Skip to content

terraform-aws-encryption-kms

A small, focused OpenTofu / Terraform module that provisions the AWS half of an OpenPGP identity which can receive encrypted mail — the counterpart to terraform-aws-signing-kms, which can only ever sign.

Use it wherever you publish an OpenPGP certificate that anyone can encrypt to — a security.txt contact, a confidential intake address, a whistleblowing channel — and where:

  • The private key material never leaves AWS KMS.
  • No CI pipeline can decrypt anything — there is deliberately no OIDC trust in this module at all.
  • The apply role can neither decrypt a message nor re-certify the identity, even on full compromise of the runner.
  • Decrypting and re-certifying the identity are separate roles.

The one thing to know first

An RSA KMS key cannot decrypt OpenPGP at all. OpenPGP encrypts the session key with PKCS#1 v1.5 padding; KMS offers only OAEP. Such a key provisions cleanly and then fails on the first real message — so the module rejects RSA for the encryption key at plan time, rather than letting the problem be discovered at the worst possible moment.

ECDH escapes this because it involves no padding: DeriveSharedSecret returns the raw shared secret that OpenPGP's KDF consumes directly.

Start here

  • Tutorials — never used it before? Go from an empty account to two KMS keys and a downloadable public key in about 20 minutes.
  • How-to guides — Identity Center wiring, granting access, verifying the published certificate, retiring an identity.
  • Reference — every input, output and IAM grant.
  • Explanation — why RSA cannot work, why there are two keys and two roles, and which operation actually loses messages.

Also:

  • Spec 0001 — the decision record, including what is still open.
  • Engineering standards — module conventions, tag propagation, naming, security defaults.