generated from clowdhaus/terraform-aws-module-template
-
-
Notifications
You must be signed in to change notification settings - Fork 81
/
variables.tf
253 lines (210 loc) · 9.18 KB
/
variables.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
variable "create" {
description = "Determines whether resources will be created (affects all resources)"
type = bool
default = true
}
variable "tags" {
description = "A map of tags to add to all resources"
type = map(string)
default = {}
}
################################################################################
# Key
################################################################################
variable "create_external" {
description = "Determines whether an external CMK (externally provided material) will be created or a standard CMK (AWS provided material)"
type = bool
default = false
}
variable "bypass_policy_lockout_safety_check" {
description = "A flag to indicate whether to bypass the key policy lockout safety check. Setting this value to true increases the risk that the KMS key becomes unmanageable"
type = bool
default = null
}
variable "customer_master_key_spec" {
description = "Specifies whether the key contains a symmetric key or an asymmetric key pair and the encryption algorithms or signing algorithms that the key supports. Valid values: `SYMMETRIC_DEFAULT`, `RSA_2048`, `RSA_3072`, `RSA_4096`, `HMAC_256`, `ECC_NIST_P256`, `ECC_NIST_P384`, `ECC_NIST_P521`, or `ECC_SECG_P256K1`. Defaults to `SYMMETRIC_DEFAULT`"
type = string
default = null
}
variable "custom_key_store_id" {
description = "ID of the KMS Custom Key Store where the key will be stored instead of KMS (eg CloudHSM)."
type = string
default = null
}
variable "deletion_window_in_days" {
description = "The waiting period, specified in number of days. After the waiting period ends, AWS KMS deletes the KMS key. If you specify a value, it must be between `7` and `30`, inclusive. If you do not specify a value, it defaults to `30`"
type = number
default = null
}
variable "description" {
description = "The description of the key as viewed in AWS console"
type = string
default = null
}
variable "enable_key_rotation" {
description = "Specifies whether key rotation is enabled. Defaults to `true`"
type = bool
default = true
}
variable "is_enabled" {
description = "Specifies whether the key is enabled. Defaults to `true`"
type = bool
default = null
}
variable "key_material_base64" {
description = "Base64 encoded 256-bit symmetric encryption key material to import. The CMK is permanently associated with this key material. External key only"
type = string
default = null
}
variable "key_usage" {
description = "Specifies the intended use of the key. Valid values: `ENCRYPT_DECRYPT` or `SIGN_VERIFY`. Defaults to `ENCRYPT_DECRYPT`"
type = string
default = null
}
variable "multi_region" {
description = "Indicates whether the KMS key is a multi-Region (`true`) or regional (`false`) key. Defaults to `false`"
type = bool
default = false
}
variable "policy" {
description = "A valid policy JSON document. Although this is a key policy, not an IAM policy, an `aws_iam_policy_document`, in the form that designates a principal, can be used"
type = string
default = null
}
variable "valid_to" {
description = "Time at which the imported key material expires. When the key material expires, AWS KMS deletes the key material and the CMK becomes unusable. If not specified, key material does not expire"
type = string
default = null
}
variable "enable_default_policy" {
description = "Specifies whether to enable the default key policy. Defaults to `true`"
type = bool
default = true
}
variable "key_owners" {
description = "A list of IAM ARNs for those who will have full key permissions (`kms:*`)"
type = list(string)
default = []
}
variable "key_administrators" {
description = "A list of IAM ARNs for [key administrators](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-default-allow-administrators)"
type = list(string)
default = []
}
variable "key_users" {
description = "A list of IAM ARNs for [key users](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-default-allow-users)"
type = list(string)
default = []
}
variable "key_service_users" {
description = "A list of IAM ARNs for [key service users](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-service-integration)"
type = list(string)
default = []
}
variable "key_service_roles_for_autoscaling" {
description = "A list of IAM ARNs for [AWSServiceRoleForAutoScaling roles](https://docs.aws.amazon.com/autoscaling/ec2/userguide/key-policy-requirements-EBS-encryption.html#policy-example-cmk-access)"
type = list(string)
default = []
}
variable "key_symmetric_encryption_users" {
description = "A list of IAM ARNs for [key symmetric encryption users](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-users-crypto)"
type = list(string)
default = []
}
variable "key_hmac_users" {
description = "A list of IAM ARNs for [key HMAC users](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-users-crypto)"
type = list(string)
default = []
}
variable "key_asymmetric_public_encryption_users" {
description = "A list of IAM ARNs for [key asymmetric public encryption users](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-users-crypto)"
type = list(string)
default = []
}
variable "key_asymmetric_sign_verify_users" {
description = "A list of IAM ARNs for [key asymmetric sign and verify users](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-users-crypto)"
type = list(string)
default = []
}
variable "key_statements" {
description = "A map of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) for custom permission usage"
type = any
default = {}
}
variable "source_policy_documents" {
description = "List of IAM policy documents that are merged together into the exported document. Statements must have unique `sid`s"
type = list(string)
default = []
}
variable "override_policy_documents" {
description = "List of IAM policy documents that are merged together into the exported document. In merging, statements with non-blank `sid`s will override statements with the same `sid`"
type = list(string)
default = []
}
variable "enable_route53_dnssec" {
description = "Determines whether the KMS policy used for Route53 DNSSEC signing is enabled"
type = bool
default = false
}
variable "route53_dnssec_sources" {
description = "A list of maps containing `account_ids` and Route53 `hosted_zone_arn` that will be allowed to sign DNSSEC records"
type = list(any)
default = []
}
variable "rotation_period_in_days" {
description = "Custom period of time between each rotation date. Must be a number between 90 and 2560 (inclusive)"
type = number
default = null
}
################################################################################
# Replica Key
################################################################################
variable "create_replica" {
description = "Determines whether a replica standard CMK will be created (AWS provided material)"
type = bool
default = false
}
variable "primary_key_arn" {
description = "The primary key arn of a multi-region replica key"
type = string
default = null
}
################################################################################
# Replica External Key
################################################################################
variable "create_replica_external" {
description = "Determines whether a replica external CMK will be created (externally provided material)"
type = bool
default = false
}
variable "primary_external_key_arn" {
description = "The primary external key arn of a multi-region replica external key"
type = string
default = null
}
################################################################################
# Alias
################################################################################
variable "aliases" {
description = "A list of aliases to create. Note - due to the use of `toset()`, values must be static strings and not computed values"
type = list(string)
default = []
}
variable "computed_aliases" {
description = "A map of aliases to create. Values provided via the `name` key of the map can be computed from upstream resources"
type = any
default = {}
}
variable "aliases_use_name_prefix" {
description = "Determines whether the alias name is used as a prefix"
type = bool
default = false
}
################################################################################
# Grant
################################################################################
variable "grants" {
description = "A map of grant definitions to create"
type = any
default = {}
}