terraform-provider/docs/resources/kms_key.md

page_title, subcategory, description

page_title	subcategory	description
kms_kms_key Resource - terraform-provider	KMS	Create and manage KMS keys in Hanzo KMS.

kms_kms_key (Resource)

Create and manage KMS keys in Hanzo KMS.

Example Usage

terraform {
  required_providers {
    kms = {
      # version = <latest version>
      source = "hanzokms/kms"
    }
  }
}

provider "kms" {
  host = "https://kms.hanzo.ai" # Only required if using self hosted instance of Hanzo KMS, default is https://kms.hanzo.ai
  auth = {
    universal = {
      client_id     = "<machine-identity-client-id>"
      client_secret = "<machine-identity-client-secret>"
    }
  }
}

# Create an encryption KMS key
resource "kms_kms_key" "encryption_key" {
  project_id           = "<your-project-id>"
  name                 = "my-encryption-key"
  description          = "KMS key for encrypting sensitive data"
  key_usage            = "encrypt-decrypt"
  encryption_algorithm = "aes-256-gcm"
}

# Create a signing KMS key
resource "kms_kms_key" "signing_key" {
  project_id           = "<your-project-id>"
  name                 = "my-signing-key"
  description          = "KMS key for digital signatures"
  key_usage            = "sign-verify"
  encryption_algorithm = "RSA_4096"
}

Schema

Required

• name (String) The name of the KMS key. Must be 1-32 characters.
• project_id (String) The ID of the project where the KMS key will be created.

Optional

• description (String) The description of the KMS key. Maximum 500 characters.
• encryption_algorithm (String) The encryption algorithm for the key. Options: aes-256-gcm, aes-128-gcm, RSA_4096, ECC_NIST_P256. Defaults to 'aes-256-gcm'.
• is_disabled (Boolean) Whether the key is disabled. Defaults to false.
• key_usage (String) The usage of the key. Options: encrypt-decrypt, sign-verify. Defaults to 'encrypt-decrypt'.

Read-Only

• created_at (String) The creation timestamp of the key.
• id (String) The ID of the KMS key.
• org_id (String) The ID of the organization.
• updated_at (String) The last update timestamp of the key.
• version (Number) The version of the key.