terraform-provider/docs/resources/cert_manager_certificate_policy.md

page_title, subcategory, description

page_title	subcategory	description
kms_cert_manager_certificate_policy Resource - terraform-provider	Certificate Management	Create and manage certificate policies in Hanzo KMS. Only Machine Identity authentication is supported for this resource.

kms_cert_manager_certificate_policy (Resource)

Create and manage certificate policies in Hanzo KMS. Only Machine Identity authentication is supported for this resource.

Example Usage

resource "kms_project" "pki" {
  name        = "PKI Project"
  slug        = "pki-project"
  description = "Project for PKI certificate management"
  type        = "cert-manager"
}

resource "kms_cert_manager_certificate_policy" "web_server" {
  project_slug = kms_project.pki.slug

  name        = "web-server-policy"
  description = "Policy for web server certificates"

  # Subject Attribute Policies
  subject {
    type     = "common_name"
    allowed  = ["*.example.com", "*.internal.example.com"]
    required = ["*.example.com"]
  }

  subject {
    type     = "organization"
    required = ["Example Corp"]
  }

  subject {
    type     = "country"
    required = ["US"]
  }

  # Subject Alternative Name Policies
  sans {
    type     = "dns_name"
    allowed  = ["*.example.com", "*.internal.example.com"]
    required = ["*.example.com"]
  }

  sans {
    type    = "email"
    allowed = ["*@example.com"]
  }

  sans {
    type    = "ip_address"
    allowed = ["10.0.0.0/8", "192.168.0.0/16"]
  }

  # Certificate Properties
  key_usages {
    allowed = ["digital_signature", "key_encipherment"]
  }

  extended_key_usages {
    allowed = ["server_auth", "client_auth"]
  }

  # Validity Constraints
  validity {
    max = "90d" # Uses simplified format: 90d, 12m, 1y, 24h
  }

  # Algorithm Constraints
  algorithms {
    signature     = ["SHA256-RSA", "SHA256-ECDSA", "SHA384-ECDSA"]
    key_algorithm = ["RSA-2048", "RSA-3072", "ECDSA-P256", "ECDSA-P384"]
  }
}

resource "kms_cert_manager_certificate_policy" "code_signing" {
  project_slug = kms_project.pki.slug

  name        = "code-signing-policy"
  description = "Policy for code signing certificates"

  # Subject Attribute Policies
  subject {
    type     = "common_name"
    allowed  = ["Example Corp Code Signing"]
    required = ["Example Corp Code Signing"]
  }

  subject {
    type     = "organization"
    required = ["Example Corp"]
  }

  subject {
    type     = "country"
    required = ["US"]
  }

  # Certificate Properties
  key_usages {
    allowed = ["digital_signature"]
  }

  extended_key_usages {
    allowed = ["code_signing"]
  }

  # Validity Constraints
  validity {
    max = "1y"
  }

  # Algorithm Constraints
  algorithms {
    signature     = ["SHA256-RSA", "SHA256-ECDSA"]
    key_algorithm = ["RSA-2048", "RSA-3072", "ECDSA-P256"]
  }
}

Schema

Required

• name (String) The name of the certificate policy
• project_slug (String) The slug of the cert-manager project

Optional

• algorithms (Block, Optional) Algorithm constraints for the certificate policy. At least one signature algorithm and one key algorithm must be specified. (see below for nested schema)
• description (String) The description of the certificate policy
• extended_key_usages (Block, Optional) Extended key usage policies for the certificate policy (see below for nested schema)
• key_usages (Block, Optional) Key usage policies for the certificate policy (see below for nested schema)
• sans (Block List) Subject alternative name (SAN) policies for the certificate policy (see below for nested schema)
• subject (Block List) Subject attribute policies for the certificate policy (see below for nested schema)
• validity (Block, Optional) Validity constraints for the certificate policy (see below for nested schema)

Read-Only

• id (String) The ID of the certificate policy

Nested Schema for algorithms

Required:

• key_algorithm (List of String) List of allowed key algorithms (at least one required). Supported values: RSA-2048, RSA-3072, RSA-4096, ECDSA-P256, ECDSA-P521, ECDSA-P384
• signature (List of String) List of allowed signature algorithms (at least one required). Supported values: SHA256-RSA, SHA512-RSA, SHA384-ECDSA, SHA384-RSA, SHA256-ECDSA, SHA512-ECDSA

Nested Schema for extended_key_usages

Optional:

• allowed (List of String) List of allowed extended key usages. Possible values: client_auth, server_auth, code_signing, email_protection, ocsp_signing, time_stamping
• denied (List of String) List of denied extended key usages. Possible values: client_auth, server_auth, code_signing, email_protection, ocsp_signing, time_stamping
• required (List of String) List of required extended key usages. Possible values: client_auth, server_auth, code_signing, email_protection, ocsp_signing, time_stamping

Nested Schema for key_usages

Optional:

• allowed (List of String) List of allowed key usages. Possible values: digital_signature, key_encipherment, non_repudiation, data_encipherment, key_agreement, key_cert_sign, crl_sign, encipher_only, decipher_only
• denied (List of String) List of denied key usages. Possible values: digital_signature, key_encipherment, non_repudiation, data_encipherment, key_agreement, key_cert_sign, crl_sign, encipher_only, decipher_only
• required (List of String) List of required key usages. Possible values: digital_signature, key_encipherment, non_repudiation, data_encipherment, key_agreement, key_cert_sign, crl_sign, encipher_only, decipher_only

Nested Schema for sans

Required:

• type (String) The SAN type. Possible values: dns_name, ip_address, email, uri

Optional:

• allowed (List of String) List of allowed values for this SAN type
• denied (List of String) List of denied values for this SAN type
• required (List of String) List of required values for this SAN type

Nested Schema for subject

Required:

• type (String) The subject attribute type. Possible values: common_name, organization, country

Optional:

• allowed (List of String) List of allowed values for this subject attribute
• denied (List of String) List of denied values for this subject attribute
• required (List of String) List of required values for this subject attribute

Nested Schema for validity

Optional:

• max (String) Maximum validity period (e.g., '90d', '2y', '6m')