java.lang.Object
- com.pulumi.resources.Resource
- - com.pulumi.resources.CustomResource
  - - com.pulumi.aws.kms.ExternalKey

public class ExternalKey
extends com.pulumi.resources.CustomResource

Manages a single-Region or multi-Region primary KMS key that uses external key material. To instead manage a single-Region or multi-Region primary KMS key where AWS automatically generates and potentially rotates key material, see the `aws.kms.Key` resource. ## Example Usage

 
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.kms.ExternalKey;
 import com.pulumi.aws.kms.ExternalKeyArgs;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var example = new ExternalKey("example", ExternalKeyArgs.builder()
             .description("KMS EXTERNAL for AMI encryption")
             .build());
 
     }
 }

## Import Using `pulumi import`, import KMS External Keys using the `id`. For example: ```sh $ pulumi import aws:kms/externalKey:ExternalKey a arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab ```

Nested Class Summary
- Nested classes/interfaces inherited from class com.pulumi.resources.CustomResource
  com.pulumi.resources.CustomResource.CustomResourceInternal
- Nested classes/interfaces inherited from class com.pulumi.resources.Resource
  com.pulumi.resources.Resource.LazyField<T extends java.lang.Object>, com.pulumi.resources.Resource.LazyFields, com.pulumi.resources.Resource.ResourceInternal

Field Summary
- Fields inherited from class com.pulumi.resources.Resource
  childResources, remote

Constructor Summary

Constructors
Constructor	Description
`ExternalKey(java.lang.String name)`
`ExternalKey(java.lang.String name, ExternalKeyArgs args)`
`ExternalKey(java.lang.String name, ExternalKeyArgs args, com.pulumi.resources.CustomResourceOptions options)`

Method Summary

All Methods Static Methods Instance Methods Concrete Methods
Modifier and Type	Method	Description
`com.pulumi.core.Output<java.lang.String>`	`arn()`
`com.pulumi.core.Output<java.util.Optional<java.lang.Boolean>>`	`bypassPolicyLockoutSafetyCheck()`
`com.pulumi.core.Output<java.util.Optional<java.lang.Integer>>`	`deletionWindowInDays()`
`com.pulumi.core.Output<java.util.Optional<java.lang.String>>`	`description()`
`com.pulumi.core.Output<java.lang.Boolean>`	`enabled()`
`com.pulumi.core.Output<java.lang.String>`	`expirationModel()`
`static ExternalKey`	`get(java.lang.String name, com.pulumi.core.Output<java.lang.String> id, ExternalKeyState state, com.pulumi.resources.CustomResourceOptions options)`	Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.
`com.pulumi.core.Output<java.util.Optional<java.lang.String>>`	`keyMaterialBase64()`
`com.pulumi.core.Output<java.lang.String>`	`keySpec()`
`com.pulumi.core.Output<java.lang.String>`	`keyState()`
`com.pulumi.core.Output<java.lang.String>`	`keyUsage()`
`com.pulumi.core.Output<java.lang.Boolean>`	`multiRegion()`
`com.pulumi.core.Output<java.lang.String>`	`policy()`
`com.pulumi.core.Output<java.lang.String>`	`region()`
`com.pulumi.core.Output<java.util.Optional<java.util.Map<java.lang.String,java.lang.String>>>`	`tags()`
`com.pulumi.core.Output<java.util.Map<java.lang.String,java.lang.String>>`	`tagsAll()`
`com.pulumi.core.Output<java.util.Optional<java.lang.String>>`	`validTo()`

Methods inherited from class com.pulumi.resources.CustomResource
getId, id, idFuture

Methods inherited from class com.pulumi.resources.Resource
getChildResources, getResourceName, getResourceType, getUrn, pulumiChildResources, pulumiResourceName, pulumiResourceType, urn

Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

- Constructor Detail
  - ExternalKey
```
public ExternalKey(java.lang.String name)
```
    Parameters:
    
    name - The _unique_ name of the resulting resource.
  - ExternalKey
```
public ExternalKey(java.lang.String name,
                   @Nullable
                   ExternalKeyArgs args)
```
    Parameters:
    
    name - The _unique_ name of the resulting resource.
    
    args - The arguments to use to populate this resource's properties.
  - ExternalKey
```
public ExternalKey(java.lang.String name,
                   @Nullable
                   ExternalKeyArgs args,
                   @Nullable
                   com.pulumi.resources.CustomResourceOptions options)
```
    Parameters:
    
    name - The _unique_ name of the resulting resource.
    
    args - The arguments to use to populate this resource's properties.
    
    options - A bag of options that control this resource's behavior.
- Method Detail
  - arn
```
public com.pulumi.core.Output<java.lang.String> arn()
```
    Returns:
    
    ARN of the key.
  - bypassPolicyLockoutSafetyCheck
```
public com.pulumi.core.Output<java.util.Optional<java.lang.Boolean>> bypassPolicyLockoutSafetyCheck()
```
    Returns:
    
    Whether to disable the policy lockout check performed when creating or updating the key's policy. Setting this value to `true` increases the risk that the key becomes unmanageable. For more information, refer to the scenario in the [Default Key Policy](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam) section in the KMS Developer Guide. Defaults to `false`.
  - deletionWindowInDays
```
public com.pulumi.core.Output<java.util.Optional<java.lang.Integer>> deletionWindowInDays()
```
    Returns:
    
    Duration in days after which the key is deleted after destruction of the resource. Must be between `7` and `30` days. Defaults to `30`.
  - description
```
public com.pulumi.core.Output<java.util.Optional<java.lang.String>> description()
```
    Returns:
    
    Description of the key.
  - enabled
```
public com.pulumi.core.Output<java.lang.Boolean> enabled()
```
    Returns:
    
    Whether the key is enabled. Keys pending import can only be `false`. Imported keys default to `true` unless expired.
  - expirationModel
```
public com.pulumi.core.Output<java.lang.String> expirationModel()
```
    Returns:
    
    Whether the key material expires. Empty when pending key material import, otherwise `KEY_MATERIAL_EXPIRES` or `KEY_MATERIAL_DOES_NOT_EXPIRE`.
  - keyMaterialBase64
```
public com.pulumi.core.Output<java.util.Optional<java.lang.String>> keyMaterialBase64()
```
    Returns:
    
    Base64 encoded 256-bit symmetric encryption key material to import. The CMK is permanently associated with this key material. The same key material can be reimported, but you cannot import different key material.
  - keySpec
```
public com.pulumi.core.Output<java.lang.String> keySpec()
```
    Returns:
    
    Whether the key contains a symmetric key or an asymmetric key pair and the encryption algorithms or signing algorithms that the key supports. Valid values: `SYMMETRIC_DEFAULT`, `RSA_2048`, `RSA_3072`, `RSA_4096`, `HMAC_224`, `HMAC_256`, `HMAC_384`, `HMAC_512`, `ECC_NIST_P256`, `ECC_NIST_P384`, `ECC_NIST_P521`, `ECC_SECG_P256K1`, `ML_DSA_44`, `ML_DSA_65`, `ML_DSA_87`, or `SM2` (China Regions only). Defaults to `SYMMETRIC_DEFAULT`. For help with choosing a key spec, see the [AWS KMS Developer Guide](https://docs.aws.amazon.com/kms/latest/developerguide/symm-asymm-choose.html).
  - keyState
```
public com.pulumi.core.Output<java.lang.String> keyState()
```
    Returns:
    
    State of the CMK.
  - keyUsage
```
public com.pulumi.core.Output<java.lang.String> keyUsage()
```
    Returns:
    
    Intended use of the key. Valid values: `ENCRYPT_DECRYPT`, `SIGN_VERIFY`, or `GENERATE_VERIFY_MAC`. Defaults to `ENCRYPT_DECRYPT`.
  - multiRegion
```
public com.pulumi.core.Output<java.lang.Boolean> multiRegion()
```
    Returns:
    
    Whether the KMS key is a multi-Region (`true`) or regional (`false`) key. Defaults to `false`.
  - policy
```
public com.pulumi.core.Output<java.lang.String> policy()
```
    Returns:
    
    Key policy JSON document. If you do not provide a key policy, AWS KMS attaches a default key policy to the CMK.
  - region
```
public com.pulumi.core.Output<java.lang.String> region()
```
    Returns:
    
    Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
  - tags
```
public com.pulumi.core.Output<java.util.Optional<java.util.Map<java.lang.String,java.lang.String>>> tags()
```
    Returns:
    
    Key-value map of tags to assign to the key. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
  - tagsAll
```
public com.pulumi.core.Output<java.util.Map<java.lang.String,java.lang.String>> tagsAll()
```
    Returns:
    
    Map of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block.
  - validTo
```
public com.pulumi.core.Output<java.util.Optional<java.lang.String>> validTo()
```
    Returns:
    
    Time at which the imported key material expires. When the key material expires, AWS KMS deletes the key material and the CMK becomes unusable. If not specified, key material does not expire. Valid values: [RFC3339 time string](https://tools.ietf.org/html/rfc3339#section-5.8) (`YYYY-MM-DDTHH:MM:SSZ`)
  - get
```
public static ExternalKey get(java.lang.String name,
                              com.pulumi.core.Output<java.lang.String> id,
                              @Nullable
                              ExternalKeyState state,
                              @Nullable
                              com.pulumi.resources.CustomResourceOptions options)
```
    Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.
    
    Parameters:
    
    name - The _unique_ name of the resulting resource.
    
    id - The _unique_ provider ID of the resource to lookup.
    
    state -
    
    options - Optional settings to control the behavior of the CustomResource.

Class ExternalKey

Nested Class Summary

Nested classes/interfaces inherited from class com.pulumi.resources.CustomResource

Nested classes/interfaces inherited from class com.pulumi.resources.Resource

Field Summary

Fields inherited from class com.pulumi.resources.Resource

Constructor Summary

Method Summary

Methods inherited from class com.pulumi.resources.CustomResource

Methods inherited from class com.pulumi.resources.Resource

Methods inherited from class java.lang.Object

Constructor Detail

ExternalKey

ExternalKey

ExternalKey

Method Detail

arn

bypassPolicyLockoutSafetyCheck

deletionWindowInDays

description

enabled

expirationModel

keyMaterialBase64

keySpec

keyState

keyUsage

multiRegion

policy

region

tags

tagsAll

validTo

get