published on Monday, Jun 1, 2026 by Volcengine
published on Monday, Jun 1, 2026 by Volcengine
Key Management Service (KMS) is a one-stop key management and data encryption platform on Volcano Engine. It provides easy-to-use encryption interfaces. KMS helps users easily manage keys and protect the security of core cloud data. It also greatly reduces the procurement and development costs for users to deploy their own cryptographic infrastructure. KMS helps businesses easily meet regulatory and compliance requirements.
Example Usage
Example coming soon!
Example coming soon!
Example coming soon!
Example coming soon!
Example coming soon!
resources:
kMSKeyDemo:
type: volcenginecc:kms:Key
name: KMSKeyDemo
properties:
keyringName: KMSKeyDemo
keyName: KMSKeyDemoKeyName
keySpec: SYMMETRIC_256
description: description KMSKeyDemo
keyUsage: ENCRYPT_DECRYPT
protectionLevel: HSM
rotateState: Enable
origin: CloudKMS
multiRegion: false
rotateInterval: 900
keyEnableOperation: 1
keyRotationOperation: 1
tags:
- key: env
value: test
ciphertext:
plaintext: tWB54tTvEu47YjRjuuj+fAt5PskpUaxxxxxx
encryption_context:
fn::toJSON:
user: alice
path: path/to/alice/plaintext.txt
reEncrypt:
new_keyring_name: terraform-test
new_key_name: ccapi-terraform
new_key_id: 677a846d-a685-4219-b8c6-xxxxxxxx
source_ciphertext_blob: jrPUHmpTQaiWWtwU8z9JvwAA6TR2e5xxxxxxxx
old_encryption_context: ""
new_encryption_context:
fn::toJSON:
user: alice
path: path/to/alice/ccapi.txt
Example coming soon!
Create Key Resource
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax
new Key(name: string, args: KeyArgs, opts?: CustomResourceOptions);@overload
def Key(resource_name: str,
args: KeyArgs,
opts: Optional[ResourceOptions] = None)
@overload
def Key(resource_name: str,
opts: Optional[ResourceOptions] = None,
key_name: Optional[str] = None,
keyring_name: Optional[str] = None,
key_rotation_operation: Optional[int] = None,
asymmetric_signature: Optional[KeyAsymmetricSignatureArgs] = None,
key_archive_operation: Optional[int] = None,
key_enable_operation: Optional[int] = None,
ciphertext: Optional[KeyCiphertextArgs] = None,
key_primary_region: Optional[str] = None,
asymmetric_ciphertext: Optional[KeyAsymmetricCiphertextArgs] = None,
key_spec: Optional[str] = None,
key_usage: Optional[str] = None,
description: Optional[str] = None,
multi_region: Optional[bool] = None,
origin: Optional[str] = None,
protection_level: Optional[str] = None,
re_encrypt: Optional[KeyReEncryptArgs] = None,
replicate_key: Optional[KeyReplicateKeyArgs] = None,
rotate_interval: Optional[int] = None,
tags: Optional[Sequence[KeyTagArgs]] = None)func NewKey(ctx *Context, name string, args KeyArgs, opts ...ResourceOption) (*Key, error)public Key(string name, KeyArgs args, CustomResourceOptions? opts = null)type: volcenginecc:kms:Key
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
resource "volcenginecc_kms_key" "name" {
# resource properties
}Parameters
- name string
- The unique name of the resource.
- args KeyArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args KeyArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args KeyArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args KeyArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args KeyArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
Constructor example
The following reference example uses placeholder values for all input properties.
var keyResource = new Volcenginecc.Kms.Key("keyResource", new()
{
KeyName = "string",
KeyringName = "string",
KeyRotationOperation = 0,
AsymmetricSignature = new Volcenginecc.Kms.Inputs.KeyAsymmetricSignatureArgs
{
Algorithm = "string",
Message = "string",
MessageType = "string",
Signature = "string",
},
KeyArchiveOperation = 0,
KeyEnableOperation = 0,
Ciphertext = new Volcenginecc.Kms.Inputs.KeyCiphertextArgs
{
CiphertextBlob = "string",
EncryptionContext = "string",
Plaintext = "string",
},
KeyPrimaryRegion = "string",
AsymmetricCiphertext = new Volcenginecc.Kms.Inputs.KeyAsymmetricCiphertextArgs
{
Algorithm = "string",
CiphertextBlob = "string",
Plaintext = "string",
},
KeySpec = "string",
KeyUsage = "string",
Description = "string",
MultiRegion = false,
Origin = "string",
ProtectionLevel = "string",
ReEncrypt = new Volcenginecc.Kms.Inputs.KeyReEncryptArgs
{
CiphertextBlob = "string",
NewEncryptionContext = "string",
NewKeyId = "string",
NewKeyName = "string",
NewKeyringName = "string",
OldEncryptionContext = "string",
SourceCiphertextBlob = "string",
},
ReplicateKey = new Volcenginecc.Kms.Inputs.KeyReplicateKeyArgs
{
Description = "string",
ReplicaKeyId = "string",
ReplicaRegion = "string",
Tags = new[]
{
new Volcenginecc.Kms.Inputs.KeyReplicateKeyTagArgs
{
Key = "string",
Value = "string",
},
},
},
RotateInterval = 0,
Tags = new[]
{
new Volcenginecc.Kms.Inputs.KeyTagArgs
{
Key = "string",
Value = "string",
},
},
});
example, err := kms.NewKey(ctx, "keyResource", &kms.KeyArgs{
KeyName: pulumi.String("string"),
KeyringName: pulumi.String("string"),
KeyRotationOperation: pulumi.Int(0),
AsymmetricSignature: &kms.KeyAsymmetricSignatureArgs{
Algorithm: pulumi.String("string"),
Message: pulumi.String("string"),
MessageType: pulumi.String("string"),
Signature: pulumi.String("string"),
},
KeyArchiveOperation: pulumi.Int(0),
KeyEnableOperation: pulumi.Int(0),
Ciphertext: &kms.KeyCiphertextArgs{
CiphertextBlob: pulumi.String("string"),
EncryptionContext: pulumi.String("string"),
Plaintext: pulumi.String("string"),
},
KeyPrimaryRegion: pulumi.String("string"),
AsymmetricCiphertext: &kms.KeyAsymmetricCiphertextArgs{
Algorithm: pulumi.String("string"),
CiphertextBlob: pulumi.String("string"),
Plaintext: pulumi.String("string"),
},
KeySpec: pulumi.String("string"),
KeyUsage: pulumi.String("string"),
Description: pulumi.String("string"),
MultiRegion: pulumi.Bool(false),
Origin: pulumi.String("string"),
ProtectionLevel: pulumi.String("string"),
ReEncrypt: &kms.KeyReEncryptArgs{
CiphertextBlob: pulumi.String("string"),
NewEncryptionContext: pulumi.String("string"),
NewKeyId: pulumi.String("string"),
NewKeyName: pulumi.String("string"),
NewKeyringName: pulumi.String("string"),
OldEncryptionContext: pulumi.String("string"),
SourceCiphertextBlob: pulumi.String("string"),
},
ReplicateKey: &kms.KeyReplicateKeyArgs{
Description: pulumi.String("string"),
ReplicaKeyId: pulumi.String("string"),
ReplicaRegion: pulumi.String("string"),
Tags: kms.KeyReplicateKeyTagArray{
&kms.KeyReplicateKeyTagArgs{
Key: pulumi.String("string"),
Value: pulumi.String("string"),
},
},
},
RotateInterval: pulumi.Int(0),
Tags: kms.KeyTagArray{
&kms.KeyTagArgs{
Key: pulumi.String("string"),
Value: pulumi.String("string"),
},
},
})
resource "volcenginecc_kms_key" "keyResource" {
key_name = "string"
keyring_name = "string"
key_rotation_operation = 0
asymmetric_signature = {
algorithm = "string"
message = "string"
message_type = "string"
signature = "string"
}
key_archive_operation = 0
key_enable_operation = 0
ciphertext = {
ciphertext_blob = "string"
encryption_context = "string"
plaintext = "string"
}
key_primary_region = "string"
asymmetric_ciphertext = {
algorithm = "string"
ciphertext_blob = "string"
plaintext = "string"
}
key_spec = "string"
key_usage = "string"
description = "string"
multi_region = false
origin = "string"
protection_level = "string"
re_encrypt = {
ciphertext_blob = "string"
new_encryption_context = "string"
new_key_id = "string"
new_key_name = "string"
new_keyring_name = "string"
old_encryption_context = "string"
source_ciphertext_blob = "string"
}
replicate_key = {
description = "string"
replica_key_id = "string"
replica_region = "string"
tags = [{
"key" = "string"
"value" = "string"
}]
}
rotate_interval = 0
tags {
key = "string"
value = "string"
}
}
var keyResource = new Key("keyResource", KeyArgs.builder()
.keyName("string")
.keyringName("string")
.keyRotationOperation(0)
.asymmetricSignature(KeyAsymmetricSignatureArgs.builder()
.algorithm("string")
.message("string")
.messageType("string")
.signature("string")
.build())
.keyArchiveOperation(0)
.keyEnableOperation(0)
.ciphertext(KeyCiphertextArgs.builder()
.ciphertextBlob("string")
.encryptionContext("string")
.plaintext("string")
.build())
.keyPrimaryRegion("string")
.asymmetricCiphertext(KeyAsymmetricCiphertextArgs.builder()
.algorithm("string")
.ciphertextBlob("string")
.plaintext("string")
.build())
.keySpec("string")
.keyUsage("string")
.description("string")
.multiRegion(false)
.origin("string")
.protectionLevel("string")
.reEncrypt(KeyReEncryptArgs.builder()
.ciphertextBlob("string")
.newEncryptionContext("string")
.newKeyId("string")
.newKeyName("string")
.newKeyringName("string")
.oldEncryptionContext("string")
.sourceCiphertextBlob("string")
.build())
.replicateKey(KeyReplicateKeyArgs.builder()
.description("string")
.replicaKeyId("string")
.replicaRegion("string")
.tags(KeyReplicateKeyTagArgs.builder()
.key("string")
.value("string")
.build())
.build())
.rotateInterval(0)
.tags(KeyTagArgs.builder()
.key("string")
.value("string")
.build())
.build());
key_resource = volcenginecc.kms.Key("keyResource",
key_name="string",
keyring_name="string",
key_rotation_operation=0,
asymmetric_signature={
"algorithm": "string",
"message": "string",
"message_type": "string",
"signature": "string",
},
key_archive_operation=0,
key_enable_operation=0,
ciphertext={
"ciphertext_blob": "string",
"encryption_context": "string",
"plaintext": "string",
},
key_primary_region="string",
asymmetric_ciphertext={
"algorithm": "string",
"ciphertext_blob": "string",
"plaintext": "string",
},
key_spec="string",
key_usage="string",
description="string",
multi_region=False,
origin="string",
protection_level="string",
re_encrypt={
"ciphertext_blob": "string",
"new_encryption_context": "string",
"new_key_id": "string",
"new_key_name": "string",
"new_keyring_name": "string",
"old_encryption_context": "string",
"source_ciphertext_blob": "string",
},
replicate_key={
"description": "string",
"replica_key_id": "string",
"replica_region": "string",
"tags": [{
"key": "string",
"value": "string",
}],
},
rotate_interval=0,
tags=[{
"key": "string",
"value": "string",
}])
const keyResource = new volcenginecc.kms.Key("keyResource", {
keyName: "string",
keyringName: "string",
keyRotationOperation: 0,
asymmetricSignature: {
algorithm: "string",
message: "string",
messageType: "string",
signature: "string",
},
keyArchiveOperation: 0,
keyEnableOperation: 0,
ciphertext: {
ciphertextBlob: "string",
encryptionContext: "string",
plaintext: "string",
},
keyPrimaryRegion: "string",
asymmetricCiphertext: {
algorithm: "string",
ciphertextBlob: "string",
plaintext: "string",
},
keySpec: "string",
keyUsage: "string",
description: "string",
multiRegion: false,
origin: "string",
protectionLevel: "string",
reEncrypt: {
ciphertextBlob: "string",
newEncryptionContext: "string",
newKeyId: "string",
newKeyName: "string",
newKeyringName: "string",
oldEncryptionContext: "string",
sourceCiphertextBlob: "string",
},
replicateKey: {
description: "string",
replicaKeyId: "string",
replicaRegion: "string",
tags: [{
key: "string",
value: "string",
}],
},
rotateInterval: 0,
tags: [{
key: "string",
value: "string",
}],
});
type: volcenginecc:kms:Key
properties:
asymmetricCiphertext:
algorithm: string
ciphertextBlob: string
plaintext: string
asymmetricSignature:
algorithm: string
message: string
messageType: string
signature: string
ciphertext:
ciphertextBlob: string
encryptionContext: string
plaintext: string
description: string
keyArchiveOperation: 0
keyEnableOperation: 0
keyName: string
keyPrimaryRegion: string
keyRotationOperation: 0
keySpec: string
keyUsage: string
keyringName: string
multiRegion: false
origin: string
protectionLevel: string
reEncrypt:
ciphertextBlob: string
newEncryptionContext: string
newKeyId: string
newKeyName: string
newKeyringName: string
oldEncryptionContext: string
sourceCiphertextBlob: string
replicateKey:
description: string
replicaKeyId: string
replicaRegion: string
tags:
- key: string
value: string
rotateInterval: 0
tags:
- key: string
value: string
Key Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.
The Key resource accepts the following input properties:
- Key
Name string - Master key name. Length 2–31 characters. Valid characters: [a-zA-Z0-9-_].
- Keyring
Name string - Key ring name. Length 2–31 characters. Valid characters: [a-zA-Z0-9-_].
- Asymmetric
Ciphertext Volcengine.Key Asymmetric Ciphertext - Asymmetric encryption action parameters and results. AsymmetricEncrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- Asymmetric
Signature Volcengine.Key Asymmetric Signature - Asymmetric signature action parameters and results. AsymmetricSign can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- Ciphertext
Volcengine.
Key Ciphertext - Symmetric encryption action parameters and results. Encrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- Description string
- Key description: Length 0–8192 characters.
- Key
Archive intOperation - User master key archive operation (enter 1 to archive, 2 to unarchive).
- Key
Enable intOperation - User master key enable operation (enter 1 to enable, 2 to disable).
- Key
Primary stringRegion - Primary region of the multi-region key. Set the target primary region during the Create/Update phase; the current primary region is returned during the Read phase.
- Key
Rotation intOperation - User master key rotation operation (enter 1 to enable, 2 to disable).
- Key
Spec string - Symmetric keys: SYMMETRIC256, SYMMETRIC128; asymmetric keys: RSA2048, RSA3072, RSA4096, ECP256, ECP256K, ECP384, ECP521, ECSM2.
- Key
Usage string - Key usage. Options: ENCRYPTDECRYPT, SIGNVERIFY, GENERATEVERIFYMAC.
- Multi
Region bool - Is this a multi-region type master key.
- Origin string
- Key source. Options: CloudKMS, External, ExternalKeyStore.
- Protection
Level string - Key protection level. Options: SOFTWARE, HSM.
- Re
Encrypt Volcengine.Key Re Encrypt - Re-encryption action parameters and results. ReEncrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- Replicate
Key Volcengine.Key Replicate Key - Replicate key action parameters and results. ReplicateKey can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- Rotate
Interval int - Key rotation period (days). Range: [90, 2560].
-
List<Volcengine.
Key Tag>
- Key
Name string - Master key name. Length 2–31 characters. Valid characters: [a-zA-Z0-9-_].
- Keyring
Name string - Key ring name. Length 2–31 characters. Valid characters: [a-zA-Z0-9-_].
- Asymmetric
Ciphertext KeyAsymmetric Ciphertext Args - Asymmetric encryption action parameters and results. AsymmetricEncrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- Asymmetric
Signature KeyAsymmetric Signature Args - Asymmetric signature action parameters and results. AsymmetricSign can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- Ciphertext
Key
Ciphertext Args - Symmetric encryption action parameters and results. Encrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- Description string
- Key description: Length 0–8192 characters.
- Key
Archive intOperation - User master key archive operation (enter 1 to archive, 2 to unarchive).
- Key
Enable intOperation - User master key enable operation (enter 1 to enable, 2 to disable).
- Key
Primary stringRegion - Primary region of the multi-region key. Set the target primary region during the Create/Update phase; the current primary region is returned during the Read phase.
- Key
Rotation intOperation - User master key rotation operation (enter 1 to enable, 2 to disable).
- Key
Spec string - Symmetric keys: SYMMETRIC256, SYMMETRIC128; asymmetric keys: RSA2048, RSA3072, RSA4096, ECP256, ECP256K, ECP384, ECP521, ECSM2.
- Key
Usage string - Key usage. Options: ENCRYPTDECRYPT, SIGNVERIFY, GENERATEVERIFYMAC.
- Multi
Region bool - Is this a multi-region type master key.
- Origin string
- Key source. Options: CloudKMS, External, ExternalKeyStore.
- Protection
Level string - Key protection level. Options: SOFTWARE, HSM.
- Re
Encrypt KeyRe Encrypt Args - Re-encryption action parameters and results. ReEncrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- Replicate
Key KeyReplicate Key Args - Replicate key action parameters and results. ReplicateKey can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- Rotate
Interval int - Key rotation period (days). Range: [90, 2560].
-
[]Key
Tag Args
- key_
name string - Master key name. Length 2–31 characters. Valid characters: [a-zA-Z0-9-_].
- keyring_
name string - Key ring name. Length 2–31 characters. Valid characters: [a-zA-Z0-9-_].
- asymmetric_
ciphertext object - Asymmetric encryption action parameters and results. AsymmetricEncrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- asymmetric_
signature object - Asymmetric signature action parameters and results. AsymmetricSign can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- ciphertext object
- Symmetric encryption action parameters and results. Encrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- description string
- Key description: Length 0–8192 characters.
- key_
archive_ numberoperation - User master key archive operation (enter 1 to archive, 2 to unarchive).
- key_
enable_ numberoperation - User master key enable operation (enter 1 to enable, 2 to disable).
- key_
primary_ stringregion - Primary region of the multi-region key. Set the target primary region during the Create/Update phase; the current primary region is returned during the Read phase.
- key_
rotation_ numberoperation - User master key rotation operation (enter 1 to enable, 2 to disable).
- key_
spec string - Symmetric keys: SYMMETRIC256, SYMMETRIC128; asymmetric keys: RSA2048, RSA3072, RSA4096, ECP256, ECP256K, ECP384, ECP521, ECSM2.
- key_
usage string - Key usage. Options: ENCRYPTDECRYPT, SIGNVERIFY, GENERATEVERIFYMAC.
- multi_
region bool - Is this a multi-region type master key.
- origin string
- Key source. Options: CloudKMS, External, ExternalKeyStore.
- protection_
level string - Key protection level. Options: SOFTWARE, HSM.
- re_
encrypt object - Re-encryption action parameters and results. ReEncrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- replicate_
key object - Replicate key action parameters and results. ReplicateKey can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- rotate_
interval number - Key rotation period (days). Range: [90, 2560].
- list(object)
- key
Name String - Master key name. Length 2–31 characters. Valid characters: [a-zA-Z0-9-_].
- keyring
Name String - Key ring name. Length 2–31 characters. Valid characters: [a-zA-Z0-9-_].
- asymmetric
Ciphertext KeyAsymmetric Ciphertext - Asymmetric encryption action parameters and results. AsymmetricEncrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- asymmetric
Signature KeyAsymmetric Signature - Asymmetric signature action parameters and results. AsymmetricSign can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- ciphertext
Key
Ciphertext - Symmetric encryption action parameters and results. Encrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- description String
- Key description: Length 0–8192 characters.
- key
Archive IntegerOperation - User master key archive operation (enter 1 to archive, 2 to unarchive).
- key
Enable IntegerOperation - User master key enable operation (enter 1 to enable, 2 to disable).
- key
Primary StringRegion - Primary region of the multi-region key. Set the target primary region during the Create/Update phase; the current primary region is returned during the Read phase.
- key
Rotation IntegerOperation - User master key rotation operation (enter 1 to enable, 2 to disable).
- key
Spec String - Symmetric keys: SYMMETRIC256, SYMMETRIC128; asymmetric keys: RSA2048, RSA3072, RSA4096, ECP256, ECP256K, ECP384, ECP521, ECSM2.
- key
Usage String - Key usage. Options: ENCRYPTDECRYPT, SIGNVERIFY, GENERATEVERIFYMAC.
- multi
Region Boolean - Is this a multi-region type master key.
- origin String
- Key source. Options: CloudKMS, External, ExternalKeyStore.
- protection
Level String - Key protection level. Options: SOFTWARE, HSM.
- re
Encrypt KeyRe Encrypt - Re-encryption action parameters and results. ReEncrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- replicate
Key KeyReplicate Key - Replicate key action parameters and results. ReplicateKey can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- rotate
Interval Integer - Key rotation period (days). Range: [90, 2560].
-
List<Key
Tag>
- key
Name string - Master key name. Length 2–31 characters. Valid characters: [a-zA-Z0-9-_].
- keyring
Name string - Key ring name. Length 2–31 characters. Valid characters: [a-zA-Z0-9-_].
- asymmetric
Ciphertext KeyAsymmetric Ciphertext - Asymmetric encryption action parameters and results. AsymmetricEncrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- asymmetric
Signature KeyAsymmetric Signature - Asymmetric signature action parameters and results. AsymmetricSign can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- ciphertext
Key
Ciphertext - Symmetric encryption action parameters and results. Encrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- description string
- Key description: Length 0–8192 characters.
- key
Archive numberOperation - User master key archive operation (enter 1 to archive, 2 to unarchive).
- key
Enable numberOperation - User master key enable operation (enter 1 to enable, 2 to disable).
- key
Primary stringRegion - Primary region of the multi-region key. Set the target primary region during the Create/Update phase; the current primary region is returned during the Read phase.
- key
Rotation numberOperation - User master key rotation operation (enter 1 to enable, 2 to disable).
- key
Spec string - Symmetric keys: SYMMETRIC256, SYMMETRIC128; asymmetric keys: RSA2048, RSA3072, RSA4096, ECP256, ECP256K, ECP384, ECP521, ECSM2.
- key
Usage string - Key usage. Options: ENCRYPTDECRYPT, SIGNVERIFY, GENERATEVERIFYMAC.
- multi
Region boolean - Is this a multi-region type master key.
- origin string
- Key source. Options: CloudKMS, External, ExternalKeyStore.
- protection
Level string - Key protection level. Options: SOFTWARE, HSM.
- re
Encrypt KeyRe Encrypt - Re-encryption action parameters and results. ReEncrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- replicate
Key KeyReplicate Key - Replicate key action parameters and results. ReplicateKey can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- rotate
Interval number - Key rotation period (days). Range: [90, 2560].
-
Key
Tag[]
- key_
name str - Master key name. Length 2–31 characters. Valid characters: [a-zA-Z0-9-_].
- keyring_
name str - Key ring name. Length 2–31 characters. Valid characters: [a-zA-Z0-9-_].
- asymmetric_
ciphertext KeyAsymmetric Ciphertext Args - Asymmetric encryption action parameters and results. AsymmetricEncrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- asymmetric_
signature KeyAsymmetric Signature Args - Asymmetric signature action parameters and results. AsymmetricSign can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- ciphertext
Key
Ciphertext Args - Symmetric encryption action parameters and results. Encrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- description str
- Key description: Length 0–8192 characters.
- key_
archive_ intoperation - User master key archive operation (enter 1 to archive, 2 to unarchive).
- key_
enable_ intoperation - User master key enable operation (enter 1 to enable, 2 to disable).
- key_
primary_ strregion - Primary region of the multi-region key. Set the target primary region during the Create/Update phase; the current primary region is returned during the Read phase.
- key_
rotation_ intoperation - User master key rotation operation (enter 1 to enable, 2 to disable).
- key_
spec str - Symmetric keys: SYMMETRIC256, SYMMETRIC128; asymmetric keys: RSA2048, RSA3072, RSA4096, ECP256, ECP256K, ECP384, ECP521, ECSM2.
- key_
usage str - Key usage. Options: ENCRYPTDECRYPT, SIGNVERIFY, GENERATEVERIFYMAC.
- multi_
region bool - Is this a multi-region type master key.
- origin str
- Key source. Options: CloudKMS, External, ExternalKeyStore.
- protection_
level str - Key protection level. Options: SOFTWARE, HSM.
- re_
encrypt KeyRe Encrypt Args - Re-encryption action parameters and results. ReEncrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- replicate_
key KeyReplicate Key Args - Replicate key action parameters and results. ReplicateKey can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- rotate_
interval int - Key rotation period (days). Range: [90, 2560].
-
Sequence[Key
Tag Args]
- key
Name String - Master key name. Length 2–31 characters. Valid characters: [a-zA-Z0-9-_].
- keyring
Name String - Key ring name. Length 2–31 characters. Valid characters: [a-zA-Z0-9-_].
- asymmetric
Ciphertext Property Map - Asymmetric encryption action parameters and results. AsymmetricEncrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- asymmetric
Signature Property Map - Asymmetric signature action parameters and results. AsymmetricSign can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- ciphertext Property Map
- Symmetric encryption action parameters and results. Encrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- description String
- Key description: Length 0–8192 characters.
- key
Archive NumberOperation - User master key archive operation (enter 1 to archive, 2 to unarchive).
- key
Enable NumberOperation - User master key enable operation (enter 1 to enable, 2 to disable).
- key
Primary StringRegion - Primary region of the multi-region key. Set the target primary region during the Create/Update phase; the current primary region is returned during the Read phase.
- key
Rotation NumberOperation - User master key rotation operation (enter 1 to enable, 2 to disable).
- key
Spec String - Symmetric keys: SYMMETRIC256, SYMMETRIC128; asymmetric keys: RSA2048, RSA3072, RSA4096, ECP256, ECP256K, ECP384, ECP521, ECSM2.
- key
Usage String - Key usage. Options: ENCRYPTDECRYPT, SIGNVERIFY, GENERATEVERIFYMAC.
- multi
Region Boolean - Is this a multi-region type master key.
- origin String
- Key source. Options: CloudKMS, External, ExternalKeyStore.
- protection
Level String - Key protection level. Options: SOFTWARE, HSM.
- re
Encrypt Property Map - Re-encryption action parameters and results. ReEncrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- replicate
Key Property Map - Replicate key action parameters and results. ReplicateKey can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- rotate
Interval Number - Key rotation period (days). Range: [90, 2560].
- List<Property Map>
Outputs
All input properties are implicitly available as output properties. Additionally, the Key resource produces the following output properties:
- Created
Time int - Key creation time.
- Id string
- The provider-assigned unique ID for this managed resource.
- Key
Id string - Key unique identifier in UUID format.
- Key
Material stringExpire Time - Key material expiration time. If empty, the key does not expire.
- Key
State stringValue - Key status: Enable, Disable, PendingDelete, Archived, PendingImport.
- Last
Rotation stringTime - Key last rotation time.
- Multi
Region Volcengine.Configuration Key Multi Region Configuration - Multi-region key configuration information.
- Rotate
State string - Key rotation status. Options: Enable, Disable.
- Schedule
Delete stringTime - Key deletion time.
- Schedule
Rotation stringTime - Key rotation time.
- Trn string
- Resource name. Format should be trn:${Service}:${Region}:${AccountID}:${ResourcePath}.
- Updated
Time int - Key update time.
- Created
Time int - Key creation time.
- Id string
- The provider-assigned unique ID for this managed resource.
- Key
Id string - Key unique identifier in UUID format.
- Key
Material stringExpire Time - Key material expiration time. If empty, the key does not expire.
- Key
State string - Key status: Enable, Disable, PendingDelete, Archived, PendingImport.
- Last
Rotation stringTime - Key last rotation time.
- Multi
Region KeyConfiguration Multi Region Configuration - Multi-region key configuration information.
- Rotate
State string - Key rotation status. Options: Enable, Disable.
- Schedule
Delete stringTime - Key deletion time.
- Schedule
Rotation stringTime - Key rotation time.
- Trn string
- Resource name. Format should be trn:${Service}:${Region}:${AccountID}:${ResourcePath}.
- Updated
Time int - Key update time.
- created_
time number - Key creation time.
- id string
- The provider-assigned unique ID for this managed resource.
- key_
id string - Key unique identifier in UUID format.
- key_
material_ stringexpire_ time - Key material expiration time. If empty, the key does not expire.
- key_
state string - Key status: Enable, Disable, PendingDelete, Archived, PendingImport.
- last_
rotation_ stringtime - Key last rotation time.
- multi_
region_ objectconfiguration - Multi-region key configuration information.
- rotate_
state string - Key rotation status. Options: Enable, Disable.
- schedule_
delete_ stringtime - Key deletion time.
- schedule_
rotation_ stringtime - Key rotation time.
- trn string
- Resource name. Format should be trn:${Service}:${Region}:${AccountID}:${ResourcePath}.
- updated_
time number - Key update time.
- created
Time Integer - Key creation time.
- id String
- The provider-assigned unique ID for this managed resource.
- key
Id String - Key unique identifier in UUID format.
- key
Material StringExpire Time - Key material expiration time. If empty, the key does not expire.
- key
State String - Key status: Enable, Disable, PendingDelete, Archived, PendingImport.
- last
Rotation StringTime - Key last rotation time.
- multi
Region KeyConfiguration Multi Region Configuration - Multi-region key configuration information.
- rotate
State String - Key rotation status. Options: Enable, Disable.
- schedule
Delete StringTime - Key deletion time.
- schedule
Rotation StringTime - Key rotation time.
- trn String
- Resource name. Format should be trn:${Service}:${Region}:${AccountID}:${ResourcePath}.
- updated
Time Integer - Key update time.
- created
Time number - Key creation time.
- id string
- The provider-assigned unique ID for this managed resource.
- key
Id string - Key unique identifier in UUID format.
- key
Material stringExpire Time - Key material expiration time. If empty, the key does not expire.
- key
State string - Key status: Enable, Disable, PendingDelete, Archived, PendingImport.
- last
Rotation stringTime - Key last rotation time.
- multi
Region KeyConfiguration Multi Region Configuration - Multi-region key configuration information.
- rotate
State string - Key rotation status. Options: Enable, Disable.
- schedule
Delete stringTime - Key deletion time.
- schedule
Rotation stringTime - Key rotation time.
- trn string
- Resource name. Format should be trn:${Service}:${Region}:${AccountID}:${ResourcePath}.
- updated
Time number - Key update time.
- created_
time int - Key creation time.
- id str
- The provider-assigned unique ID for this managed resource.
- key_
id str - Key unique identifier in UUID format.
- key_
material_ strexpire_ time - Key material expiration time. If empty, the key does not expire.
- key_
state str - Key status: Enable, Disable, PendingDelete, Archived, PendingImport.
- last_
rotation_ strtime - Key last rotation time.
- multi_
region_ Keyconfiguration Multi Region Configuration - Multi-region key configuration information.
- rotate_
state str - Key rotation status. Options: Enable, Disable.
- schedule_
delete_ strtime - Key deletion time.
- schedule_
rotation_ strtime - Key rotation time.
- trn str
- Resource name. Format should be trn:${Service}:${Region}:${AccountID}:${ResourcePath}.
- updated_
time int - Key update time.
- created
Time Number - Key creation time.
- id String
- The provider-assigned unique ID for this managed resource.
- key
Id String - Key unique identifier in UUID format.
- key
Material StringExpire Time - Key material expiration time. If empty, the key does not expire.
- key
State String - Key status: Enable, Disable, PendingDelete, Archived, PendingImport.
- last
Rotation StringTime - Key last rotation time.
- multi
Region Property MapConfiguration - Multi-region key configuration information.
- rotate
State String - Key rotation status. Options: Enable, Disable.
- schedule
Delete StringTime - Key deletion time.
- schedule
Rotation StringTime - Key rotation time.
- trn String
- Resource name. Format should be trn:${Service}:${Region}:${AccountID}:${ResourcePath}.
- updated
Time Number - Key update time.
Look up Existing Key Resource
Get an existing Key resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: KeyState, opts?: CustomResourceOptions): Key@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
asymmetric_ciphertext: Optional[KeyAsymmetricCiphertextArgs] = None,
asymmetric_signature: Optional[KeyAsymmetricSignatureArgs] = None,
ciphertext: Optional[KeyCiphertextArgs] = None,
created_time: Optional[int] = None,
description: Optional[str] = None,
key_archive_operation: Optional[int] = None,
key_enable_operation: Optional[int] = None,
key_id: Optional[str] = None,
key_material_expire_time: Optional[str] = None,
key_name: Optional[str] = None,
key_primary_region: Optional[str] = None,
key_rotation_operation: Optional[int] = None,
key_spec: Optional[str] = None,
key_state: Optional[str] = None,
key_usage: Optional[str] = None,
keyring_name: Optional[str] = None,
last_rotation_time: Optional[str] = None,
multi_region: Optional[bool] = None,
multi_region_configuration: Optional[KeyMultiRegionConfigurationArgs] = None,
origin: Optional[str] = None,
protection_level: Optional[str] = None,
re_encrypt: Optional[KeyReEncryptArgs] = None,
replicate_key: Optional[KeyReplicateKeyArgs] = None,
rotate_interval: Optional[int] = None,
rotate_state: Optional[str] = None,
schedule_delete_time: Optional[str] = None,
schedule_rotation_time: Optional[str] = None,
tags: Optional[Sequence[KeyTagArgs]] = None,
trn: Optional[str] = None,
updated_time: Optional[int] = None) -> Keyfunc GetKey(ctx *Context, name string, id IDInput, state *KeyState, opts ...ResourceOption) (*Key, error)public static Key Get(string name, Input<string> id, KeyState? state, CustomResourceOptions? opts = null)public static Key get(String name, Output<String> id, KeyState state, CustomResourceOptions options)resources: _: type: volcenginecc:kms:Key get: id: ${id}import {
to = volcenginecc_kms_key.example
id = "${id}"
}
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Asymmetric
Ciphertext Volcengine.Key Asymmetric Ciphertext - Asymmetric encryption action parameters and results. AsymmetricEncrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- Asymmetric
Signature Volcengine.Key Asymmetric Signature - Asymmetric signature action parameters and results. AsymmetricSign can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- Ciphertext
Volcengine.
Key Ciphertext - Symmetric encryption action parameters and results. Encrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- Created
Time int - Key creation time.
- Description string
- Key description: Length 0–8192 characters.
- Key
Archive intOperation - User master key archive operation (enter 1 to archive, 2 to unarchive).
- Key
Enable intOperation - User master key enable operation (enter 1 to enable, 2 to disable).
- Key
Id string - Key unique identifier in UUID format.
- Key
Material stringExpire Time - Key material expiration time. If empty, the key does not expire.
- Key
Name string - Master key name. Length 2–31 characters. Valid characters: [a-zA-Z0-9-_].
- Key
Primary stringRegion - Primary region of the multi-region key. Set the target primary region during the Create/Update phase; the current primary region is returned during the Read phase.
- Key
Rotation intOperation - User master key rotation operation (enter 1 to enable, 2 to disable).
- Key
Spec string - Symmetric keys: SYMMETRIC256, SYMMETRIC128; asymmetric keys: RSA2048, RSA3072, RSA4096, ECP256, ECP256K, ECP384, ECP521, ECSM2.
- Key
State stringValue - Key status: Enable, Disable, PendingDelete, Archived, PendingImport.
- Key
Usage string - Key usage. Options: ENCRYPTDECRYPT, SIGNVERIFY, GENERATEVERIFYMAC.
- Keyring
Name string - Key ring name. Length 2–31 characters. Valid characters: [a-zA-Z0-9-_].
- Last
Rotation stringTime - Key last rotation time.
- Multi
Region bool - Is this a multi-region type master key.
- Multi
Region Volcengine.Configuration Key Multi Region Configuration - Multi-region key configuration information.
- Origin string
- Key source. Options: CloudKMS, External, ExternalKeyStore.
- Protection
Level string - Key protection level. Options: SOFTWARE, HSM.
- Re
Encrypt Volcengine.Key Re Encrypt - Re-encryption action parameters and results. ReEncrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- Replicate
Key Volcengine.Key Replicate Key - Replicate key action parameters and results. ReplicateKey can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- Rotate
Interval int - Key rotation period (days). Range: [90, 2560].
- Rotate
State string - Key rotation status. Options: Enable, Disable.
- Schedule
Delete stringTime - Key deletion time.
- Schedule
Rotation stringTime - Key rotation time.
-
List<Volcengine.
Key Tag> - Trn string
- Resource name. Format should be trn:${Service}:${Region}:${AccountID}:${ResourcePath}.
- Updated
Time int - Key update time.
- Asymmetric
Ciphertext KeyAsymmetric Ciphertext Args - Asymmetric encryption action parameters and results. AsymmetricEncrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- Asymmetric
Signature KeyAsymmetric Signature Args - Asymmetric signature action parameters and results. AsymmetricSign can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- Ciphertext
Key
Ciphertext Args - Symmetric encryption action parameters and results. Encrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- Created
Time int - Key creation time.
- Description string
- Key description: Length 0–8192 characters.
- Key
Archive intOperation - User master key archive operation (enter 1 to archive, 2 to unarchive).
- Key
Enable intOperation - User master key enable operation (enter 1 to enable, 2 to disable).
- Key
Id string - Key unique identifier in UUID format.
- Key
Material stringExpire Time - Key material expiration time. If empty, the key does not expire.
- Key
Name string - Master key name. Length 2–31 characters. Valid characters: [a-zA-Z0-9-_].
- Key
Primary stringRegion - Primary region of the multi-region key. Set the target primary region during the Create/Update phase; the current primary region is returned during the Read phase.
- Key
Rotation intOperation - User master key rotation operation (enter 1 to enable, 2 to disable).
- Key
Spec string - Symmetric keys: SYMMETRIC256, SYMMETRIC128; asymmetric keys: RSA2048, RSA3072, RSA4096, ECP256, ECP256K, ECP384, ECP521, ECSM2.
- Key
State string - Key status: Enable, Disable, PendingDelete, Archived, PendingImport.
- Key
Usage string - Key usage. Options: ENCRYPTDECRYPT, SIGNVERIFY, GENERATEVERIFYMAC.
- Keyring
Name string - Key ring name. Length 2–31 characters. Valid characters: [a-zA-Z0-9-_].
- Last
Rotation stringTime - Key last rotation time.
- Multi
Region bool - Is this a multi-region type master key.
- Multi
Region KeyConfiguration Multi Region Configuration Args - Multi-region key configuration information.
- Origin string
- Key source. Options: CloudKMS, External, ExternalKeyStore.
- Protection
Level string - Key protection level. Options: SOFTWARE, HSM.
- Re
Encrypt KeyRe Encrypt Args - Re-encryption action parameters and results. ReEncrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- Replicate
Key KeyReplicate Key Args - Replicate key action parameters and results. ReplicateKey can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- Rotate
Interval int - Key rotation period (days). Range: [90, 2560].
- Rotate
State string - Key rotation status. Options: Enable, Disable.
- Schedule
Delete stringTime - Key deletion time.
- Schedule
Rotation stringTime - Key rotation time.
-
[]Key
Tag Args - Trn string
- Resource name. Format should be trn:${Service}:${Region}:${AccountID}:${ResourcePath}.
- Updated
Time int - Key update time.
- asymmetric_
ciphertext object - Asymmetric encryption action parameters and results. AsymmetricEncrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- asymmetric_
signature object - Asymmetric signature action parameters and results. AsymmetricSign can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- ciphertext object
- Symmetric encryption action parameters and results. Encrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- created_
time number - Key creation time.
- description string
- Key description: Length 0–8192 characters.
- key_
archive_ numberoperation - User master key archive operation (enter 1 to archive, 2 to unarchive).
- key_
enable_ numberoperation - User master key enable operation (enter 1 to enable, 2 to disable).
- key_
id string - Key unique identifier in UUID format.
- key_
material_ stringexpire_ time - Key material expiration time. If empty, the key does not expire.
- key_
name string - Master key name. Length 2–31 characters. Valid characters: [a-zA-Z0-9-_].
- key_
primary_ stringregion - Primary region of the multi-region key. Set the target primary region during the Create/Update phase; the current primary region is returned during the Read phase.
- key_
rotation_ numberoperation - User master key rotation operation (enter 1 to enable, 2 to disable).
- key_
spec string - Symmetric keys: SYMMETRIC256, SYMMETRIC128; asymmetric keys: RSA2048, RSA3072, RSA4096, ECP256, ECP256K, ECP384, ECP521, ECSM2.
- key_
state string - Key status: Enable, Disable, PendingDelete, Archived, PendingImport.
- key_
usage string - Key usage. Options: ENCRYPTDECRYPT, SIGNVERIFY, GENERATEVERIFYMAC.
- keyring_
name string - Key ring name. Length 2–31 characters. Valid characters: [a-zA-Z0-9-_].
- last_
rotation_ stringtime - Key last rotation time.
- multi_
region bool - Is this a multi-region type master key.
- multi_
region_ objectconfiguration - Multi-region key configuration information.
- origin string
- Key source. Options: CloudKMS, External, ExternalKeyStore.
- protection_
level string - Key protection level. Options: SOFTWARE, HSM.
- re_
encrypt object - Re-encryption action parameters and results. ReEncrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- replicate_
key object - Replicate key action parameters and results. ReplicateKey can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- rotate_
interval number - Key rotation period (days). Range: [90, 2560].
- rotate_
state string - Key rotation status. Options: Enable, Disable.
- schedule_
delete_ stringtime - Key deletion time.
- schedule_
rotation_ stringtime - Key rotation time.
- list(object)
- trn string
- Resource name. Format should be trn:${Service}:${Region}:${AccountID}:${ResourcePath}.
- updated_
time number - Key update time.
- asymmetric
Ciphertext KeyAsymmetric Ciphertext - Asymmetric encryption action parameters and results. AsymmetricEncrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- asymmetric
Signature KeyAsymmetric Signature - Asymmetric signature action parameters and results. AsymmetricSign can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- ciphertext
Key
Ciphertext - Symmetric encryption action parameters and results. Encrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- created
Time Integer - Key creation time.
- description String
- Key description: Length 0–8192 characters.
- key
Archive IntegerOperation - User master key archive operation (enter 1 to archive, 2 to unarchive).
- key
Enable IntegerOperation - User master key enable operation (enter 1 to enable, 2 to disable).
- key
Id String - Key unique identifier in UUID format.
- key
Material StringExpire Time - Key material expiration time. If empty, the key does not expire.
- key
Name String - Master key name. Length 2–31 characters. Valid characters: [a-zA-Z0-9-_].
- key
Primary StringRegion - Primary region of the multi-region key. Set the target primary region during the Create/Update phase; the current primary region is returned during the Read phase.
- key
Rotation IntegerOperation - User master key rotation operation (enter 1 to enable, 2 to disable).
- key
Spec String - Symmetric keys: SYMMETRIC256, SYMMETRIC128; asymmetric keys: RSA2048, RSA3072, RSA4096, ECP256, ECP256K, ECP384, ECP521, ECSM2.
- key
State String - Key status: Enable, Disable, PendingDelete, Archived, PendingImport.
- key
Usage String - Key usage. Options: ENCRYPTDECRYPT, SIGNVERIFY, GENERATEVERIFYMAC.
- keyring
Name String - Key ring name. Length 2–31 characters. Valid characters: [a-zA-Z0-9-_].
- last
Rotation StringTime - Key last rotation time.
- multi
Region Boolean - Is this a multi-region type master key.
- multi
Region KeyConfiguration Multi Region Configuration - Multi-region key configuration information.
- origin String
- Key source. Options: CloudKMS, External, ExternalKeyStore.
- protection
Level String - Key protection level. Options: SOFTWARE, HSM.
- re
Encrypt KeyRe Encrypt - Re-encryption action parameters and results. ReEncrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- replicate
Key KeyReplicate Key - Replicate key action parameters and results. ReplicateKey can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- rotate
Interval Integer - Key rotation period (days). Range: [90, 2560].
- rotate
State String - Key rotation status. Options: Enable, Disable.
- schedule
Delete StringTime - Key deletion time.
- schedule
Rotation StringTime - Key rotation time.
-
List<Key
Tag> - trn String
- Resource name. Format should be trn:${Service}:${Region}:${AccountID}:${ResourcePath}.
- updated
Time Integer - Key update time.
- asymmetric
Ciphertext KeyAsymmetric Ciphertext - Asymmetric encryption action parameters and results. AsymmetricEncrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- asymmetric
Signature KeyAsymmetric Signature - Asymmetric signature action parameters and results. AsymmetricSign can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- ciphertext
Key
Ciphertext - Symmetric encryption action parameters and results. Encrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- created
Time number - Key creation time.
- description string
- Key description: Length 0–8192 characters.
- key
Archive numberOperation - User master key archive operation (enter 1 to archive, 2 to unarchive).
- key
Enable numberOperation - User master key enable operation (enter 1 to enable, 2 to disable).
- key
Id string - Key unique identifier in UUID format.
- key
Material stringExpire Time - Key material expiration time. If empty, the key does not expire.
- key
Name string - Master key name. Length 2–31 characters. Valid characters: [a-zA-Z0-9-_].
- key
Primary stringRegion - Primary region of the multi-region key. Set the target primary region during the Create/Update phase; the current primary region is returned during the Read phase.
- key
Rotation numberOperation - User master key rotation operation (enter 1 to enable, 2 to disable).
- key
Spec string - Symmetric keys: SYMMETRIC256, SYMMETRIC128; asymmetric keys: RSA2048, RSA3072, RSA4096, ECP256, ECP256K, ECP384, ECP521, ECSM2.
- key
State string - Key status: Enable, Disable, PendingDelete, Archived, PendingImport.
- key
Usage string - Key usage. Options: ENCRYPTDECRYPT, SIGNVERIFY, GENERATEVERIFYMAC.
- keyring
Name string - Key ring name. Length 2–31 characters. Valid characters: [a-zA-Z0-9-_].
- last
Rotation stringTime - Key last rotation time.
- multi
Region boolean - Is this a multi-region type master key.
- multi
Region KeyConfiguration Multi Region Configuration - Multi-region key configuration information.
- origin string
- Key source. Options: CloudKMS, External, ExternalKeyStore.
- protection
Level string - Key protection level. Options: SOFTWARE, HSM.
- re
Encrypt KeyRe Encrypt - Re-encryption action parameters and results. ReEncrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- replicate
Key KeyReplicate Key - Replicate key action parameters and results. ReplicateKey can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- rotate
Interval number - Key rotation period (days). Range: [90, 2560].
- rotate
State string - Key rotation status. Options: Enable, Disable.
- schedule
Delete stringTime - Key deletion time.
- schedule
Rotation stringTime - Key rotation time.
-
Key
Tag[] - trn string
- Resource name. Format should be trn:${Service}:${Region}:${AccountID}:${ResourcePath}.
- updated
Time number - Key update time.
- asymmetric_
ciphertext KeyAsymmetric Ciphertext Args - Asymmetric encryption action parameters and results. AsymmetricEncrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- asymmetric_
signature KeyAsymmetric Signature Args - Asymmetric signature action parameters and results. AsymmetricSign can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- ciphertext
Key
Ciphertext Args - Symmetric encryption action parameters and results. Encrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- created_
time int - Key creation time.
- description str
- Key description: Length 0–8192 characters.
- key_
archive_ intoperation - User master key archive operation (enter 1 to archive, 2 to unarchive).
- key_
enable_ intoperation - User master key enable operation (enter 1 to enable, 2 to disable).
- key_
id str - Key unique identifier in UUID format.
- key_
material_ strexpire_ time - Key material expiration time. If empty, the key does not expire.
- key_
name str - Master key name. Length 2–31 characters. Valid characters: [a-zA-Z0-9-_].
- key_
primary_ strregion - Primary region of the multi-region key. Set the target primary region during the Create/Update phase; the current primary region is returned during the Read phase.
- key_
rotation_ intoperation - User master key rotation operation (enter 1 to enable, 2 to disable).
- key_
spec str - Symmetric keys: SYMMETRIC256, SYMMETRIC128; asymmetric keys: RSA2048, RSA3072, RSA4096, ECP256, ECP256K, ECP384, ECP521, ECSM2.
- key_
state str - Key status: Enable, Disable, PendingDelete, Archived, PendingImport.
- key_
usage str - Key usage. Options: ENCRYPTDECRYPT, SIGNVERIFY, GENERATEVERIFYMAC.
- keyring_
name str - Key ring name. Length 2–31 characters. Valid characters: [a-zA-Z0-9-_].
- last_
rotation_ strtime - Key last rotation time.
- multi_
region bool - Is this a multi-region type master key.
- multi_
region_ Keyconfiguration Multi Region Configuration Args - Multi-region key configuration information.
- origin str
- Key source. Options: CloudKMS, External, ExternalKeyStore.
- protection_
level str - Key protection level. Options: SOFTWARE, HSM.
- re_
encrypt KeyRe Encrypt Args - Re-encryption action parameters and results. ReEncrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- replicate_
key KeyReplicate Key Args - Replicate key action parameters and results. ReplicateKey can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- rotate_
interval int - Key rotation period (days). Range: [90, 2560].
- rotate_
state str - Key rotation status. Options: Enable, Disable.
- schedule_
delete_ strtime - Key deletion time.
- schedule_
rotation_ strtime - Key rotation time.
-
Sequence[Key
Tag Args] - trn str
- Resource name. Format should be trn:${Service}:${Region}:${AccountID}:${ResourcePath}.
- updated_
time int - Key update time.
- asymmetric
Ciphertext Property Map - Asymmetric encryption action parameters and results. AsymmetricEncrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- asymmetric
Signature Property Map - Asymmetric signature action parameters and results. AsymmetricSign can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- ciphertext Property Map
- Symmetric encryption action parameters and results. Encrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- created
Time Number - Key creation time.
- description String
- Key description: Length 0–8192 characters.
- key
Archive NumberOperation - User master key archive operation (enter 1 to archive, 2 to unarchive).
- key
Enable NumberOperation - User master key enable operation (enter 1 to enable, 2 to disable).
- key
Id String - Key unique identifier in UUID format.
- key
Material StringExpire Time - Key material expiration time. If empty, the key does not expire.
- key
Name String - Master key name. Length 2–31 characters. Valid characters: [a-zA-Z0-9-_].
- key
Primary StringRegion - Primary region of the multi-region key. Set the target primary region during the Create/Update phase; the current primary region is returned during the Read phase.
- key
Rotation NumberOperation - User master key rotation operation (enter 1 to enable, 2 to disable).
- key
Spec String - Symmetric keys: SYMMETRIC256, SYMMETRIC128; asymmetric keys: RSA2048, RSA3072, RSA4096, ECP256, ECP256K, ECP384, ECP521, ECSM2.
- key
State String - Key status: Enable, Disable, PendingDelete, Archived, PendingImport.
- key
Usage String - Key usage. Options: ENCRYPTDECRYPT, SIGNVERIFY, GENERATEVERIFYMAC.
- keyring
Name String - Key ring name. Length 2–31 characters. Valid characters: [a-zA-Z0-9-_].
- last
Rotation StringTime - Key last rotation time.
- multi
Region Boolean - Is this a multi-region type master key.
- multi
Region Property MapConfiguration - Multi-region key configuration information.
- origin String
- Key source. Options: CloudKMS, External, ExternalKeyStore.
- protection
Level String - Key protection level. Options: SOFTWARE, HSM.
- re
Encrypt Property Map - Re-encryption action parameters and results. ReEncrypt can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- replicate
Key Property Map - Replicate key action parameters and results. ReplicateKey can be triggered during the Create/Update phase; the result is only guaranteed to be returned in the current response.
- rotate
Interval Number - Key rotation period (days). Range: [90, 2560].
- rotate
State String - Key rotation status. Options: Enable, Disable.
- schedule
Delete StringTime - Key deletion time.
- schedule
Rotation StringTime - Key rotation time.
- List<Property Map>
- trn String
- Resource name. Format should be trn:${Service}:${Region}:${AccountID}:${ResourcePath}.
- updated
Time Number - Key update time.
Supporting Types
KeyAsymmetricCiphertext, KeyAsymmetricCiphertextArgs
- Algorithm string
- Encryption algorithm. Optional values: RSAESOAEPSHA_256, SM2PKE.
- Ciphertext
Blob string - Ciphertext of encryption result, Base64-encoded.
- Plaintext string
- Plaintext to be encrypted, Base64-encoded.
- Algorithm string
- Encryption algorithm. Optional values: RSAESOAEPSHA_256, SM2PKE.
- Ciphertext
Blob string - Ciphertext of encryption result, Base64-encoded.
- Plaintext string
- Plaintext to be encrypted, Base64-encoded.
- algorithm string
- Encryption algorithm. Optional values: RSAESOAEPSHA_256, SM2PKE.
- ciphertext_
blob string - Ciphertext of encryption result, Base64-encoded.
- plaintext string
- Plaintext to be encrypted, Base64-encoded.
- algorithm String
- Encryption algorithm. Optional values: RSAESOAEPSHA_256, SM2PKE.
- ciphertext
Blob String - Ciphertext of encryption result, Base64-encoded.
- plaintext String
- Plaintext to be encrypted, Base64-encoded.
- algorithm string
- Encryption algorithm. Optional values: RSAESOAEPSHA_256, SM2PKE.
- ciphertext
Blob string - Ciphertext of encryption result, Base64-encoded.
- plaintext string
- Plaintext to be encrypted, Base64-encoded.
- algorithm str
- Encryption algorithm. Optional values: RSAESOAEPSHA_256, SM2PKE.
- ciphertext_
blob str - Ciphertext of encryption result, Base64-encoded.
- plaintext str
- Plaintext to be encrypted, Base64-encoded.
- algorithm String
- Encryption algorithm. Optional values: RSAESOAEPSHA_256, SM2PKE.
- ciphertext
Blob String - Ciphertext of encryption result, Base64-encoded.
- plaintext String
- Plaintext to be encrypted, Base64-encoded.
KeyAsymmetricSignature, KeyAsymmetricSignatureArgs
- Algorithm string
- Signature algorithm, for example: RSAPSSSHA256, RSAPKCS1SHA256, ECDSASHA256, SM2_DSA.
- Message string
- Message to be signed, Base64-encoded.
- Message
Type string - Message type. Optional values: RAW, DIGEST.
- Signature string
- Signature result, Base64-encoded.
- Algorithm string
- Signature algorithm, for example: RSAPSSSHA256, RSAPKCS1SHA256, ECDSASHA256, SM2_DSA.
- Message string
- Message to be signed, Base64-encoded.
- Message
Type string - Message type. Optional values: RAW, DIGEST.
- Signature string
- Signature result, Base64-encoded.
- algorithm string
- Signature algorithm, for example: RSAPSSSHA256, RSAPKCS1SHA256, ECDSASHA256, SM2_DSA.
- message string
- Message to be signed, Base64-encoded.
- message_
type string - Message type. Optional values: RAW, DIGEST.
- signature string
- Signature result, Base64-encoded.
- algorithm String
- Signature algorithm, for example: RSAPSSSHA256, RSAPKCS1SHA256, ECDSASHA256, SM2_DSA.
- message String
- Message to be signed, Base64-encoded.
- message
Type String - Message type. Optional values: RAW, DIGEST.
- signature String
- Signature result, Base64-encoded.
- algorithm string
- Signature algorithm, for example: RSAPSSSHA256, RSAPKCS1SHA256, ECDSASHA256, SM2_DSA.
- message string
- Message to be signed, Base64-encoded.
- message
Type string - Message type. Optional values: RAW, DIGEST.
- signature string
- Signature result, Base64-encoded.
- algorithm str
- Signature algorithm, for example: RSAPSSSHA256, RSAPKCS1SHA256, ECDSASHA256, SM2_DSA.
- message str
- Message to be signed, Base64-encoded.
- message_
type str - Message type. Optional values: RAW, DIGEST.
- signature str
- Signature result, Base64-encoded.
- algorithm String
- Signature algorithm, for example: RSAPSSSHA256, RSAPKCS1SHA256, ECDSASHA256, SM2_DSA.
- message String
- Message to be signed, Base64-encoded.
- message
Type String - Message type. Optional values: RAW, DIGEST.
- signature String
- Signature result, Base64-encoded.
KeyCiphertext, KeyCiphertextArgs
- Ciphertext
Blob string - Ciphertext of encryption result, Base64-encoded.
- Encryption
Context string - Encryption context JSON string.
- Plaintext string
- Plaintext to be encrypted, Base64-encoded.
- Ciphertext
Blob string - Ciphertext of encryption result, Base64-encoded.
- Encryption
Context string - Encryption context JSON string.
- Plaintext string
- Plaintext to be encrypted, Base64-encoded.
- ciphertext_
blob string - Ciphertext of encryption result, Base64-encoded.
- encryption_
context string - Encryption context JSON string.
- plaintext string
- Plaintext to be encrypted, Base64-encoded.
- ciphertext
Blob String - Ciphertext of encryption result, Base64-encoded.
- encryption
Context String - Encryption context JSON string.
- plaintext String
- Plaintext to be encrypted, Base64-encoded.
- ciphertext
Blob string - Ciphertext of encryption result, Base64-encoded.
- encryption
Context string - Encryption context JSON string.
- plaintext string
- Plaintext to be encrypted, Base64-encoded.
- ciphertext_
blob str - Ciphertext of encryption result, Base64-encoded.
- encryption_
context str - Encryption context JSON string.
- plaintext str
- Plaintext to be encrypted, Base64-encoded.
- ciphertext
Blob String - Ciphertext of encryption result, Base64-encoded.
- encryption
Context String - Encryption context JSON string.
- plaintext String
- Plaintext to be encrypted, Base64-encoded.
KeyMultiRegionConfiguration, KeyMultiRegionConfigurationArgs
- Multi
Region stringKey Type - Multi-region key type.
- Primary
Key Volcengine.Key Multi Region Configuration Primary Key - Primary multi-region key transaction identifier and region ID.
- Replica
Keys List<Volcengine.Key Multi Region Configuration Replica Key>
- Multi
Region stringKey Type - Multi-region key type.
- Primary
Key KeyMulti Region Configuration Primary Key - Primary multi-region key transaction identifier and region ID.
- Replica
Keys []KeyMulti Region Configuration Replica Key
- multi_
region_ stringkey_ type - Multi-region key type.
- primary_
key object - Primary multi-region key transaction identifier and region ID.
- replica_
keys list(object)
- multi
Region StringKey Type - Multi-region key type.
- primary
Key KeyMulti Region Configuration Primary Key - Primary multi-region key transaction identifier and region ID.
- replica
Keys List<KeyMulti Region Configuration Replica Key>
- multi
Region stringKey Type - Multi-region key type.
- primary
Key KeyMulti Region Configuration Primary Key - Primary multi-region key transaction identifier and region ID.
- replica
Keys KeyMulti Region Configuration Replica Key[]
- multi_
region_ strkey_ type - Multi-region key type.
- primary_
key KeyMulti Region Configuration Primary Key - Primary multi-region key transaction identifier and region ID.
- replica_
keys Sequence[KeyMulti Region Configuration Replica Key]
- multi
Region StringKey Type - Multi-region key type.
- primary
Key Property Map - Primary multi-region key transaction identifier and region ID.
- replica
Keys List<Property Map>
KeyMultiRegionConfigurationPrimaryKey, KeyMultiRegionConfigurationPrimaryKeyArgs
KeyMultiRegionConfigurationReplicaKey, KeyMultiRegionConfigurationReplicaKeyArgs
KeyReEncrypt, KeyReEncryptArgs
- Ciphertext
Blob string - Re-encrypted ciphertext, Base64-encoded.
- New
Encryption stringContext - New encryption context JSON string.
- New
Key stringId - Target key ID. If not specified, you must provide NewKeyringName and NewKeyName.
- New
Key stringName - Target key name.
- New
Keyring stringName - Name of the keyring to which the target key belongs.
- Old
Encryption stringContext - Old encryption context JSON string.
- Source
Ciphertext stringBlob - Source ciphertext to be re-encrypted, Base64-encoded.
- Ciphertext
Blob string - Re-encrypted ciphertext, Base64-encoded.
- New
Encryption stringContext - New encryption context JSON string.
- New
Key stringId - Target key ID. If not specified, you must provide NewKeyringName and NewKeyName.
- New
Key stringName - Target key name.
- New
Keyring stringName - Name of the keyring to which the target key belongs.
- Old
Encryption stringContext - Old encryption context JSON string.
- Source
Ciphertext stringBlob - Source ciphertext to be re-encrypted, Base64-encoded.
- ciphertext_
blob string - Re-encrypted ciphertext, Base64-encoded.
- new_
encryption_ stringcontext - New encryption context JSON string.
- new_
key_ stringid - Target key ID. If not specified, you must provide NewKeyringName and NewKeyName.
- new_
key_ stringname - Target key name.
- new_
keyring_ stringname - Name of the keyring to which the target key belongs.
- old_
encryption_ stringcontext - Old encryption context JSON string.
- source_
ciphertext_ stringblob - Source ciphertext to be re-encrypted, Base64-encoded.
- ciphertext
Blob String - Re-encrypted ciphertext, Base64-encoded.
- new
Encryption StringContext - New encryption context JSON string.
- new
Key StringId - Target key ID. If not specified, you must provide NewKeyringName and NewKeyName.
- new
Key StringName - Target key name.
- new
Keyring StringName - Name of the keyring to which the target key belongs.
- old
Encryption StringContext - Old encryption context JSON string.
- source
Ciphertext StringBlob - Source ciphertext to be re-encrypted, Base64-encoded.
- ciphertext
Blob string - Re-encrypted ciphertext, Base64-encoded.
- new
Encryption stringContext - New encryption context JSON string.
- new
Key stringId - Target key ID. If not specified, you must provide NewKeyringName and NewKeyName.
- new
Key stringName - Target key name.
- new
Keyring stringName - Name of the keyring to which the target key belongs.
- old
Encryption stringContext - Old encryption context JSON string.
- source
Ciphertext stringBlob - Source ciphertext to be re-encrypted, Base64-encoded.
- ciphertext_
blob str - Re-encrypted ciphertext, Base64-encoded.
- new_
encryption_ strcontext - New encryption context JSON string.
- new_
key_ strid - Target key ID. If not specified, you must provide NewKeyringName and NewKeyName.
- new_
key_ strname - Target key name.
- new_
keyring_ strname - Name of the keyring to which the target key belongs.
- old_
encryption_ strcontext - Old encryption context JSON string.
- source_
ciphertext_ strblob - Source ciphertext to be re-encrypted, Base64-encoded.
- ciphertext
Blob String - Re-encrypted ciphertext, Base64-encoded.
- new
Encryption StringContext - New encryption context JSON string.
- new
Key StringId - Target key ID. If not specified, you must provide NewKeyringName and NewKeyName.
- new
Key StringName - Target key name.
- new
Keyring StringName - Name of the keyring to which the target key belongs.
- old
Encryption StringContext - Old encryption context JSON string.
- source
Ciphertext StringBlob - Source ciphertext to be re-encrypted, Base64-encoded.
KeyReplicateKey, KeyReplicateKeyArgs
- Description string
- Replica key description.
- Replica
Key stringId - Replica key ID.
- Replica
Region string - Target region of the replica key.
-
List<Volcengine.
Key Replicate Key Tag>
- Description string
- Replica key description.
- Replica
Key stringId - Replica key ID.
- Replica
Region string - Target region of the replica key.
-
[]Key
Replicate Key Tag
- description string
- Replica key description.
- replica_
key_ stringid - Replica key ID.
- replica_
region string - Target region of the replica key.
- list(object)
- description String
- Replica key description.
- replica
Key StringId - Replica key ID.
- replica
Region String - Target region of the replica key.
-
List<Key
Replicate Key Tag>
- description string
- Replica key description.
- replica
Key stringId - Replica key ID.
- replica
Region string - Target region of the replica key.
-
Key
Replicate Key Tag[]
- description str
- Replica key description.
- replica_
key_ strid - Replica key ID.
- replica_
region str - Target region of the replica key.
-
Sequence[Key
Replicate Key Tag]
- description String
- Replica key description.
- replica
Key StringId - Replica key ID.
- replica
Region String - Target region of the replica key.
- List<Property Map>
KeyReplicateKeyTag, KeyReplicateKeyTagArgs
KeyTag, KeyTagArgs
Import
$ pulumi import volcenginecc:kms/key:Key example "keyring_name|key_id"
To learn more about importing existing cloud resources, see Importing resources.
Package Details
- Repository
- volcenginecc volcengine/pulumi-volcenginecc
- License
- MPL-2.0
- Notes
- This Pulumi package is based on the
volcengineccTerraform Provider.
published on Monday, Jun 1, 2026 by Volcengine