Reference¶
Information-oriented. Facts, generated from or checked against the module source.
In this section¶
- Inputs and outputs: every variable and output, with types and defaults.
- IAM permissions: every statement in both key policies and both trust policies, and exactly what each principal class can do.
Resources created¶
Six, always:
| Address | Type |
|---|---|
aws_kms_key.certify |
Certification primary (SIGN_VERIFY) |
aws_kms_alias.certify |
Alias for the above |
aws_kms_key.encrypt |
Encryption subkey (KEY_AGREEMENT) |
aws_kms_alias.encrypt |
Alias for the above |
aws_iam_role.reader |
Holds kms:DeriveSharedSecret |
aws_iam_role.certifier |
Holds kms:Sign on the primary |
Neither role has an attached identity policy. Both key policies are the single source of permission grants; key policies explains why.
Version compatibility¶
| OpenTofu | >= 1.12.0 |
| AWS provider | ~> 6.0 |
| Terraform | Not supported: prevent_destroy is driven by a variable, which Terraform rejects |
The OpenTofu version is a floor: the oldest version the module supports, raised
by hand only when the module uses a newer feature. It is 1.12.0 because that is
the first release to accept a variable in prevent_destroy; 1.11 and earlier
reject the module with "Variables not allowed". The pin in .opentofu-version
is what CI tests on. In a .tf file, OpenTofu 1.12 and later treat
required_version as a statement, not a gate
(opentofu#3347).