AwsKms

Service-level AWS KMS component.

Remarks

This is the primary component resource for the package. It can orchestrate key creation with its policy and alias, alias creation for an existing key, or key policy management for an existing key through one service-level component boundary.

Every key created through the key capability has its description fixed to ${project}-${stack} from the Pulumi runtime context and remains enabled. Omitting key.policy creates the default account-root policy. When a custom policy is supplied, an existing Enable IAM User Permissions statement is retained unchanged; otherwise, the canonical account-root allow statement is prepended.

Naming:

• Root type ${namespace}:aws:AwsKms uses literal capability kms and logical-only args.identity through buildComponentLogicalName(...): ${env}-${projectHash}-kms-${sanitised args.identity}. Punctuation-only identities are rejected because the shared builder requires an ASCII alphanumeric character.
• Qualified child type aws:kms/key:Key uses tuple [args.identity] for the key path, yielding ${env}-${projectHash}-${sanitised args.identity}.
• Qualified child type aws:kms/alias:Alias uses tuple [args.identity] for the alias and key paths, yielding ${env}-${projectHash}-${sanitised args.identity}.
• Qualified child type aws:kms/keyPolicy:KeyPolicy uses tuple [args.identity] for the keyPolicy and key paths, yielding ${env}-${projectHash}-${sanitised args.identity}.
• The KMS key and key policy have provider-generated identifiers. Exception: the KMS alias uses alias/${env}-${projectHash} from stackOnly, with no purpose because one alias exists per project/environment. Intentional.

Example

const key = new AwsKms({
  identity: 'application-kms',
  key: {},
});

Constructors

new AwsKms( args: AwsKmsArgs, options?: ComponentResourceOptions, ): AwsKms

Parameters

• args (AwsKmsArgs) — Service-level KMS capability inputs.
• options (ComponentResourceOptions, optional) — Optional settings controlling resource behaviour.

Returns

AwsKms

Hierarchy

• ComponentResource
• AwsKms

Properties

aliasArn: Output<string> | undefined

ARN of the alias created by the key or alias capability.

aliasName: Output<string> | undefined

Name of the alias created by the key or alias capability.

keyArn: Output<string>

ARN of the KMS key represented by the active capability.

keyId: Output<string> | undefined

ID of a key created by the key capability.

policy: Output<string> | undefined

Rendered policy created by the key or keyPolicy capability.

urn: Output<string>

Inherited from urn

The stable logical URN used to distinctly address a resource, both before and after deployments.

Methods

getData(): Promise<any>

Inherited from getData

Retrieves the data produces by initialize. The data is immediately available in a derived class's constructor after the super(...) call to ComponentResource.

Returns

• Promise<any>

getProvider(moduleMember: string): ProviderResource | undefined

Inherited from getProvider

Returns the provider for the given module member, if one exists.

Parameters

• moduleMember (string)

Returns

• ProviderResource | undefined

initialize( args: Inputs, opts?: ComponentResourceOptions, name?: string, type?: string, ): Promise<any>

Inherited from initialize

Can be overridden by a subclass to asynchronously initialize data for this component automatically when constructed. The data will be available immediately for subclass constructors to use. To access the data use getData.

Parameters

• args (Inputs)
• opts (ComponentResourceOptions, optional)
• name (string, optional)
• type (string, optional)

Returns

• Promise<any>

registerOutputs( outputs?: Inputs | Promise<Inputs> | Output<Inputs>, ): void

Inherited from registerOutputs

Registers synthetic outputs that a component has initialized, usually by allocating other child sub-resources and propagating their resulting property values.

Component resources can call this at the end of their constructor to indicate that they are done creating child resources. This is not strictly necessary as this will automatically be called after the initialize method completes.

Parameters

• outputs (Inputs | Promise<Inputs> | Output<Inputs>, optional)

Returns

• void

Static Methods

isInstance(obj: any): obj is ComponentResource<any>

Inherited from isInstance

Returns true if the given object is a CustomResource. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

Parameters

• obj (any)

Returns

• obj is ComponentResource<any>