Class: AWSCDK::KMS::KeyProps

Inherits:
Jsii::Struct
  • Object
show all
Defined in:
kms/key_props.rb

Overview

Construction properties for a KMS Key object.

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(admins: nil, _alias: nil, description: nil, enabled: nil, enable_key_rotation: nil, key_spec: nil, key_usage: nil, multi_region: nil, pending_window: nil, policy: nil, removal_policy: nil, rotation_period: nil) ⇒ KeyProps

Returns a new instance of KeyProps.

Parameters:

  • admins (Array<AWSCDK::IAM::IPrincipal>, nil) (defaults to: nil) —

    A list of principals to add as key administrators to the key policy.

  • _alias (String, nil) (defaults to: nil) —

    Initial alias to add to the key.

  • description (String, nil) (defaults to: nil) —

    A description of the key.

  • enabled (Boolean, nil) (defaults to: nil) —

    Indicates whether the key is available for use.

  • enable_key_rotation (Boolean, nil) (defaults to: nil) —

    Indicates whether AWS KMS rotates the key.

  • key_spec (AWSCDK::KMS::KeySpec, nil) (defaults to: nil) —

    The cryptographic configuration of the key. The valid value depends on usage of the key.

  • key_usage (AWSCDK::KMS::KeyUsage, nil) (defaults to: nil) —

    The cryptographic operations for which the key can be used.

  • multi_region (Boolean, nil) (defaults to: nil) —

    Creates a multi-Region primary key that you can replicate in other AWS Regions.

  • pending_window (AWSCDK::Duration, nil) (defaults to: nil) —

    Specifies the number of days in the waiting period before AWS KMS deletes a CMK that has been removed from a CloudFormation stack.

  • policy (AWSCDK::IAM::PolicyDocument, nil) (defaults to: nil) —

    Custom policy document to attach to the KMS key.

  • removal_policy (AWSCDK::RemovalPolicy, nil) (defaults to: nil) —

    Whether the encryption key should be retained when it is removed from the Stack.

  • rotation_period (AWSCDK::Duration, nil) (defaults to: nil) —

    The period between each automatic rotation.



19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
 
# File 'kms/key_props.rb', line 19

def initialize(admins: nil, _alias: nil, description: nil, enabled: nil, enable_key_rotation: nil, key_spec: nil, key_usage: nil, multi_region: nil, pending_window: nil, policy: nil, removal_policy: nil, rotation_period: nil)
  @admins = admins
  Jsii::Type.check_type(@admins, JSON.parse(Base64.strict_decode64("eyJjb2xsZWN0aW9uIjp7ImVsZW1lbnR0eXBlIjp7ImZxbiI6ImF3cy1jZGstbGliLmF3c19pYW0uSVByaW5jaXBhbCJ9LCJraW5kIjoiYXJyYXkifX0=")), "admins") unless @admins.nil?
  @_alias = _alias
  Jsii::Type.check_type(@_alias, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "alias") unless @_alias.nil?
  @description = description
  Jsii::Type.check_type(@description, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "description") unless @description.nil?
  @enabled = enabled
  Jsii::Type.check_type(@enabled, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJib29sZWFuIn0=")), "enabled") unless @enabled.nil?
  @enable_key_rotation = enable_key_rotation
  Jsii::Type.check_type(@enable_key_rotation, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJib29sZWFuIn0=")), "enableKeyRotation") unless @enable_key_rotation.nil?
  @key_spec = key_spec
  Jsii::Type.check_type(@key_spec, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3Nfa21zLktleVNwZWMifQ==")), "keySpec") unless @key_spec.nil?
  @key_usage = key_usage
  Jsii::Type.check_type(@key_usage, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3Nfa21zLktleVVzYWdlIn0=")), "keyUsage") unless @key_usage.nil?
  @multi_region = multi_region
  Jsii::Type.check_type(@multi_region, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJib29sZWFuIn0=")), "multiRegion") unless @multi_region.nil?
  @pending_window = pending_window
  Jsii::Type.check_type(@pending_window, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5EdXJhdGlvbiJ9")), "pendingWindow") unless @pending_window.nil?
  @policy = policy
  Jsii::Type.check_type(@policy, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3NfaWFtLlBvbGljeURvY3VtZW50In0=")), "policy") unless @policy.nil?
  @removal_policy = removal_policy
  Jsii::Type.check_type(@removal_policy, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5SZW1vdmFsUG9saWN5In0=")), "removalPolicy") unless @removal_policy.nil?
  @rotation_period = rotation_period
  Jsii::Type.check_type(@rotation_period, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5EdXJhdGlvbiJ9")), "rotationPeriod") unless @rotation_period.nil?
end

Instance Attribute Details

#_alias ⇒ String? (readonly)

Note:

Default: - No alias is added for the key.

Initial alias to add to the key.

More aliases can be added later by calling add_alias.

Returns:

  • (String, nil) 


62
63
64
 
# File 'kms/key_props.rb', line 62

def _alias
  @_alias
end

#admins ⇒ Array<AWSCDK::IAM::IPrincipal>? (readonly)

Note:

Default: []

A list of principals to add as key administrators to the key policy.

Key administrators have permissions to manage the key (e.g., change permissions, revoke), but do not have permissions to use the key in cryptographic operations (e.g., encrypt, decrypt).

These principals will be added to the default key policy (if none specified), or to the specified policy (if provided).

Returns:



55
56
57
 
# File 'kms/key_props.rb', line 55

def admins
  @admins
end

#description ⇒ String? (readonly)

Note:

Default: - No description.

A description of the key.

Use a description that helps your users decide whether the key is appropriate for a particular task.

Returns:

  • (String, nil) 


70
71
72
 
# File 'kms/key_props.rb', line 70

def description
  @description
end

#enable_key_rotation ⇒ Boolean? (readonly)

Note:

Default: false

Indicates whether AWS KMS rotates the key.

Returns:

  • (Boolean, nil) 


80
81
82
 
# File 'kms/key_props.rb', line 80

def enable_key_rotation
  @enable_key_rotation
end

#enabled ⇒ Boolean? (readonly)

Note:

Default: - Key is enabled.

Indicates whether the key is available for use.

Returns:

  • (Boolean, nil) 


75
76
77
 
# File 'kms/key_props.rb', line 75

def enabled
  @enabled
end

#key_spec ⇒ AWSCDK::KMS::KeySpec? (readonly)

Note:

Default: KeySpec.SYMMETRIC_DEFAULT

The cryptographic configuration of the key. The valid value depends on usage of the key.

IMPORTANT: If you change this property of an existing key, the existing key is scheduled for deletion and a new key is created with the specified value.

Returns:



88
89
90
 
# File 'kms/key_props.rb', line 88

def key_spec
  @key_spec
end

#key_usage ⇒ AWSCDK::KMS::KeyUsage? (readonly)

Note:

Default: KeyUsage.ENCRYPT_DECRYPT

The cryptographic operations for which the key can be used.

IMPORTANT: If you change this property of an existing key, the existing key is scheduled for deletion and a new key is created with the specified value.

Returns:



96
97
98
 
# File 'kms/key_props.rb', line 96

def key_usage
  @key_usage
end

#multi_region ⇒ Boolean? (readonly)

Note:

Default: false

Creates a multi-Region primary key that you can replicate in other AWS Regions.

You can't change the multi_region value after the KMS key is created.

IMPORTANT: If you change the value of the multi_region property on an existing KMS key, the update request fails, regardless of the value of the UpdateReplacePolicy attribute. This prevents you from accidentally deleting a KMS key by changing an immutable property value.

Returns:

  • (Boolean, nil)

See Also:



108
109
110
 
# File 'kms/key_props.rb', line 108

def multi_region
  @multi_region
end

#pending_window ⇒ AWSCDK::Duration? (readonly)

Note:

Default: - 30 days

Specifies the number of days in the waiting period before AWS KMS deletes a CMK that has been removed from a CloudFormation stack.

When you remove a customer master key (CMK) from a CloudFormation stack, AWS KMS schedules the CMK for deletion and starts the mandatory waiting period. The PendingWindowInDays property determines the length of waiting period. During the waiting period, the key state of CMK is Pending Deletion, which prevents the CMK from being used in cryptographic operations. When the waiting period expires, AWS KMS permanently deletes the CMK.

Enter a value between 7 and 30 days.

Returns:

See Also:



121
122
123
 
# File 'kms/key_props.rb', line 121

def pending_window
  @pending_window
end

#policy ⇒ AWSCDK::IAM::PolicyDocument? (readonly)

Note:

Default: - A policy document with permissions for the account root to administer the key will be created.

Custom policy document to attach to the KMS key.

NOTE - If the @aws-cdk/aws-kms:defaultKeyPolicies feature flag is set (the default for new projects), this policy will override the default key policy and become the only key policy for the key. If the feature flag is not set, this policy will be appended to the default key policy.

Returns:



130
131
132
 
# File 'kms/key_props.rb', line 130

def policy
  @policy
end

#removal_policy ⇒ AWSCDK::RemovalPolicy? (readonly)

Note:

Default: RemovalPolicy.Retain

Whether the encryption key should be retained when it is removed from the Stack.

This is useful when one wants to retain access to data that was encrypted with a key that is being retired.

Returns:



138
139
140
 
# File 'kms/key_props.rb', line 138

def removal_policy
  @removal_policy
end

#rotation_period ⇒ AWSCDK::Duration? (readonly)

Note:

Default: - set by CFN to 365 days.

The period between each automatic rotation.

Returns:



143
144
145
 
# File 'kms/key_props.rb', line 143

def rotation_period
  @rotation_period
end

Class Method Details

.jsii_properties ⇒ Object 



145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
 
# File 'kms/key_props.rb', line 145

def self.jsii_properties
  {
    :admins => "admins",
    :_alias => "alias",
    :description => "description",
    :enabled => "enabled",
    :enable_key_rotation => "enableKeyRotation",
    :key_spec => "keySpec",
    :key_usage => "keyUsage",
    :multi_region => "multiRegion",
    :pending_window => "pendingWindow",
    :policy => "policy",
    :removal_policy => "removalPolicy",
    :rotation_period => "rotationPeriod",
  }
end

Instance Method Details

#to_jsii ⇒ Object 



162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
 
# File 'kms/key_props.rb', line 162

def to_jsii
  result = {}
  result.merge!({
    "admins" => @admins,
    "alias" => @_alias,
    "description" => @description,
    "enabled" => @enabled,
    "enableKeyRotation" => @enable_key_rotation,
    "keySpec" => @key_spec,
    "keyUsage" => @key_usage,
    "multiRegion" => @multi_region,
    "pendingWindow" => @pending_window,
    "policy" => @policy,
    "removalPolicy" => @removal_policy,
    "rotationPeriod" => @rotation_period,
  })
  result.compact
end