cloudposse/kms-key
Terraform module to provision a KMS key with alias.
About
Terraform module to provision a KMS key with alias.
Maintained by cloudposse on the Terraform Registry. Latest version 0.12.2, 12.4M downloads. Requires providers: aws >= 3.64.0.
Deploy creates a StackGuardian workflow from the module's GitHub repository, pinned to this version. You set the inputs, see the plan, then approve the apply.
Use cases
- Customer-managed keys with rotation turned on from day one.
- Secrets referenced by workflows, never stored in repositories.
- One key and secret layout shared by every environment.
Inputs
No required inputs. Every variable has a default, so the first run works with an empty input form.
26 inputs, 4 outputs in total. The full list, with defaults and descriptions, is on the registry page.
What it creates
aws_kms_keyaws_kms_alias
How it runs on StackGuardian
Terraform workflow from the module's GitHub repository: plan, policy check, approval, then apply.
Approvals happen in StackGuardian. An agent can never approve its own run. Every run keeps its plan, policy results and approver in the audit log.