{"id":39493541,"url":"https://github.com/infrahouse/terraform-aws-key","last_synced_at":"2026-02-23T05:09:18.482Z","repository":{"id":307576952,"uuid":"1029966480","full_name":"infrahouse/terraform-aws-key","owner":"infrahouse","description":"Terraform module for AWS KMS encryption keys with configurable key policies, key rotation, aliases, and cross-account access grants. ","archived":false,"fork":false,"pushed_at":"2026-02-20T01:16:48.000Z","size":128,"stargazers_count":0,"open_issues_count":6,"forks_count":1,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-02-20T05:06:20.473Z","etag":null,"topics":["aws","encryption","infrahouse","kms","security","terraform","terraform-module"],"latest_commit_sha":null,"homepage":"https://infrahouse.github.io/terraform-aws-key","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/infrahouse.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-07-31T21:41:37.000Z","updated_at":"2026-02-20T01:16:53.000Z","dependencies_parsed_at":"2025-10-01T20:17:31.312Z","dependency_job_id":"69dc5244-c0ac-411c-9a4c-881215b3dd0d","html_url":"https://github.com/infrahouse/terraform-aws-key","commit_stats":null,"previous_names":["infrahouse/terraform-aws-key"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/infrahouse/terraform-aws-key","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/infrahouse%2Fterraform-aws-key","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/infrahouse%2Fterraform-aws-key/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/infrahouse%2Fterraform-aws-key/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/infrahouse%2Fterraform-aws-key/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/infrahouse","download_url":"https://codeload.github.com/infrahouse/terraform-aws-key/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/infrahouse%2Fterraform-aws-key/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29738083,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-23T04:51:08.365Z","status":"ssl_error","status_checked_at":"2026-02-23T04:49:15.865Z","response_time":90,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","encryption","infrahouse","kms","security","terraform","terraform-module"],"created_at":"2026-01-18T05:38:50.780Z","updated_at":"2026-02-23T05:09:18.476Z","avatar_url":"https://github.com/infrahouse.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# terraform-aws-key\n\n[![Need Help?](https://img.shields.io/badge/Need%20Help%3F-Contact%20Us-0066CC)](https://infrahouse.com/contact)\n[![Docs](https://img.shields.io/badge/docs-github.io-blue)](https://infrahouse.github.io/terraform-aws-key/)\n[![Registry](https://img.shields.io/badge/Terraform-Registry-purple?logo=terraform)](https://registry.terraform.io/modules/infrahouse/key/aws/latest)\n[![Release](https://img.shields.io/github/release/infrahouse/terraform-aws-key.svg)](https://github.com/infrahouse/terraform-aws-key/releases/latest)\n[![AWS KMS](https://img.shields.io/badge/AWS-KMS-orange?logo=amazonwebservices)](https://aws.amazon.com/kms/)\n[![Security](https://img.shields.io/github/actions/workflow/status/infrahouse/terraform-aws-key/vuln-scanner-pr.yml?label=Security)](https://github.com/infrahouse/terraform-aws-key/actions/workflows/vuln-scanner-pr.yml)\n[![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](LICENSE)\n\n## Why This Module?\n\nAWS KMS key management involves creating the key, setting up an alias, configuring a key policy,\nand enabling automatic rotation. This module wraps all of that into a single resource with\na clean interface for granting encrypt and/or decrypt permissions to IAM roles.\n\nIt also supports **split permissions** — granting encrypt-only or decrypt-only access to\ndifferent roles — which is essential for least-privilege architectures where producers\nwrite encrypted data and consumers read it, without either having both capabilities.\n\n## Features\n\n- Creates a KMS key with automatic annual key rotation enabled\n- Creates a KMS alias for human-readable key references\n- Configurable key policy via IAM role ARN lists\n- Split encrypt/decrypt permissions (`key_encrypt_only_users`, `key_decrypt_only_users`)\n- Full encrypt+decrypt access via `key_users`\n- Root account retains full key management access\n- Supports AWS provider versions 5 and 6\n- Standard InfraHouse tagging (environment, service, created_by_module, module_version)\n\n## Quick Start\n\n```hcl\nmodule \"encryption_key\" {\n  source  = \"registry.infrahouse.com/infrahouse/key/aws\"\n  version = \"0.3.0\"\n\n  environment     = \"production\"\n  service_name    = \"my-app\"\n  key_name        = \"my-app-data\"\n  key_description = \"Encryption key for my-app data at rest\"\n  key_users       = [\n    \"arn:aws:iam::123456789012:role/my-app-role\"\n  ]\n}\n```\n\n### Envelope Encryption Example\n\n```python\nimport boto3\n\nkms = boto3.client(\"kms\")\nkey_arn = \"arn:aws:kms:us-west-2:123456789012:key/...\"\n\n# Encrypt\nresponse = kms.encrypt(KeyId=key_arn, Plaintext=b\"Hello world\")\nciphertext = response[\"CiphertextBlob\"]\n\n# Decrypt\nresponse = kms.decrypt(CiphertextBlob=ciphertext)\nplaintext = response[\"Plaintext\"]  # b\"Hello world\"\n```\n\n## Documentation\n\nFull documentation is available at\n[infrahouse.github.io/terraform-aws-key](https://infrahouse.github.io/terraform-aws-key/).\n\n- [Getting Started](https://infrahouse.github.io/terraform-aws-key/getting-started/)\n- [Configuration](https://infrahouse.github.io/terraform-aws-key/configuration/)\n- [Architecture](https://infrahouse.github.io/terraform-aws-key/architecture/)\n- [Examples](https://infrahouse.github.io/terraform-aws-key/examples/)\n- [Troubleshooting](https://infrahouse.github.io/terraform-aws-key/troubleshooting/)\n\n\u003c!-- BEGIN_TF_DOCS --\u003e\n\n## Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_aws\"\u003e\u003c/a\u003e [aws](#requirement\\_aws) | \u003e= 5.62, \u003c 7.0 |\n\n## Providers\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"provider_aws\"\u003e\u003c/a\u003e [aws](#provider\\_aws) | \u003e= 5.62, \u003c 7.0 |\n\n## Modules\n\nNo modules.\n\n## Resources\n\n| Name | Type |\n|------|------|\n| [aws_kms_alias.alias](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_alias) | resource |\n| [aws_kms_key.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |\n| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |\n| [aws_iam_policy_document.key_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_environment\"\u003e\u003c/a\u003e [environment](#input\\_environment) | Environment name string. | `string` | n/a | yes |\n| \u003ca name=\"input_key_decrypt_only_users\"\u003e\u003c/a\u003e [key\\_decrypt\\_only\\_users](#input\\_key\\_decrypt\\_only\\_users) | A list of IAM role ARNs that are allowed to decrypt with the key but not encrypt.\u003cbr/\u003eIf a role appears in both this list and key\\_encrypt\\_only\\_users, it will effectively\u003cbr/\u003ehave full encrypt+decrypt access (equivalent to key\\_users). | `list(string)` | `null` | no |\n| \u003ca name=\"input_key_description\"\u003e\u003c/a\u003e [key\\_description](#input\\_key\\_description) | A human readable description for the key. | `string` | n/a | yes |\n| \u003ca name=\"input_key_encrypt_only_users\"\u003e\u003c/a\u003e [key\\_encrypt\\_only\\_users](#input\\_key\\_encrypt\\_only\\_users) | A list of IAM role ARNs that are allowed to encrypt with the key but not decrypt.\u003cbr/\u003eIf a role appears in both this list and key\\_decrypt\\_only\\_users, it will effectively\u003cbr/\u003ehave full encrypt+decrypt access (equivalent to key\\_users). | `list(string)` | `null` | no |\n| \u003ca name=\"input_key_name\"\u003e\u003c/a\u003e [key\\_name](#input\\_key\\_name) | A descriptive one word name for the key. Letters, digits, and \\_-/ are allowed. | `string` | n/a | yes |\n| \u003ca name=\"input_key_users\"\u003e\u003c/a\u003e [key\\_users](#input\\_key\\_users) | A list of IAM role ARNs that are allowed to use the key for both encrypt and decrypt. | `list(string)` | `null` | no |\n| \u003ca name=\"input_service_name\"\u003e\u003c/a\u003e [service\\_name](#input\\_service\\_name) | A descriptive name for the service that owns the key. | `string` | n/a | yes |\n| \u003ca name=\"input_tags\"\u003e\u003c/a\u003e [tags](#input\\_tags) | A map of tags to add to resources. | `map(string)` | `{}` | no |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_kms_key_arn\"\u003e\u003c/a\u003e [kms\\_key\\_arn](#output\\_kms\\_key\\_arn) | The Amazon Resource Name (ARN) of the KMS key created by this module. |\n\u003c!-- END_TF_DOCS --\u003e\n\n## Contributing\n\nSee [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.\n\n## License\n\n[Apache 2.0](LICENSE)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Finfrahouse%2Fterraform-aws-key","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Finfrahouse%2Fterraform-aws-key","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Finfrahouse%2Fterraform-aws-key/lists"}