AWS::KMS::Key¶
The AWS::KMS::Key resource specifies an KMS key in KMSlong.
Generated by cfn-typegen --out cfn_types AWS::KMS::Key into cfn_types/kms.py:
# Generated by cfn-typegen from the CloudFormation registry schemas. Do not edit.
# fmt: off
# ruff: noqa
"""AWS::KMS resources."""
from collections.abc import Mapping, Sequence
from typing import Any, Literal, NotRequired, Unpack
from typing_extensions import TypedDict
from cfn_typed.base import DeletionPolicy, DependsOn, ResourceAttrs, Tag, UpdateReplacePolicy, build
from cfn_typed.intrinsics import Expr
CONSTRAINTS:dict[str,Any]={
'AWS::KMS::Key':{'Description':{'l':0,'L':8192},'KeyUsage':{'e':["ENCRYPT_DECRYPT","SIGN_VERIFY","GENERATE_VERIFY_MAC","KEY_AGREEMENT","ENCAPSULATE_DECAPSULATE"]},'Origin':{'e':["AWS_KMS","EXTERNAL"]},'KeySpec':{'e':["SYMMETRIC_DEFAULT","RSA_2048","RSA_3072","RSA_4096","ECC_NIST_P256","ECC_NIST_P384","ECC_NIST_P521","ECC_SECG_P256K1","HMAC_224","HMAC_256","HMAC_384","HMAC_512","SM2","ML_DSA_44","ML_DSA_65","ML_DSA_87","ECC_NIST_EDWARDS25519","ML_KEM_512","ML_KEM_768","ML_KEM_1024"]},'PendingWindowInDays':{'m':7,'M':30},'Tags':{'T':{'P':{'Key':{'l':1,'L':128},'Value':{'l':0,'L':256}}}},'RotationPeriodInDays':{'m':90,'M':2560}},
}
ATTRIBUTES:dict[str,Any]={"AWS::KMS::Key":["Arn","KeyId"]}
RULES:dict[str,Any]={}
Nested types (3)
These are defined above the properties in the generated module.
class KeyProps(TypedDict, closed=True):
'The ``AWS::KMS::Key`` resource specifies an [KMS key](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#kms_keys) in KMSlong.'
Description: NotRequired[Expr[str]]
'A description of the KMS key.'
Enabled: NotRequired[Expr[bool]]
'Specifies whether the KMS key is enabled.'
EnableKeyRotation: NotRequired[Expr[bool]]
'Enables automatic rotation of the key material for the specified KMS key.'
KeyPolicy: NotRequired[Expr[Mapping[str, Any]] | Expr[str]]
'The key policy to attach to the KMS key.'
KeyUsage: NotRequired[Expr[str]]
'Determines the [cryptographic operations](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations) for which you can use...'
Origin: NotRequired[Expr[str]]
'The source of the key material for the KMS key.'
KeySpec: NotRequired[Expr[str]]
'Specifies the type of KMS key to create.'
MultiRegion: NotRequired[Expr[bool]]
'Creates a multi-Region primary key that you can replicate in other AWS-Regions.'
PendingWindowInDays: NotRequired[Expr[int]]
'Specifies the number of days in the waiting period before KMS deletes a KMS key that has been removed from a CloudFormation stack.'
Tags: NotRequired[Expr[Sequence[Expr[Tag]]]]
'Assigns one or more tags to the replica key.'
BypassPolicyLockoutSafetyCheck: NotRequired[Expr[bool]]
'Skips ("bypasses") the key policy lockout safety check.'
RotationPeriodInDays: NotRequired[Expr[int]]
'Specifies a custom period of time between each rotation date.'
class Key(ResourceAttrs):
'The ``AWS::KMS::Key`` resource specifies an [KMS key](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#kms_keys) in KMSlong.'
Type: Literal['AWS::KMS::Key']
Properties: NotRequired[KeyProps]
def key(
*,
depends_on: DependsOn | None = None,
deletion_policy: DeletionPolicy | None = None,
update_replace_policy: UpdateReplacePolicy | None = None,
condition: str | None = None,
metadata: dict[str, Any] | None = None,
**props: Unpack[KeyProps],
) -> Key:
return build('AWS::KMS::Key', props, depends_on, deletion_policy, update_replace_policy, condition, metadata)
Attributes¶
Read-only values for get_att(logical_id, attribute). They are not accepted as inputs.
ArnKeyId