https://github.com/infrahouse/terraform-aws-key
Terraform module for AWS KMS encryption keys with configurable key policies, key rotation, aliases, and cross-account access grants.
https://github.com/infrahouse/terraform-aws-key
aws encryption infrahouse kms security terraform terraform-module
Last synced: 5 months ago
JSON representation
Terraform module for AWS KMS encryption keys with configurable key policies, key rotation, aliases, and cross-account access grants.
- Host: GitHub
- URL: https://github.com/infrahouse/terraform-aws-key
- Owner: infrahouse
- License: apache-2.0
- Created: 2025-07-31T21:41:37.000Z (12 months ago)
- Default Branch: main
- Last Pushed: 2026-02-20T01:16:48.000Z (5 months ago)
- Last Synced: 2026-02-20T05:06:20.473Z (5 months ago)
- Topics: aws, encryption, infrahouse, kms, security, terraform, terraform-module
- Language: Python
- Homepage: https://infrahouse.github.io/terraform-aws-key
- Size: 125 KB
- Stars: 0
- Watchers: 0
- Forks: 1
- Open Issues: 6
-
Metadata Files:
- Readme: README.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
- Security: SECURITY.md
Awesome Lists containing this project
README
# terraform-aws-key
[](https://infrahouse.com/contact)
[](https://infrahouse.github.io/terraform-aws-key/)
[](https://registry.terraform.io/modules/infrahouse/key/aws/latest)
[](https://github.com/infrahouse/terraform-aws-key/releases/latest)
[](https://aws.amazon.com/kms/)
[](https://github.com/infrahouse/terraform-aws-key/actions/workflows/vuln-scanner-pr.yml)
[](LICENSE)
## Why This Module?
AWS KMS key management involves creating the key, setting up an alias, configuring a key policy,
and enabling automatic rotation. This module wraps all of that into a single resource with
a clean interface for granting encrypt and/or decrypt permissions to IAM roles.
It also supports **split permissions** — granting encrypt-only or decrypt-only access to
different roles — which is essential for least-privilege architectures where producers
write encrypted data and consumers read it, without either having both capabilities.
## Features
- Creates a KMS key with automatic annual key rotation enabled
- Creates a KMS alias for human-readable key references
- Configurable key policy via IAM role ARN lists
- Split encrypt/decrypt permissions (`key_encrypt_only_users`, `key_decrypt_only_users`)
- Full encrypt+decrypt access via `key_users`
- Root account retains full key management access
- Supports AWS provider versions 5 and 6
- Standard InfraHouse tagging (environment, service, created_by_module, module_version)
## Quick Start
```hcl
module "encryption_key" {
source = "registry.infrahouse.com/infrahouse/key/aws"
version = "0.3.0"
environment = "production"
service_name = "my-app"
key_name = "my-app-data"
key_description = "Encryption key for my-app data at rest"
key_users = [
"arn:aws:iam::123456789012:role/my-app-role"
]
}
```
### Envelope Encryption Example
```python
import boto3
kms = boto3.client("kms")
key_arn = "arn:aws:kms:us-west-2:123456789012:key/..."
# Encrypt
response = kms.encrypt(KeyId=key_arn, Plaintext=b"Hello world")
ciphertext = response["CiphertextBlob"]
# Decrypt
response = kms.decrypt(CiphertextBlob=ciphertext)
plaintext = response["Plaintext"] # b"Hello world"
```
## Documentation
Full documentation is available at
[infrahouse.github.io/terraform-aws-key](https://infrahouse.github.io/terraform-aws-key/).
- [Getting Started](https://infrahouse.github.io/terraform-aws-key/getting-started/)
- [Configuration](https://infrahouse.github.io/terraform-aws-key/configuration/)
- [Architecture](https://infrahouse.github.io/terraform-aws-key/architecture/)
- [Examples](https://infrahouse.github.io/terraform-aws-key/examples/)
- [Troubleshooting](https://infrahouse.github.io/terraform-aws-key/troubleshooting/)
## Requirements
| Name | Version |
|------|---------|
| [aws](#requirement\_aws) | >= 5.62, < 7.0 |
## Providers
| Name | Version |
|------|---------|
| [aws](#provider\_aws) | >= 5.62, < 7.0 |
## Modules
No modules.
## Resources
| Name | Type |
|------|------|
| [aws_kms_alias.alias](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_alias) | resource |
| [aws_kms_key.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
| [aws_iam_policy_document.key_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
## Inputs
| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| [environment](#input\_environment) | Environment name string. | `string` | n/a | yes |
| [key\_decrypt\_only\_users](#input\_key\_decrypt\_only\_users) | A list of IAM role ARNs that are allowed to decrypt with the key but not encrypt.
If a role appears in both this list and key\_encrypt\_only\_users, it will effectively
have full encrypt+decrypt access (equivalent to key\_users). | `list(string)` | `null` | no |
| [key\_description](#input\_key\_description) | A human readable description for the key. | `string` | n/a | yes |
| [key\_encrypt\_only\_users](#input\_key\_encrypt\_only\_users) | A list of IAM role ARNs that are allowed to encrypt with the key but not decrypt.
If a role appears in both this list and key\_decrypt\_only\_users, it will effectively
have full encrypt+decrypt access (equivalent to key\_users). | `list(string)` | `null` | no |
| [key\_name](#input\_key\_name) | A descriptive one word name for the key. Letters, digits, and \_-/ are allowed. | `string` | n/a | yes |
| [key\_users](#input\_key\_users) | A list of IAM role ARNs that are allowed to use the key for both encrypt and decrypt. | `list(string)` | `null` | no |
| [service\_name](#input\_service\_name) | A descriptive name for the service that owns the key. | `string` | n/a | yes |
| [tags](#input\_tags) | A map of tags to add to resources. | `map(string)` | `{}` | no |
## Outputs
| Name | Description |
|------|-------------|
| [kms\_key\_arn](#output\_kms\_key\_arn) | The Amazon Resource Name (ARN) of the KMS key created by this module. |
## Contributing
See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
## License
[Apache 2.0](LICENSE)