KMS Key with Policy Patterns

aws-kms

Customer-managed KMS key with a least-privilege, lockout-safe key policy, automatic rotation on by default, aliases, and optional multi-region replicas. Works with Terraform and OpenTofu (>= 1.6), AWS provider >= 6.0, < 7.0. The generated key policy follows the AWS reference pattern — account root keeps kms:* so the key is never orphaned, while administrators, users, and AWS service principals get only the actions they need.

Status: static-validated, live-test pending. Ships under live-test quarantine — validated with tofu fmt, tofu validate, and tflint. Real apply → verify → destroy against an AWS account is pending a cloud sandbox. KMS destroy is non-immediate by design: terraform destroy only schedules deletion (deletion_window_in_days, 7–30 days), and the key remains billable (~$1/mo) and recoverable until the window elapses. This is an expected exception to the marketplace's instant-destroyConfirmed semantics, not a teardown failure.

What you get:

• aws_kms_key — symmetric or asymmetric/HMAC, with rotation, a deletion window, and an optional multi-region primary.
• aws_kms_key_policy — a generated least-privilege document (override with a full policy JSON string if you need to).
• aws_kms_alias — one or more alias/<name> aliases pointed at the key.
• aws_kms_replica_key — cross-region replicas of a multi-region primary.

Secure defaults

• Rotation on (enable_key_rotation = true) for symmetric encryption keys; automatically nulled for asymmetric/HMAC specs that do not support it.
• Generated least-privilege policy: root keeps kms:* (the non-lockout safeguard), administration and cryptographic use are split into separate statements, and service principals are pinned to your account via kms:CallerAccount. Key-user grant creation is restricted to AWS resources (kms:GrantIsForAWSResource).
• 30-day deletion window by default — the maximum recovery runway.
• bypass_policy_lockout_safety_check defaults to false; the safety check stays on.
• Reserved aws/* alias names and AWS-managed keys are rejected by validation.

Provider pin

aws = {
  source  = "hashicorp/aws"
  version = ">= 6.0, < 7.0"
}

License

Commercial — LicenseRef-IaCBazaar-Commercial. © IaC Bazaar. Original work (not derived from a third-party module).