Package com.pulumi.aws.kms

Class KeyArgs.Builder

  • Enclosing class:
    KeyArgs
    public static final class KeyArgs.Builder
extends java.lang.Object

    • Constructor Detail

      • Builder

        public Builder()

      • Builder

        public Builder​(KeyArgs defaults)

    • Method Detail

      • bypassPolicyLockoutSafetyCheck

        public KeyArgs.Builder bypassPolicyLockoutSafetyCheck​(@Nullable
                                                      com.pulumi.core.Output<java.lang.Boolean> bypassPolicyLockoutSafetyCheck)
        Parameters:
        bypassPolicyLockoutSafetyCheck - Whether to bypass the key policy lockout safety check. Setting this value to true increases the risk that the KMS key becomes unmanageable. Do not set this value to true indiscriminately. For more information, refer to the scenario in the [Default Key Policy](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam) section in the _AWS KMS Developer Guide_. The default value is `false`.
        Returns:
        builder

      • bypassPolicyLockoutSafetyCheck

        public KeyArgs.Builder bypassPolicyLockoutSafetyCheck​(java.lang.Boolean bypassPolicyLockoutSafetyCheck)
        Parameters:
        bypassPolicyLockoutSafetyCheck - Whether to bypass the key policy lockout safety check. Setting this value to true increases the risk that the KMS key becomes unmanageable. Do not set this value to true indiscriminately. For more information, refer to the scenario in the [Default Key Policy](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam) section in the _AWS KMS Developer Guide_. The default value is `false`.
        Returns:
        builder

      • customKeyStoreId

        public KeyArgs.Builder customKeyStoreId​(@Nullable
                                        com.pulumi.core.Output<java.lang.String> customKeyStoreId)
        Parameters:
        customKeyStoreId - ID of the KMS [Custom Key Store](https://docs.aws.amazon.com/kms/latest/developerguide/create-cmk-keystore.html) where the key will be stored instead of KMS (eg CloudHSM).
        Returns:
        builder

      • customKeyStoreId

        public KeyArgs.Builder customKeyStoreId​(java.lang.String customKeyStoreId)
        Parameters:
        customKeyStoreId - ID of the KMS [Custom Key Store](https://docs.aws.amazon.com/kms/latest/developerguide/create-cmk-keystore.html) where the key will be stored instead of KMS (eg CloudHSM).
        Returns:
        builder

      • customerMasterKeySpec

        public KeyArgs.Builder customerMasterKeySpec​(@Nullable
                                             com.pulumi.core.Output<java.lang.String> customerMasterKeySpec)
        Parameters:
        customerMasterKeySpec - Whether the key contains a symmetric key or an asymmetric key pair and the encryption algorithms or signing algorithms that the key supports. Valid values: `SYMMETRIC_DEFAULT`, `RSA_2048`, `RSA_3072`, `RSA_4096`, `HMAC_224`, `HMAC_256`, `HMAC_384`, `HMAC_512`, `ECC_NIST_P256`, `ECC_NIST_P384`, `ECC_NIST_P521`, `ECC_SECG_P256K1`, `ML_DSA_44`, `ML_DSA_65`, `ML_DSA_87`, `SM2` (China Regions only), or `ECC_NIST_EDWARDS25519`. Defaults to `SYMMETRIC_DEFAULT`. For help with choosing a key spec, see the [AWS KMS Developer Guide](https://docs.aws.amazon.com/kms/latest/developerguide/symm-asymm-choose.html).
        Returns:
        builder

      • customerMasterKeySpec

        public KeyArgs.Builder customerMasterKeySpec​(java.lang.String customerMasterKeySpec)
        Parameters:
        customerMasterKeySpec - Whether the key contains a symmetric key or an asymmetric key pair and the encryption algorithms or signing algorithms that the key supports. Valid values: `SYMMETRIC_DEFAULT`, `RSA_2048`, `RSA_3072`, `RSA_4096`, `HMAC_224`, `HMAC_256`, `HMAC_384`, `HMAC_512`, `ECC_NIST_P256`, `ECC_NIST_P384`, `ECC_NIST_P521`, `ECC_SECG_P256K1`, `ML_DSA_44`, `ML_DSA_65`, `ML_DSA_87`, `SM2` (China Regions only), or `ECC_NIST_EDWARDS25519`. Defaults to `SYMMETRIC_DEFAULT`. For help with choosing a key spec, see the [AWS KMS Developer Guide](https://docs.aws.amazon.com/kms/latest/developerguide/symm-asymm-choose.html).
        Returns:
        builder

      • deletionWindowInDays

        public KeyArgs.Builder deletionWindowInDays​(@Nullable
                                            com.pulumi.core.Output<java.lang.Integer> deletionWindowInDays)
        Parameters:
        deletionWindowInDays - Waiting period, specified in number of days. After the waiting period ends, AWS KMS deletes the KMS key. If you specify a value, it must be between `7` and `30`, inclusive. If you do not specify a value, it defaults to `30`. If the KMS key is a multi-Region primary key with replicas, the waiting period begins when the last of its replica keys is deleted. Otherwise, the waiting period begins immediately.
        Returns:
        builder

      • deletionWindowInDays

        public KeyArgs.Builder deletionWindowInDays​(java.lang.Integer deletionWindowInDays)
        Parameters:
        deletionWindowInDays - Waiting period, specified in number of days. After the waiting period ends, AWS KMS deletes the KMS key. If you specify a value, it must be between `7` and `30`, inclusive. If you do not specify a value, it defaults to `30`. If the KMS key is a multi-Region primary key with replicas, the waiting period begins when the last of its replica keys is deleted. Otherwise, the waiting period begins immediately.
        Returns:
        builder

      • description

        public KeyArgs.Builder description​(@Nullable
                                   com.pulumi.core.Output<java.lang.String> description)
        Parameters:
        description - Description of the key as viewed in AWS console.
        Returns:
        builder

      • description

        public KeyArgs.Builder description​(java.lang.String description)
        Parameters:
        description - Description of the key as viewed in AWS console.
        Returns:
        builder

      • enableKeyRotation

        public KeyArgs.Builder enableKeyRotation​(@Nullable
                                         com.pulumi.core.Output<java.lang.Boolean> enableKeyRotation)
        Parameters:
        enableKeyRotation - Whether [key rotation](http://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html) is enabled. Defaults to `false`.
        Returns:
        builder

      • enableKeyRotation

        public KeyArgs.Builder enableKeyRotation​(java.lang.Boolean enableKeyRotation)
        Parameters:
        enableKeyRotation - Whether [key rotation](http://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html) is enabled. Defaults to `false`.
        Returns:
        builder

      • isEnabled

        public KeyArgs.Builder isEnabled​(@Nullable
                                 com.pulumi.core.Output<java.lang.Boolean> isEnabled)
        Parameters:
        isEnabled - Whether the key is enabled. Defaults to `true`.
        Returns:
        builder

      • isEnabled

        public KeyArgs.Builder isEnabled​(java.lang.Boolean isEnabled)
        Parameters:
        isEnabled - Whether the key is enabled. Defaults to `true`.
        Returns:
        builder

      • keyUsage

        public KeyArgs.Builder keyUsage​(@Nullable
                                com.pulumi.core.Output<java.lang.String> keyUsage)
        Parameters:
        keyUsage - Intended use of the key. Valid values: `ENCRYPT_DECRYPT`, `SIGN_VERIFY`, or `GENERATE_VERIFY_MAC`. Defaults to `ENCRYPT_DECRYPT`.
        Returns:
        builder

      • keyUsage

        public KeyArgs.Builder keyUsage​(java.lang.String keyUsage)
        Parameters:
        keyUsage - Intended use of the key. Valid values: `ENCRYPT_DECRYPT`, `SIGN_VERIFY`, or `GENERATE_VERIFY_MAC`. Defaults to `ENCRYPT_DECRYPT`.
        Returns:
        builder

      • multiRegion

        public KeyArgs.Builder multiRegion​(@Nullable
                                   com.pulumi.core.Output<java.lang.Boolean> multiRegion)
        Parameters:
        multiRegion - Whether the KMS key is a multi-Region (`true`) or regional (`false`) key. Defaults to `false`.
        Returns:
        builder

      • multiRegion

        public KeyArgs.Builder multiRegion​(java.lang.Boolean multiRegion)
        Parameters:
        multiRegion - Whether the KMS key is a multi-Region (`true`) or regional (`false`) key. Defaults to `false`.
        Returns:
        builder

      • policy

        public KeyArgs.Builder policy​(@Nullable
                              com.pulumi.core.Output<java.lang.String> policy)
        Parameters:
        policy - Valid policy JSON document. Although this is a key policy, not an IAM policy, an `aws.iam.getPolicyDocument`, in the form that designates a principal, can be used. For more information about building policy documents with Terraform, see the AWS IAM Policy Document Guide.
        Returns:
        builder

      • policy

        public KeyArgs.Builder policy​(java.lang.String policy)
        Parameters:
        policy - Valid policy JSON document. Although this is a key policy, not an IAM policy, an `aws.iam.getPolicyDocument`, in the form that designates a principal, can be used. For more information about building policy documents with Terraform, see the AWS IAM Policy Document Guide.
        Returns:
        builder

      • region

        public KeyArgs.Builder region​(@Nullable
                              com.pulumi.core.Output<java.lang.String> region)
        Parameters:
        region - Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
        Returns:
        builder

      • region

        public KeyArgs.Builder region​(java.lang.String region)
        Parameters:
        region - Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
        Returns:
        builder

      • rotationPeriodInDays

        public KeyArgs.Builder rotationPeriodInDays​(@Nullable
                                            com.pulumi.core.Output<java.lang.Integer> rotationPeriodInDays)
        Parameters:
        rotationPeriodInDays - Custom period of time between each rotation date. Must be a number between 90 and 2560 (inclusive).
        Returns:
        builder

      • rotationPeriodInDays

        public KeyArgs.Builder rotationPeriodInDays​(java.lang.Integer rotationPeriodInDays)
        Parameters:
        rotationPeriodInDays - Custom period of time between each rotation date. Must be a number between 90 and 2560 (inclusive).
        Returns:
        builder

      • tags

        public KeyArgs.Builder tags​(@Nullable
                            com.pulumi.core.Output<java.util.Map<java.lang.String,​java.lang.String>> tags)
        Parameters:
        tags - Map of tags to assign to the object. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
        Returns:
        builder

      • tags

        public KeyArgs.Builder tags​(java.util.Map<java.lang.String,​java.lang.String> tags)
        Parameters:
        tags - Map of tags to assign to the object. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
        Returns:
        builder

      • xksKeyId

        public KeyArgs.Builder xksKeyId​(@Nullable
                                com.pulumi.core.Output<java.lang.String> xksKeyId)
        Parameters:
        xksKeyId - External key that serves as key material for the KMS key in an external key store. > **NOTE:** Note: All KMS keys must have a key policy. If a key policy is not specified, AWS gives the KMS key a [default key policy](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default) that gives all principals in the owning account unlimited access to all KMS operations for the key. This default key policy effectively delegates all access control to IAM policies and KMS grants.
        Returns:
        builder

      • xksKeyId

        public KeyArgs.Builder xksKeyId​(java.lang.String xksKeyId)
        Parameters:
        xksKeyId - External key that serves as key material for the KMS key in an external key store. > **NOTE:** Note: All KMS keys must have a key policy. If a key policy is not specified, AWS gives the KMS key a [default key policy](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default) that gives all principals in the owning account unlimited access to all KMS operations for the key. This default key policy effectively delegates all access control to IAM policies and KMS grants.
        Returns:
        builder