRING
    Provider name: AWSAccountId
    Description: The twelve-digit account ID of the Amazon Web Services account that owns the KMS key.
  • cloud_hsm_cluster_id
    Type: STRING
    Provider name: CloudHsmClusterId
    Description: The cluster ID of the CloudHSM cluster that contains the key material for the KMS key. When you create a KMS key in an CloudHSM custom key store, KMS creates the key material for the KMS key in the associated CloudHSM cluster. This field is present only when the KMS key is created in an CloudHSM key store.
  • creation_date
    Type: TIMESTAMP
    Provider name: CreationDate
    Description: The date and time when the KMS key was created.
  • custom_key_store_id
    Type: STRING
    Provider name: CustomKeyStoreId
    Description: A unique identifier for the custom key store that contains the KMS key. This field is present only when the KMS key is created in a custom key store.
  • customer_master_key_spec
    Type: STRING
    Provider name: CustomerMasterKeySpec
    Description: Instead, use the KeySpec field. The KeySpec and CustomerMasterKeySpec fields have the same value. We recommend that you use the KeySpec field in your code. However, to avoid breaking changes, KMS supports both fields.
  • deletion_date
    Type: TIMESTAMP
    Provider name: DeletionDate
    Description: The date and time after which KMS deletes this KMS key. This value is present only when the KMS key is scheduled for deletion, that is, when its KeyState is PendingDeletion. When the primary key in a multi-Region key is scheduled for deletion but still has replica keys, its key state is PendingReplicaDeletion and the length of its waiting period is displayed in the PendingDeletionWindowInDays field.
  • description
    Type: STRING
    Provider name: Description
    Description: The description of the KMS key.
  • enabled
    Type: BOOLEAN
    Provider name: Enabled
    Description: Specifies whether the KMS key is enabled. When KeyState is Enabled this value is true, otherwise it is false.
  • encryption_algorithms
    Type: UNORDERED_LIST_STRING
    Provider name: EncryptionAlgorithms
    Description: The encryption algorithms that the KMS key supports. You cannot use the KMS key with other encryption algorithms within KMS. This value is present only when the KeyUsage of the KMS key is ENCRYPT_DECRYPT.
  • expiration_model
    Type: STRING
    Provider name: ExpirationModel
    Description: Specifies whether the KMS key’s key material expires. This value is present only when Origin is EXTERNAL, otherwise this value is omitted.
  • key_agreement_algorithms
    Type: UNORDERED_LIST_STRING
    Provider name: KeyAgreementAlgorithms
    Description: The key agreement algorithm used to derive a shared secret.
  • key_id
    Type: STRING
    Provider name: KeyId
    Description: The globally unique identifier for the KMS key.
  • key_manager
    Type: STRING
    Provider name: KeyManager
    Description: The manager of the KMS key. KMS keys in your Amazon Web Services account are either customer managed or Amazon Web Services managed. For more information about the difference, see KMS keys in the Key Management Service Developer Guide.
  • key_spec
    Type: STRING
    Provider name: KeySpec
    Description: Describes the type of key material in the KMS key.
  • key_state
    Type: STRING
    Provider name: KeyState
    Description: The current status of the KMS key. For more information about how key state affects the use of a KMS key, see Key states of KMS keys in the Key Management Service Developer Guide.
  • key_usage
    Type: STRING
    Provider name: KeyUsage
    Description: The cryptographic operations for which you can use the KMS key.
  • mac_algorithms
    Type: UNORDERED_LIST_STRING
    Provider name: MacAlgorithms
    Description: The message authentication code (MAC) algorithm that the HMAC KMS key supports. This value is present only when the KeyUsage of the KMS key is GENERATE_VERIFY_MAC.
  • multi_region
    Type: BOOLEAN
    Provider name: MultiRegion
    Description: Indicates whether the KMS key is a multi-Region (True) or regional (False) key. This value is True for multi-Region primary and replica keys and False for regional KMS keys. For more information about multi-Region keys, see Multi-Region keys in KMS in the Key Management Service Developer Guide.
  • multi_region_configuration
    Type: STRUCT
    Provider name: MultiRegionConfiguration
    Description: Lists the primary and replica keys in same multi-Region key. This field is present only when the value of the MultiRegion field is True. For more information about any listed KMS key, use the DescribeKey operation.
    • MultiRegionKeyType indicates whether the KMS key is a PRIMARY or REPLICA key.
    • PrimaryKey displays the key ARN and Region of the primary key. This field displays the current KMS key if it is the primary key.
    • ReplicaKeys displays the key ARNs and Regions of all replica keys. This field includes the current KMS key if it is a replica key.
    • multi_region_key_type
      Type: STRING
      Provider name: MultiRegionKeyType
      Description: Indicates whether the KMS key is a PRIMARY or REPLICA key.
    • primary_key
      Type: STRUCT
      Provider name: PrimaryKey
      Description: Displays the key ARN and Region of the primary key. This field includes the current KMS key if it is the primary key.
      • arn
        Type: STRING
        Provider name: Arn
        Description: Displays the key ARN of a primary or replica key of a multi-Region key.
      • region
        Type: STRING
        Provider name: Region
        Description: Displays the Amazon Web Services Region of a primary or replica key in a multi-Region key.
    • replica_keys
      Type: UNORDERED_LIST_STRUCT
      Provider name: ReplicaKeys
      Description: displays the key ARNs and Regions of all replica keys. This field includes the current KMS key if it is a replica key.
      • arn
        Type: STRING
        Provider name: Arn
        Description: Displays the key ARN of a primary or replica key of a multi-Region key.
      • region
        Type: STRING
        Provider name: Region
        Description: Displays the Amazon Web Services Region of a primary or replica key in a multi-Region key.
  • origin
    Type: STRING
    Provider name: Origin
    Description: The source of the key material for the KMS key. When this value is AWS_KMS, KMS created the key material. When this value is EXTERNAL, the key material was imported or the KMS key doesn’t have any key material. When this value is AWS_CLOUDHSM, the key material was created in the CloudHSM cluster associated with a custom key store.
  • pending_deletion_window_in_days
    Type: INT32
    Provider name: PendingDeletionWindowInDays
    Description: The waiting period before the primary key in a multi-Region key is deleted. This waiting period begins when the last of its replica keys is deleted. This value is present only when the KeyState of the KMS key is PendingReplicaDeletion. That indicates that the KMS key is the primary key in a multi-Region key, it is scheduled for deletion, and it still has existing replica keys. When a single-Region KMS key or a multi-Region replica key is scheduled for deletion, its deletion date is displayed in the DeletionDate field. However, when the primary key in a multi-Region key is scheduled for deletion, its waiting period doesn’t begin until all of its replica keys are deleted. This value displays that waiting period. When the last replica key in the multi-Region key is deleted, the KeyState of the scheduled primary key changes from PendingReplicaDeletion to PendingDeletion and the deletion date appears in the DeletionDate field.
  • signing_algorithms
    Type: UNORDERED_LIST_STRING
    Provider name: SigningAlgorithms
    Description: The signing algorithms that the KMS key supports. You cannot use the KMS key with other signing algorithms within KMS. This field appears only when the KeyUsage of the KMS key is SIGN_VERIFY.
  • valid_to
    Type: TIMESTAMP
    Provider name: ValidTo
    Description: The time at which the imported key material expires. When the key material expires, KMS deletes the key material and the KMS key becomes unusable. This value is present only for KMS keys whose Origin is EXTERNAL and whose ExpirationModel is KEY_MATERIAL_EXPIRES, otherwise this value is omitted.
  • xks_key_configuration
    Type: STRUCT
    Provider name: XksKeyConfiguration
    Description: Information about the external key that is associated with a KMS key in an external key store. For more information, see External key in the Key Management Service Developer Guide.
    • id
      Type: STRING
      Provider name: Id
      Description: The ID of the external key in its external key manager. This is the ID that the external key store proxy uses to identify the external key.

key_rotation_enabled

Type: BOOLEAN
Provider name: KeyRotationEnabled
Description: A Boolean value that specifies whether key rotation is enabled.

next_rotation_date

Type: TIMESTAMP
Provider name: NextRotationDate
Description: The next date that KMS will automatically rotate the key material.

on_demand_rotation_start_date

Type: TIMESTAMP
Provider name: OnDemandRotationStartDate
Description: Identifies the date and time that an in progress on-demand rotation was initiated. The KMS API follows an eventual consistency model due to the distributed nature of the system. As a result, there might be a slight delay between initiating on-demand key rotation and the rotation’s completion. Once the on-demand rotation is complete, use ListKeyRotations to view the details of the on-demand rotation.

rotation_period_in_days

Type: INT32
Provider name: RotationPeriodInDays
Description: The number of days between each automatic rotation. The default value is 365 days.

tags

Type: UNORDERED_LIST_STRING