Class: AWSCDK::KMS::CfnReplicaKeyProps

Inherits:
Jsii::Struct
  • Object
show all
Defined in:
kms/cfn_replica_key_props.rb

Overview

Properties for defining a CfnReplicaKey.

See Also:

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(key_policy:, primary_key_arn:, description: nil, enabled: nil, pending_window_in_days: nil, tags: nil) ⇒ CfnReplicaKeyProps

Returns a new instance of CfnReplicaKeyProps.

Parameters:

  • key_policy (Object) —

    The key policy that authorizes use of the replica key.

  • primary_key_arn (String) —

    Specifies the multi-Region primary key to replicate.

  • description (String, nil) (defaults to: nil) —

    A description of the KMS key.

  • enabled (Boolean, AWSCDK::IResolvable, nil) (defaults to: nil) —

    Specifies whether the replica key is enabled. Disabled KMS keys cannot be used in cryptographic operations.

  • pending_window_in_days (Numeric, nil) (defaults to: nil) —

    Specifies the number of days in the waiting period before AWS deletes a replica key that has been removed from a CloudFormation stack.

  • tags (Array<AWSCDK::CfnTag>, nil) (defaults to: nil) —

    Assigns one or more tags to the replica key.



15
16
17
18
19
20
21
22
23
24
25
26
27
28
 
# File 'kms/cfn_replica_key_props.rb', line 15

def initialize(key_policy:, primary_key_arn:, description: nil, enabled: nil, pending_window_in_days: nil, tags: nil)
  @key_policy = key_policy
  Jsii::Type.check_type(@key_policy, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJhbnkifQ==")), "keyPolicy")
  @primary_key_arn = primary_key_arn
  Jsii::Type.check_type(@primary_key_arn, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "primaryKeyArn")
  @description = description
  Jsii::Type.check_type(@description, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "description") unless @description.nil?
  @enabled = enabled
  Jsii::Type.check_type(@enabled, JSON.parse(Base64.strict_decode64("eyJ1bmlvbiI6eyJ0eXBlcyI6W3sicHJpbWl0aXZlIjoiYm9vbGVhbiJ9LHsiZnFuIjoiYXdzLWNkay1saWIuSVJlc29sdmFibGUifV19fQ==")), "enabled") unless @enabled.nil?
  @pending_window_in_days = pending_window_in_days
  Jsii::Type.check_type(@pending_window_in_days, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJudW1iZXIifQ==")), "pendingWindowInDays") unless @pending_window_in_days.nil?
  @tags = tags.is_a?(Array) ? tags.map { |jsii_v0| jsii_v0.is_a?(Hash) ? ::AWSCDK::CfnTag.new(**jsii_v0.transform_keys(&:to_sym)) : jsii_v0 } : tags
  Jsii::Type.check_type(@tags, JSON.parse(Base64.strict_decode64("eyJjb2xsZWN0aW9uIjp7ImVsZW1lbnR0eXBlIjp7ImZxbiI6ImF3cy1jZGstbGliLkNmblRhZyJ9LCJraW5kIjoiYXJyYXkifX0=")), "tags") unless @tags.nil?
end

Instance Attribute Details

#description ⇒ String? (readonly)

A description of the KMS key.

The default value is an empty string (no description).

The description is not a shared property of multi-Region keys. You can specify the same description or a different description for each key in a set of related multi-Region keys. AWS Key Management Service does not synchronize this property.

Returns:

  • (String, nil)

See Also:



73
74
75
 
# File 'kms/cfn_replica_key_props.rb', line 73

def description
  @description
end

#enabled ⇒ Boolean, ... (readonly)

Specifies whether the replica key is enabled. Disabled KMS keys cannot be used in cryptographic operations.

When Enabled is true , the key state of the KMS key is Enabled . When Enabled is false , the key state of the KMS key is Disabled . The default value is true .

The actual key state of the replica might be affected by actions taken outside of CloudFormation, such as running the EnableKey , DisableKey , or ScheduleKeyDeletion operations. Also, while the replica key is being created, its key state is Creating . When the process is complete, the key state of the replica key changes to Enabled .

For information about the key states of a KMS key, see Key state: Effect on your KMS key in the AWS Key Management Service Developer Guide .

Returns:

See Also:



84
85
86
 
# File 'kms/cfn_replica_key_props.rb', line 84

def enabled
  @enabled
end

#key_policy ⇒ Object (readonly)

The key policy that authorizes use of the replica key.

The key policy is not a shared property of multi-Region keys. You can specify the same key policy or a different key policy for each key in a set of related multi-Region keys. AWS does not synchronize this property.

The key policy must conform to the following rules.

  • The key policy must give the caller PutKeyPolicy permission on the KMS key. This reduces the risk that the KMS key becomes unmanageable. For more information, refer to the scenario in the Default key policy section of the AWS Key Management Service Developer Guide .
  • Each statement in the key policy must contain one or more principals. The principals in the key policy must exist and be visible to AWS . When you create a new AWS principal (for example, an IAM user or role), you might need to enforce a delay before including the new principal in a key policy because the new principal might not be immediately visible to AWS . For more information, see Changes that I make are not always immediately visible in the AWS Identity and Access Management User Guide .

A key policy document can include only the following characters:

  • Printable ASCII characters from the space character ( \u0020 ) through the end of the ASCII character range.
  • Printable characters in the Basic Latin and Latin-1 Supplement character set (through \u00FF ).
  • The tab ( \u0009 ), line feed ( \u000A ), and carriage return ( \u000D ) special characters

Minimum : 1

Maximum : 32768

Returns:

  • (Object)

See Also:



51
52
53
 
# File 'kms/cfn_replica_key_props.rb', line 51

def key_policy
  @key_policy
end

#pending_window_in_days ⇒ Numeric? (readonly)

Specifies the number of days in the waiting period before AWS deletes a replica key that has been removed from a CloudFormation stack.

Enter a value between 7 and 30 days. The default value is 30 days.

When you remove a replica key from a CloudFormation stack, AWS schedules the replica key for deletion and starts the mandatory waiting period. The PendingWindowInDays property determines the length of waiting period. During the waiting period, the key state of replica key is Pending Deletion , which prevents it from being used in cryptographic operations. When the waiting period expires, AWS permanently deletes the replica key.

If the KMS key is a multi-Region primary key with replica keys, the waiting period begins when the last of its replica keys is deleted. Otherwise, the waiting period begins immediately.

You cannot use a CloudFormation template to cancel deletion of the replica after you remove it from the stack, regardless of the waiting period. However, if you specify a replica key in your template that is based on the same primary key as the original replica key, CloudFormation creates a new replica key with the same key ID, key material, and other shared properties of the original replica key. This new replica key can decrypt ciphertext that was encrypted under the original replica key, or any related multi-Region key.

For detailed information about deleting multi-Region keys, see Deleting multi-Region keys in the AWS Key Management Service Developer Guide .

For information about the PendingDeletion key state, see Key state: Effect on your KMS key in the AWS Key Management Service Developer Guide . For more information about deleting KMS keys, see the ScheduleKeyDeletion operation in the AWS Key Management Service API Reference and Deleting KMS keys in the AWS Key Management Service Developer Guide .

Returns:

  • (Numeric, nil)

See Also:



101
102
103
 
# File 'kms/cfn_replica_key_props.rb', line 101

def pending_window_in_days
  @pending_window_in_days
end

#primary_key_arn ⇒ String (readonly)

Specifies the multi-Region primary key to replicate.

The primary key must be in a different AWS Region of the same AWS partition. You can create only one replica of a given primary key in each AWS Region .

If you change the PrimaryKeyArn value of a replica key, the existing replica key is scheduled for deletion and a new replica key is created based on the specified primary key. While it is scheduled for deletion, the existing replica key becomes unusable. You can cancel the scheduled deletion of the key outside of CloudFormation.

However, if you inadvertently delete a replica key, you can decrypt ciphertext encrypted by that replica key by using any related multi-Region key. If necessary, you can recreate the replica in the same Region after the previous one is completely deleted. For details, see Deleting multi-Region keys in the AWS Key Management Service Developer Guide

Specify the key ARN of an existing multi-Region primary key. For example, arn:aws:kms:us-east-2:111122223333:key/mrk-1234abcd12ab34cd56ef1234567890ab .

Returns:

  • (String)

See Also:



64
65
66
 
# File 'kms/cfn_replica_key_props.rb', line 64

def primary_key_arn
  @primary_key_arn
end

#tags ⇒ Array<AWSCDK::CfnTag>? (readonly)

Assigns one or more tags to the replica key.

Tagging or untagging a KMS key can allow or deny permission to the KMS key. For details, see ABAC for AWS in the AWS Key Management Service Developer Guide .

Tags are not a shared property of multi-Region keys. You can specify the same tags or different tags for each key in a set of related multi-Region keys. AWS does not synchronize this property.

Each tag consists of a tag key and a tag value. Both the tag key and the tag value are required, but the tag value can be an empty (null) string. You cannot have more than one tag on a KMS key with the same tag key. If you specify an existing tag key with a different tag value, AWS replaces the current tag value with the specified one.

When you assign tags to an AWS resource, AWS generates a cost allocation report with usage and costs aggregated by tags. Tags can also be used to control access to a KMS key. For details, see Tagging keys .

Returns:

See Also:



114
115
116
 
# File 'kms/cfn_replica_key_props.rb', line 114

def tags
  @tags
end

Class Method Details

.jsii_properties ⇒ Object 



116
117
118
119
120
121
122
123
124
125
 
# File 'kms/cfn_replica_key_props.rb', line 116

def self.jsii_properties
  {
    :key_policy => "keyPolicy",
    :primary_key_arn => "primaryKeyArn",
    :description => "description",
    :enabled => "enabled",
    :pending_window_in_days => "pendingWindowInDays",
    :tags => "tags",
  }
end

Instance Method Details

#to_jsii ⇒ Object 



127
128
129
130
131
132
133
134
135
136
137
138
 
# File 'kms/cfn_replica_key_props.rb', line 127

def to_jsii
  result = {}
  result.merge!({
    "keyPolicy" => @key_policy,
    "primaryKeyArn" => @primary_key_arn,
    "description" => @description,
    "enabled" => @enabled,
    "pendingWindowInDays" => @pending_window_in_days,
    "tags" => @tags,
  })
  result.compact
end