Class: AWSCDK::KMS::Alias

Inherits:
Resource
  • Object
show all
Includes:
IAlias
Defined in:
kms/alias.rb

Overview

Defines a display name for a customer master key (CMK) in AWS Key Management Service (AWS KMS).

Using an alias to refer to a key can help you simplify key management. For example, when rotating keys, you can just update the alias mapping instead of tracking and changing key IDs. For more information, see Working with Aliases in the AWS Key Management Service Developer Guide.

You can also add an alias for a key by calling key.addAlias(alias).

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(scope, id, props) ⇒ Alias

Returns a new instance of Alias.

Parameters:



19
20
21
22
23
24
25
 
# File 'kms/alias.rb', line 19

def initialize(scope, id, props)
  props = props.is_a?(Hash) ? ::AWSCDK::KMS::AliasProps.new(**props.transform_keys(&:to_sym)) : props
  Jsii::Type.check_type(scope, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJjb25zdHJ1Y3RzLkNvbnN0cnVjdCJ9")), "scope")
  Jsii::Type.check_type(id, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "id")
  Jsii::Type.check_type(props, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3Nfa21zLkFsaWFzUHJvcHMifQ==")), "props")
  Jsii::Object.instance_method(:initialize).bind(self).call(scope, id, props)
end

Class Method Details

.from_alias_attributes(scope, id, attrs) ⇒ AWSCDK::KMS::IAlias

Import an existing KMS Alias defined outside the CDK app.

Parameters:

  • scope (Constructs::Construct) —

    The parent creating construct (usually this).

  • id (String) —

    The construct's name.

  • attrs (AWSCDK::KMS::AliasAttributes) —

    the properties of the referenced KMS Alias.

Returns:



67
68
69
70
71
72
73
 
# File 'kms/alias.rb', line 67

def self.from_alias_attributes(scope, id, attrs)
  Jsii::Type.check_type(scope, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJjb25zdHJ1Y3RzLkNvbnN0cnVjdCJ9")), "scope")
  Jsii::Type.check_type(id, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "id")
  attrs = attrs.is_a?(Hash) ? ::AWSCDK::KMS::AliasAttributes.new(**attrs.transform_keys(&:to_sym)) : attrs
  Jsii::Type.check_type(attrs, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3Nfa21zLkFsaWFzQXR0cmlidXRlcyJ9")), "attrs")
  Jsii::Kernel.instance.call_static("aws-cdk-lib.aws_kms.Alias", "fromAliasAttributes", [scope, id, attrs])
end

.from_alias_name(scope, id, alias_name) ⇒ AWSCDK::KMS::IAlias

Import an existing KMS Alias defined outside the CDK app, by the alias name.

This method should be used instead of 'fromAliasAttributes' when the underlying KMS Key ARN is not available. This Alias will not have a direct reference to the KMS Key, so addAlias method is not supported.

If the @aws-cdk/aws-kms:applyImportedAliasPermissionsToPrincipal feature flag is set to true, the grant* methods will use the kms:ResourceAliases condition to grant permissions to the specific alias name. They will only modify the principal policy, not the key resource policy. Without the feature flag grant* methods will be a no-op.

Parameters:

  • scope (Constructs::Construct) —

    The parent creating construct (usually this).

  • id (String) —

    The construct's name.

  • alias_name (String) —

    The full name of the KMS Alias (e.g., 'alias/aws/s3', 'alias/myKeyAlias').

Returns:



90
91
92
93
94
95
 
# File 'kms/alias.rb', line 90

def self.from_alias_name(scope, id, alias_name)
  Jsii::Type.check_type(scope, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJjb25zdHJ1Y3RzLkNvbnN0cnVjdCJ9")), "scope")
  Jsii::Type.check_type(id, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "id")
  Jsii::Type.check_type(alias_name, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "aliasName")
  Jsii::Kernel.instance.call_static("aws-cdk-lib.aws_kms.Alias", "fromAliasName", [scope, id, alias_name])
end

.jsii_overridable_methods ⇒ Object 



27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
 
# File 'kms/alias.rb', line 27

def self.jsii_overridable_methods
  {
    :node => { kind: :property, name: "node", is_optional: false },
    :env => { kind: :property, name: "env", is_optional: false },
    :physical_name => { kind: :property, name: "physicalName", is_optional: false },
    :stack => { kind: :property, name: "stack", is_optional: false },
    :alias_arn => { kind: :property, name: "aliasArn", is_optional: false },
    :alias_name => { kind: :property, name: "aliasName", is_optional: false },
    :alias_ref => { kind: :property, name: "aliasRef", is_optional: false },
    :alias_target_key => { kind: :property, name: "aliasTargetKey", is_optional: false },
    :key_arn => { kind: :property, name: "keyArn", is_optional: false },
    :key_id => { kind: :property, name: "keyId", is_optional: false },
    :key_ref => { kind: :property, name: "keyRef", is_optional: false },
    :to_string => { kind: :method, name: "toString", is_optional: false },
    :with => { kind: :method, name: "with", is_optional: false },
    :apply_cross_stack_reference_strength => { kind: :method, name: "applyCrossStackReferenceStrength", is_optional: false },
    :apply_removal_policy => { kind: :method, name: "applyRemovalPolicy", is_optional: false },
    :generate_physical_name => { kind: :method, name: "generatePhysicalName", is_optional: false },
    :get_resource_arn_attribute => { kind: :method, name: "getResourceArnAttribute", is_optional: false },
    :get_resource_name_attribute => { kind: :method, name: "getResourceNameAttribute", is_optional: false },
    :add_alias => { kind: :method, name: "addAlias", is_optional: false },
    :add_to_resource_policy => { kind: :method, name: "addToResourcePolicy", is_optional: false },
    :grant => { kind: :method, name: "grant", is_optional: false },
    :grant_decrypt => { kind: :method, name: "grantDecrypt", is_optional: false },
    :grant_encrypt => { kind: :method, name: "grantEncrypt", is_optional: false },
    :grant_encrypt_decrypt => { kind: :method, name: "grantEncryptDecrypt", is_optional: false },
    :grant_generate_mac => { kind: :method, name: "grantGenerateMac", is_optional: false },
    :grant_sign => { kind: :method, name: "grantSign", is_optional: false },
    :grant_sign_verify => { kind: :method, name: "grantSignVerify", is_optional: false },
    :grant_verify => { kind: :method, name: "grantVerify", is_optional: false },
    :grant_verify_mac => { kind: :method, name: "grantVerifyMac", is_optional: false },
  }
end

.PROPERTY_INJECTION_ID ⇒ String

Uniquely identifies this class.

Returns:

  • (String) 


143
144
145
 
# File 'kms/alias.rb', line 143

def self.PROPERTY_INJECTION_ID()
  Jsii::Kernel.instance.get_static("aws-cdk-lib.aws_kms.Alias", "PROPERTY_INJECTION_ID")
end

Instance Method Details

#add_alias(_alias) ⇒ AWSCDK::KMS::Alias

Defines a new alias for the key.

Parameters:

  • _alias (String)

Returns:

  • (AWSCDK::KMS::Alias) 


291
292
293
294
 
# File 'kms/alias.rb', line 291

def add_alias(_alias)
  Jsii::Type.check_type(_alias, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "alias")
  jsii_call_method("addAlias", [_alias])
end

#add_to_resource_policy(statement, allow_no_op = nil) ⇒ AWSCDK::IAM::AddToResourcePolicyResult

Adds a statement to the KMS key resource policy.

Parameters:

Returns:



301
302
303
304
305
 
# File 'kms/alias.rb', line 301

def add_to_resource_policy(statement, allow_no_op = nil)
  Jsii::Type.check_type(statement, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3NfaWFtLlBvbGljeVN0YXRlbWVudCJ9")), "statement")
  Jsii::Type.check_type(allow_no_op, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJib29sZWFuIn0=")), "allowNoOp") unless allow_no_op.nil?
  jsii_call_method("addToResourcePolicy", [statement, allow_no_op])
end

#alias_arn ⇒ String

The ARN of the alias.

Returns:

  • (String) 


150
151
152
 
# File 'kms/alias.rb', line 150

def alias_arn()
  jsii_get_property("aliasArn")
end

#alias_name ⇒ String

The name of the alias.

Returns:

  • (String) 


157
158
159
 
# File 'kms/alias.rb', line 157

def alias_name()
  jsii_get_property("aliasName")
end

#alias_ref ⇒ AWSCDK::Interfaces::AWSKMS::AliasReference

A reference to a Alias resource.

Returns:



164
165
166
 
# File 'kms/alias.rb', line 164

def alias_ref()
  jsii_get_property("aliasRef")
end

#alias_target_key ⇒ AWSCDK::KMS::IKey

The Key to which the Alias refers.

Returns:



171
172
173
 
# File 'kms/alias.rb', line 171

def alias_target_key()
  jsii_get_property("aliasTargetKey")
end

#apply_cross_stack_reference_strength(strength) ⇒ void

This method returns an undefined value.

Override the cross-stack reference strength for this resource.

When set, any cross-stack reference to this resource will use the specified mechanism instead of the global default determined by the @aws-cdk/core:defaultCrossStackReferences context key. This is useful for selectively weakening specific references to avoid the "deadly embrace" problem without changing the app-wide default.

Parameters:



230
231
232
233
 
# File 'kms/alias.rb', line 230

def apply_cross_stack_reference_strength(strength)
  Jsii::Type.check_type(strength, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5SZWZlcmVuY2VTdHJlbmd0aCJ9")), "strength")
  jsii_call_method("applyCrossStackReferenceStrength", [strength])
end

#apply_removal_policy(policy) ⇒ void

This method returns an undefined value.

Apply the given removal policy to this resource.

The Removal Policy controls what happens to this resource when it stops being managed by CloudFormation, either because you've removed it from the CDK application or because you've made a change that requires the resource to be replaced.

The resource can be deleted (RemovalPolicy.DESTROY), or left in your AWS account for data recovery and cleanup later (RemovalPolicy.RETAIN).

Parameters:



247
248
249
250
 
# File 'kms/alias.rb', line 247

def apply_removal_policy(policy)
  Jsii::Type.check_type(policy, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5SZW1vdmFsUG9saWN5In0=")), "policy")
  jsii_call_method("applyRemovalPolicy", [policy])
end

#env ⇒ AWSCDK::Interfaces::ResourceEnvironment

The environment this resource belongs to.

For resources that are created and managed in a Stack (those created by creating new class instances like new Role(), new Bucket(), etc.), this is always the same as the environment of the stack they belong to.

For referenced resources (those obtained from referencing methods like Role.fromRoleArn(), Bucket.fromBucketName(), etc.), they might be different than the stack they were imported into.

Returns:



115
116
117
 
# File 'kms/alias.rb', line 115

def env()
  jsii_get_property("env")
end

#generate_physical_name ⇒ String

Returns:

  • (String) 


253
254
255
 
# File 'kms/alias.rb', line 253

def generate_physical_name()
  jsii_call_method("generatePhysicalName", [])
end

#get_resource_arn_attribute(arn_attr, arn_components) ⇒ String

Returns an environment-sensitive token that should be used for the resource's "ARN" attribute (e.g. bucket.bucketArn).

Normally, this token will resolve to arn_attr, but if the resource is referenced across environments, arn_components will be used to synthesize a concrete ARN with the resource's physical name. Make sure to reference this.physicalName in arn_components.

Parameters:

  • arn_attr (String) —

    The CFN attribute which resolves to the ARN of the resource.

  • arn_components (AWSCDK::ARNComponents) —

    The format of the ARN of this resource.

Returns:

  • (String) 


267
268
269
270
271
272
 
# File 'kms/alias.rb', line 267

def get_resource_arn_attribute(arn_attr, arn_components)
  Jsii::Type.check_type(arn_attr, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "arnAttr")
  arn_components = arn_components.is_a?(Hash) ? ::AWSCDK::ARNComponents.new(**arn_components.transform_keys(&:to_sym)) : arn_components
  Jsii::Type.check_type(arn_components, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5Bcm5Db21wb25lbnRzIn0=")), "arnComponents")
  jsii_call_method("getResourceArnAttribute", [arn_attr, arn_components])
end

#get_resource_name_attribute(name_attr) ⇒ String

Returns an environment-sensitive token that should be used for the resource's "name" attribute (e.g. bucket.bucketName).

Normally, this token will resolve to name_attr, but if the resource is referenced across environments, it will be resolved to this.physicalName, which will be a concrete name.

Parameters:

  • name_attr (String) —

    The CFN attribute which resolves to the resource's name.

Returns:

  • (String) 


282
283
284
285
 
# File 'kms/alias.rb', line 282

def get_resource_name_attribute(name_attr)
  Jsii::Type.check_type(name_attr, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "nameAttr")
  jsii_call_method("getResourceNameAttribute", [name_attr])
end

#grant(grantee, *actions) ⇒ AWSCDK::IAM::Grant

[disable-awslint:no-grants].

Parameters:

Returns:



312
313
314
315
316
317
318
 
# File 'kms/alias.rb', line 312

def grant(grantee, *actions)
  Jsii::Type.check_type(grantee, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3NfaWFtLklHcmFudGFibGUifQ==")), "grantee")
  actions.each_with_index do |item, index|
    Jsii::Type.check_type(item, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "actions[#{index}]")
  end
  jsii_call_method("grant", [grantee, *actions])
end

#grant_decrypt(grantee) ⇒ AWSCDK::IAM::Grant

[disable-awslint:no-grants].

Parameters:

Returns:



324
325
326
327
 
# File 'kms/alias.rb', line 324

def grant_decrypt(grantee)
  Jsii::Type.check_type(grantee, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3NfaWFtLklHcmFudGFibGUifQ==")), "grantee")
  jsii_call_method("grantDecrypt", [grantee])
end

#grant_encrypt(grantee) ⇒ AWSCDK::IAM::Grant

[disable-awslint:no-grants].

Parameters:

Returns:



333
334
335
336
 
# File 'kms/alias.rb', line 333

def grant_encrypt(grantee)
  Jsii::Type.check_type(grantee, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3NfaWFtLklHcmFudGFibGUifQ==")), "grantee")
  jsii_call_method("grantEncrypt", [grantee])
end

#grant_encrypt_decrypt(grantee) ⇒ AWSCDK::IAM::Grant

[disable-awslint:no-grants].

Parameters:

Returns:



342
343
344
345
 
# File 'kms/alias.rb', line 342

def grant_encrypt_decrypt(grantee)
  Jsii::Type.check_type(grantee, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3NfaWFtLklHcmFudGFibGUifQ==")), "grantee")
  jsii_call_method("grantEncryptDecrypt", [grantee])
end

#grant_generate_mac(grantee) ⇒ AWSCDK::IAM::Grant

[disable-awslint:no-grants].

Parameters:

Returns:



351
352
353
354
 
# File 'kms/alias.rb', line 351

def grant_generate_mac(grantee)
  Jsii::Type.check_type(grantee, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3NfaWFtLklHcmFudGFibGUifQ==")), "grantee")
  jsii_call_method("grantGenerateMac", [grantee])
end

#grant_sign(grantee) ⇒ AWSCDK::IAM::Grant

[disable-awslint:no-grants].

Parameters:

Returns:



360
361
362
363
 
# File 'kms/alias.rb', line 360

def grant_sign(grantee)
  Jsii::Type.check_type(grantee, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3NfaWFtLklHcmFudGFibGUifQ==")), "grantee")
  jsii_call_method("grantSign", [grantee])
end

#grant_sign_verify(grantee) ⇒ AWSCDK::IAM::Grant

[disable-awslint:no-grants].

Parameters:

Returns:



369
370
371
372
 
# File 'kms/alias.rb', line 369

def grant_sign_verify(grantee)
  Jsii::Type.check_type(grantee, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3NfaWFtLklHcmFudGFibGUifQ==")), "grantee")
  jsii_call_method("grantSignVerify", [grantee])
end

#grant_verify(grantee) ⇒ AWSCDK::IAM::Grant

[disable-awslint:no-grants].

Parameters:

Returns:



378
379
380
381
 
# File 'kms/alias.rb', line 378

def grant_verify(grantee)
  Jsii::Type.check_type(grantee, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3NfaWFtLklHcmFudGFibGUifQ==")), "grantee")
  jsii_call_method("grantVerify", [grantee])
end

#grant_verify_mac(grantee) ⇒ AWSCDK::IAM::Grant

[disable-awslint:no-grants].

Parameters:

Returns:



387
388
389
390
 
# File 'kms/alias.rb', line 387

def grant_verify_mac(grantee)
  Jsii::Type.check_type(grantee, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3NfaWFtLklHcmFudGFibGUifQ==")), "grantee")
  jsii_call_method("grantVerifyMac", [grantee])
end

#key_arn ⇒ String

Deprecated.

use aliasArn instead

The ARN of the alias.

Returns:

  • (String) 


179
180
181
 
# File 'kms/alias.rb', line 179

def key_arn()
  jsii_get_property("keyArn")
end

#key_id ⇒ String

The ID of the key (the part that looks something like: 1234abcd-12ab-34cd-56ef-1234567890ab).

Returns:

  • (String) 


186
187
188
 
# File 'kms/alias.rb', line 186

def key_id()
  jsii_get_property("keyId")
end

#key_ref ⇒ AWSCDK::Interfaces::AWSKMS::KeyReference

A reference to a Key resource.

Returns:



193
194
195
 
# File 'kms/alias.rb', line 193

def key_ref()
  jsii_get_property("keyRef")
end

#node ⇒ Constructs::Node

The tree node.

Returns:

  • (Constructs::Node) 


100
101
102
 
# File 'kms/alias.rb', line 100

def node()
  jsii_get_property("node")
end

#physical_name ⇒ String

Returns a string-encoded token that resolves to the physical name that should be passed to the CloudFormation resource.

This value will resolve to one of the following:

  • a concrete value (e.g. "my-awesome-bucket")
  • undefined, when a name should be generated by CloudFormation
  • a concrete name generated automatically during synthesis, in cross-environment scenarios.

Returns:

  • (String) 


129
130
131
 
# File 'kms/alias.rb', line 129

def physical_name()
  jsii_get_property("physicalName")
end

#stack ⇒ AWSCDK::Stack

The stack in which this resource is defined.

Returns:



136
137
138
 
# File 'kms/alias.rb', line 136

def stack()
  jsii_get_property("stack")
end

#to_string ⇒ String

Returns a string representation of this construct.

Returns:

  • (String) 


200
201
202
 
# File 'kms/alias.rb', line 200

def to_string()
  jsii_call_method("toString", [])
end

#with(*mixins) ⇒ Constructs::IConstruct

Applies one or more mixins to this construct.

Mixins are applied in order. The list of constructs is captured at the start of the call, so constructs added by a mixin will not be visited. Use multiple with() calls if subsequent mixins should apply to added constructs.

Parameters:

  • mixins (Array<Constructs::IMixin>)

Returns:

  • (Constructs::IConstruct) 


213
214
215
216
217
218
 
# File 'kms/alias.rb', line 213

def with(*mixins)
  mixins.each_with_index do |item, index|
    Jsii::Type.check_type(item, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJjb25zdHJ1Y3RzLklNaXhpbiJ9")), "mixins[#{index}]")
  end
  jsii_call_method("with", [*mixins])
end