KMS

5 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

KMSAlias # GA

KMSAlias is the Schema for managing KMS Aliases.

kubectl get kmsalias · example on GitHub

Example

# KMSAlias — KMS
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/kms.html#kmsalias
apiVersion: aws.konfig.io/v1alpha1
kind: KMSAlias
metadata:
  name: example-kmsalias
  namespace: default
spec:
  aliasName: alias/example
  providerRef:
    name: example-kmsalias
    region: us-east-1
  targetKeyRef:
    name: example-kmsalias

Spec

Field	Type	Required	Description
`aliasName`	string	yes	AliasName is the alias name.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`targetKeyRef`	object	yes	TargetKeyRef references the KMS key to alias.
`targetKeyRef.keyId`	string	—	KeyID is a direct AWS KMS key ID or ARN.
`targetKeyRef.name`	string	—	Name of a KMSKey CR in the same namespace.

Status

Field	Type	Required	Description
`arn`	string	—	ARN is the ARN of the alias.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

KMSGrant # GA

KMSGrant is the Schema for managing KMS grants.

kubectl get kmsgrants · example on GitHub

Example

# KMSGrant — KMS
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/kms.html#kmsgrant
apiVersion: aws.konfig.io/v1alpha1
kind: KMSGrant
metadata:
  name: example-kmsgrant
  namespace: default
spec:
  granteePrincipalArn: arn:aws:iam::123456789012:role/example-role
  keyId: example-id
  name: example-kmsgrant
  operations:
  - example
  providerRef:
    name: example-kmsgrant
    region: us-east-1
  retiringPrincipalArn: arn:aws:iam::123456789012:role/example-role

Spec

Field	Type	Required	Description
`granteePrincipalArn`	string	yes	GranteePrincipalARN is the ARN of the principal that gets the grant permissions.
`keyId`	string	yes	KeyID is the KMS key ID or ARN to grant permissions on.
`name`	string	—	Name is an optional friendly name for the grant.
`operations`	array<string>	yes	Operations are the KMS operations the grantee can perform.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`retiringPrincipalArn`	string	—	RetiringPrincipalARN is the ARN of the principal that can retire the grant.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`grantId`	string	—	GrantID is the ID of the grant.
`grantToken`	string	—	GrantToken is the grant token.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

KMSKey # GA

KMSKey is the Schema for managing AWS KMS Keys.

kubectl get kmskeys · example on GitHub

Example

# KMSKey — KMS
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/kms.html#kmskey
apiVersion: aws.konfig.io/v1alpha1
kind: KMSKey
metadata:
  name: example-kmskey
  namespace: default
spec:
  description: Managed by konfig-konector
  enableKeyRotation: true
  keySpec: SYMMETRIC_DEFAULT
  keyUsage: ENCRYPT_DECRYPT
  pendingWindowInDays: 7
  policy: '{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": ["s3:GetObject"], "Resource":
    "*"}]}'
  providerRef:
    name: example-kmskey
    region: us-east-1
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`description`	string	—	Description is a human-readable description for the key.
`enableKeyRotation`	boolean	—	EnableKeyRotation enables automatic annual key rotation.
`keySpec`	enum	—	KeySpec is the type of KMS key to create. Allowed: `SYMMETRIC_DEFAULT, RSA_2048, RSA_3072, RSA_4096, ECC_NIST_P256, ECC_NIST_P384, ECC_NIST_P521, ECC_SECG_P256K1…`
`keyUsage`	enum	—	KeyUsage is the cryptographic operations the key supports. Allowed: `ENCRYPT_DECRYPT, SIGN_VERIFY, GENERATE_VERIFY_MAC`
`pendingWindowInDays`	integer	—	PendingWindowInDays is the waiting period (7-30 days) before scheduled deletion.
`policy`	string	—	Policy is the JSON key policy document.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—	Tags are AWS resource tags to apply.

Status

Field	Type	Required	Description
`arn`	string	—	ARN is the ARN of the KMS key.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`keyId`	string	—	KeyID is the AWS KMS key ID.
`keyState`	string	—	KeyState is the current state of the key.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

KMSKeyPolicy # GA

KMSKeyPolicy is the Schema for managing KMS Key Policies.

kubectl get kmskeypolicies · example on GitHub

Example

# KMSKeyPolicy — KMS
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/kms.html#kmskeypolicy
apiVersion: aws.konfig.io/v1alpha1
kind: KMSKeyPolicy
metadata:
  name: example-kmskeypolicy
  namespace: default
spec:
  keyRef:
    name: example-kmskeypolicy
  policyDocument: '{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": ["s3:GetObject"],
    "Resource": "*"}]}'
  policyName: example-kmskeypolicy
  providerRef:
    name: example-kmskeypolicy
    region: us-east-1

Spec

Field	Type	Required	Description
`keyRef`	object	yes	KeyRef references the KMS key.
`keyRef.keyId`	string	—	KeyID is a direct AWS KMS key ID or ARN.
`keyRef.name`	string	—	Name of a KMSKey CR in the same namespace.
`policyDocument`	string	yes	PolicyDocument is the JSON key policy document.
`policyName`	string	—	PolicyName is the name of the policy (default is "default").
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

KMSReplicaKey # CLOUD CONTROL · AWS::KMS::ReplicaKey

KMSReplicaKey manages AWS::KMS::ReplicaKey through the AWS Cloud Control API.

kubectl get kmsreplicakeys · example on GitHub

Example

# KMSReplicaKey — KMS
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/kms.html#kmsreplicakey
apiVersion: aws.konfig.io/v1alpha1
kind: KMSReplicaKey
metadata:
  name: example-kmsreplicakey
  namespace: default
spec:
  description: Managed by konfig-konector
  enabled: true
  pendingWindowInDays: 7
  primaryKeyArn: arn:aws:iam::123456789012:role/example-role
  providerRef:
    name: example-kmsreplicakey
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`description`	string	—	A description of the AWS KMS key.
`enabled`	boolean	—	Specifies whether the AWS KMS key is enabled.
`keyPolicy`	object	yes	The key policy that authorizes use of the AWS KMS key.
`pendingWindowInDays`	integer	—	Specifies the number of days in the waiting period before AWS KMS deletes an AWS KMS key that has been removed from a CloudFormation stack.
`primaryKeyArn`	string	yes	Identifies the primary AWS KMS key to create a replica of.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	An array of key-value pairs to apply to this resource.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`arn`	string	—	Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`keyId`	string	—	Read-only: reported by AWS after creation.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.