Reference¶
Information-oriented. Facts, generated from or checked against the module source.
In this section¶
- Inputs and outputs — every variable and output, with types and defaults.
- IAM permissions — every statement in both key policies and both trust policies, and exactly what each principal class can do.
Resources created¶
Six, always:
| Address | Type |
|---|---|
aws_kms_key.certify |
Certification primary (SIGN_VERIFY) |
aws_kms_alias.certify |
Alias for the above |
aws_kms_key.encrypt |
Encryption subkey (KEY_AGREEMENT) |
aws_kms_alias.encrypt |
Alias for the above |
aws_iam_role.reader |
Holds kms:DeriveSharedSecret |
aws_iam_role.certifier |
Holds kms:Sign on the primary |
Neither role has an attached identity policy. Both key policies are the single source of permission grants — see key policies for why.
Version compatibility¶
| OpenTofu | ~> 1.12.5 |
| AWS provider | ~> 6.0 |
| Terraform | Not supported — prevent_destroy is driven by a variable, which Terraform rejects |