rvn-aws-kms · Latest version: 0.1.0
Readme
Creates a regional symmetric AWS KMS encryption key and stable alias.Overview
Use this module to create one customer-managed key for application data, secrets, storage, and envelope encryption. The key uses the standard AWS KMS symmetric encryption configuration and receives a stable alias derived from the key name. The module creates a key policy that preserves account-root IAM administration and can grant encryption access directly to selected IAM principals. The key can be created before its consumers because the key user list may be empty.Use cases
Encryption defaults
The standard form creates a regionalSYMMETRIC_DEFAULT key with ENCRYPT_DECRYPT usage. Annual automatic rotation is enabled, and the deletion waiting period is 30 days. The alias defaults to alias/<key name>, and the generated key description also uses the key name.
Specialized settings such as asymmetric keys, signing, HMAC, key agreement, custom aliases, multi-Region keys, key administrators, signers, public key readers, rotation changes, and shorter deletion windows remain available through Advanced Terraform variables.
Key access
Key user principal ARNs grants the selected account roots, IAM roles, or IAM users permission to encrypt, decrypt, re-encrypt, generate data keys, and describe the key. Keep the list as narrow as possible. The account root principal remains in the key policy withkms:*, following the AWS pattern that allows IAM policies in the account to delegate administration. A principal may require both a key policy grant and an IAM identity policy, depending on how access is managed in the account.
Configuration
Design decisions
The standard form deliberately targets regional symmetric encryption, which covers the common customer-managed key use case without exposing uncommon cryptographic or lifecycle controls. Advanced Terraform variables remain available for exceptional requirements. The module always creates an alias so consumers can use a stable, readable identifier. Key name, AWS account, and Region are immutable in Ravion because changing them alters key identity or deployment target. Ravion adds standard tags for ownership and traceability. User-provided Tags are merged on top for team, cost, or environment metadata.Learn more
Inputs reference
All inputs forrvn-aws-kms version 0.1.0. Use the name shown for each field as the input key in module config.
AWS account & region
string
required
AWS account.
- Immutable after creation
string
required
Region.
- Immutable after creation
KMS key
string
required
Key name. Name used for the key’s default alias, description, and tags.
- Default:
<<project.given_id>>-<<environment.given_id>>-<<module.given_id>> - Immutable after creation
- Pattern:
^[A-Za-z0-9/_-]{1,64}$— 1-64 letters, numbers, slashes, underscores, or hyphens.
Key access
string_array
Key user principal ARNs. IAM principals allowed to encrypt, decrypt, re-encrypt, generate data keys, and describe the key.
- Default:
[] - Pattern:
^arn:aws(-us-gov|-cn|-iso|-iso-b|-iso-e|-iso-f)?:iam::[0-9]{12}:(root|(role|user)/[!-~]*[A-Za-z0-9+=,.@_-])$— Invalid IAM principal ARN. Use an account root, role, or user ARN with a 12-digit account ID.
Misc
keyvalue
Tags. A map of tags to assign to all resources. Default tags are
Owner, ProjectGivenId, EnvironmentGivenId, ModuleGivenId, ModuleIdTerraform settings
string
OpenTofu version override. Override the environment’s default version for this module
string
Ravion Terraform workspace name. Override Terraform state backend workspace name. Defaults to project + environment + module given ids.
- Immutable after creation
object
Advanced Terraform variables. Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above.
- Default:
{}
string
Terraform execution environment. Override the execution environment for Terraform runners. Must use the same AWS account as selected above.