terraform-provider/docs/resources/external_kms_aws.md

page_title, subcategory, description

page_title	subcategory	description
kms_external_kms_aws Resource - terraform-provider	External KMS	Create and manage AWS External KMS

kms_external_kms_aws (Resource)

Create and manage AWS External KMS

Example Usage

terraform {
  required_providers {
    kms = {
      # version = <latest version>
      source = "hanzokms/kms"
    }
  }
}

provider "kms" {
  host = "https://kms.hanzo.ai" # Only required if using self hosted instance of Hanzo KMS, default is https://kms.hanzo.ai
  auth = {
    universal = {
      client_id     = "<machine-identity-client-id>"
      client_secret = "<machine-identity-client-secret>"
    }
  }
}

resource "kms_external_kms_aws" "external-kms-aws-assume-role" {
  name        = "aws-assume-role-external-kms"
  description = "AWS External KMS using assume-role type"
  configuration = {
    aws_region     = "us-east-1"
    aws_kms_key_id = "<aws-kms-key-id>"
    type           = "assume-role"
    credential = {
      role_arn         = "<assume-role-arn>"
      role_external_id = "<role-external-id>"
    }
  }
}

resource "kms_external_kms_aws" "external-kms-aws-access-key" {
  name        = "aws-access-key-external-kms"
  description = "AWS External KMS using access-key type"
  configuration = {
    aws_region     = "us-east-1"
    aws_kms_key_id = "<aws-kms-key-id>"
    type           = "access-key"
    credential = {
      access_key_id     = "<access-key-id>"
      secret_access_key = "<secret-access-key>"
    }
  }
}

Schema

Required

• configuration (Attributes) The configuration for the AWS External KMS (see below for nested schema)
• name (String) The name of the KMS to create. Must be slug-friendly

Optional

• description (String) An optional description for the KMS.

Read-Only

• credentials_hash (String) The hash of the AWS External KMS credentials
• id (String) The ID of the KMS

Nested Schema for configuration

Required:

• aws_kms_key_id (String) The AWS KMS key ID to use for the external KMS. For more details, refer to the documentation here https://hanzo.ai/docs/documentation/platform/kms-configuration/aws-kms#param-aws-kms-key-id
• aws_region (String) The AWS region where the KMS key is located
• credential (Attributes) The AWS credentials for the external KMS (see below for nested schema)
• type (String) The Authentication Type to use. Must be access-key or assume-role

Nested Schema for configuration.credential

Optional:

• access_key_id (String, Sensitive) The AWS Access Key ID used to authenticate requests to AWS services. Required for access-key type. For more details, refer to the documentation here https://hanzo.ai/docs/documentation/platform/kms-configuration/aws-kms#param-access-key-id
• role_arn (String, Sensitive) The Amazon Resource Name (ARN) of the IAM role to assume for performing operations. Hanzo KMS will assume this role using AWS Security Token Service (STS). Required for assume-role type. For more details, refer to the documentation here https://hanzo.ai/docs/documentation/platform/kms-configuration/aws-kms#param-iam-role-arn-for-role-assumption
• role_external_id (String, Sensitive) The external ID of the role to assume for performing operations. Required for assume-role type. For more details, refer to the documentation here https://hanzo.ai/docs/documentation/platform/kms-configuration/aws-kms#param-assume-role-external-id
• secret_access_key (String, Sensitive) The AWS Secret Access Key associated with the Access Key ID to authenticate requests to AWS services. Required for access-key type. For more details, refer to the documentation here https://hanzo.ai/docs/documentation/platform/kms-configuration/aws-kms#param-secret-access-key