Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

r/aws_kms_key: Add xks_key_id argument #31216

Merged
merged 6 commits into from
Dec 27, 2023
Merged

r/aws_kms_key: Add xks_key_id argument #31216

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
6063d3e
r/aws_kms_key: Add xks_key_id argument
albgus May 5, 2023
7360761
r/aws_kms_key: Fix SIGSEGV when xks_key_id is unset
albgus May 5, 2023
0c13352
Merge branch 'main' into aws_kms_key-xks_key_id
johnsonaj Dec 27, 2023
f0adde8
aws_kms_key: use RequiredWith
johnsonaj Dec 27, 2023
69cc0a9
add CHANGELOG entry
johnsonaj Dec 27, 2023
eb7c806
aws_kms_key: update documentation
johnsonaj Dec 27, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
3 changes: 3 additions & 0 deletions .changelog/31216.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
```release-note:enhancement
resource/aws_kms_key: Add `xks_key_id` attribute
```
18 changes: 18 additions & 0 deletions internal/service/kms/key.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,6 +121,13 @@ func ResourceKey() *schema.Resource {
},
names.AttrTags: tftags.TagsSchema(),
names.AttrTagsAll: tftags.TagsSchemaComputed(),
"xks_key_id": {
Type: schema.TypeString,
Optional: true,
ForceNew: true,
RequiredWith: []string{"custom_key_store_id"},
ValidateFunc: validation.StringLenBetween(1, 128),
},
},
}
}
Expand Down Expand Up @@ -158,6 +165,11 @@ func resourceKeyCreate(ctx context.Context, d *schema.ResourceData, meta interfa
input.CustomKeyStoreId = aws.String(v.(string))
}

if v, ok := d.GetOk("xks_key_id"); ok {
input.Origin = aws.String(kms.OriginTypeExternalKeyStore)
input.XksKeyId = aws.String(v.(string))
}

// AWS requires any principal in the policy to exist before the key is created.
// The KMS service's awareness of principals is limited by "eventual consistency".
// They acknowledge this here:
Expand Down Expand Up @@ -234,6 +246,12 @@ func resourceKeyRead(ctx context.Context, d *schema.ResourceData, meta interface
d.Set("key_usage", key.metadata.KeyUsage)
d.Set("multi_region", key.metadata.MultiRegion)

if key.metadata.XksKeyConfiguration != nil {
d.Set("xks_key_id", key.metadata.XksKeyConfiguration.Id)
} else {
d.Set("xks_key_id", nil)
}

policyToSet, err := verify.PolicyToSet(d.Get("policy").(string), key.policy)
if err != nil {
return sdkdiag.AppendErrorf(diags, "while setting policy (%s), encountered: %s", key.policy, err)
Expand Down
1 change: 1 addition & 0 deletions website/docs/r/kms_key.html.markdown
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,7 @@ If the KMS key is a multi-Region primary key with replicas, the waiting period b
* `enable_key_rotation` - (Optional) Specifies whether [key rotation](http://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html) is enabled. Defaults to `false`.
* `multi_region` - (Optional) Indicates whether the KMS key is a multi-Region (`true`) or regional (`false`) key. Defaults to `false`.
* `tags` - (Optional) A map of tags to assign to the object. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
* `xks_key_id` - (Optional) Identifies the external key that serves as key material for the KMS key in an external key store.

## Attribute Reference

Expand Down