terraform-aws-encryption-kms¶
A small, focused OpenTofu / Terraform module that
provisions the AWS half of an OpenPGP identity which can receive
encrypted mail — the counterpart to
terraform-aws-signing-kms,
which can only ever sign.
Use it wherever you publish an OpenPGP certificate that anyone can encrypt
to — a security.txt contact, a confidential intake address, a
whistleblowing channel — and where:
- The private key material never leaves AWS KMS.
- No CI pipeline can decrypt anything — there is deliberately no OIDC trust in this module at all.
- The apply role can neither decrypt a message nor re-certify the identity, even on full compromise of the runner.
- Decrypting and re-certifying the identity are separate roles.
The one thing to know first¶
An RSA KMS key cannot decrypt OpenPGP at all. OpenPGP encrypts the session key with PKCS#1 v1.5 padding; KMS offers only OAEP. Such a key provisions cleanly and then fails on the first real message — so the module rejects RSA for the encryption key at plan time, rather than letting the problem be discovered at the worst possible moment.
ECDH escapes this because it involves no padding: DeriveSharedSecret
returns the raw shared secret that OpenPGP's KDF consumes directly.
Start here¶
- Tutorials — never used it before? Go from an empty account to two KMS keys and a downloadable public key in about 20 minutes.
- How-to guides — Identity Center wiring, granting access, verifying the published certificate, retiring an identity.
- Reference — every input, output and IAM grant.
- Explanation — why RSA cannot work, why there are two keys and two roles, and which operation actually loses messages.
Also:
- Spec 0001 — the decision record, including what is still open.
- Engineering standards — module conventions, tag propagation, naming, security defaults.
Related projects¶
terraform-aws-signing-kms— the signing counterpart, whose key can only ever sign.phpboyscout/infra— the estate this module is built for, and the home of the originating work item.phpboyscout/sigillum— where certificate assembly and the decrypt path will live.