software.amazon.awscdk.services.kms.CfnReplicaKey Maven / Gradle / Ivy
package software.amazon.awscdk.services.kms;
/**
* A CloudFormation `AWS::KMS::ReplicaKey`.
*
* The AWS::KMS::ReplicaKey resource specifies a multi-Region replica key that is based on a multi-Region primary key.
*
* Multi-Region keys are an AWS KMS feature that lets you create multiple interoperable KMS keys in different AWS Regions . Because these KMS keys have the same key ID, key material, and other metadata, you can use them to encrypt data in one AWS Region and decrypt it in a different AWS Region without making a cross-Region call or exposing the plaintext data. For more information, see Multi-Region keys in the AWS Key Management Service Developer Guide .
*
* A multi-Region primary key is a fully functional symmetric or asymmetric KMS key that is also the model for replica keys in other AWS Regions . To create a multi-Region primary key, add an AWS::KMS::Key resource to your CloudFormation stack. Set its MultiRegion property to true.
*
* A multi-Region replica key is a fully functional symmetric or asymmetric KMS key that has the same key ID and key material as a multi-Region primary key, but is located in a different AWS Region of the same AWS partition. There can be multiple replicas of a primary key, but each must be in a different AWS Region .
*
* A primary key and its replicas have the same key ID and key material. They also have the same key spec, key usage, key material origin, and automatic key rotation status. These properties are known as shared properties . If they change, AWS KMS synchronizes the change to all related multi-Region keys. All other properties of a replica key can differ, including its key policy, tags, aliases, and key state. AWS KMS does not synchronize these properties.
*
* Regions
*
* AWS KMS CloudFormation resources are supported in all Regions in which AWS CloudFormation is supported. However, in the (ap-southeast-3), you cannot use a CloudFormation template to create or manage multi-Region KMS keys (primary or replica).
*
* Example:
*
*
* // The code below shows an example of how to instantiate this type.
* // The values are placeholders you should change.
* import software.amazon.awscdk.services.kms.*;
* Object keyPolicy;
* CfnReplicaKey cfnReplicaKey = CfnReplicaKey.Builder.create(this, "MyCfnReplicaKey")
* .keyPolicy(keyPolicy)
* .primaryKeyArn("primaryKeyArn")
* // the properties below are optional
* .description("description")
* .enabled(false)
* .pendingWindowInDays(123)
* .tags(List.of(CfnTag.builder()
* .key("key")
* .value("value")
* .build()))
* .build();
*
*/
@javax.annotation.Generated(value = "jsii-pacmak/1.54.0 (build b1b977a)", date = "2022-03-01T02:28:59.896Z")
@software.amazon.jsii.Stability(software.amazon.jsii.Stability.Level.Stable)
@software.amazon.jsii.Jsii(module = software.amazon.awscdk.services.kms.$Module.class, fqn = "@aws-cdk/aws-kms.CfnReplicaKey")
public class CfnReplicaKey extends software.amazon.awscdk.core.CfnResource implements software.amazon.awscdk.core.IInspectable {
protected CfnReplicaKey(final software.amazon.jsii.JsiiObjectRef objRef) {
super(objRef);
}
protected CfnReplicaKey(final software.amazon.jsii.JsiiObject.InitializationMode initializationMode) {
super(initializationMode);
}
static {
CFN_RESOURCE_TYPE_NAME = software.amazon.jsii.JsiiObject.jsiiStaticGet(software.amazon.awscdk.services.kms.CfnReplicaKey.class, "CFN_RESOURCE_TYPE_NAME", software.amazon.jsii.NativeType.forClass(java.lang.String.class));
}
/**
* Create a new `AWS::KMS::ReplicaKey`.
*
* @param scope - scope in which this resource is defined. This parameter is required.
* @param id - scoped id of the resource. This parameter is required.
* @param props - resource properties. This parameter is required.
*/
@software.amazon.jsii.Stability(software.amazon.jsii.Stability.Level.Stable)
public CfnReplicaKey(final @org.jetbrains.annotations.NotNull software.amazon.awscdk.core.Construct scope, final @org.jetbrains.annotations.NotNull java.lang.String id, final @org.jetbrains.annotations.NotNull software.amazon.awscdk.services.kms.CfnReplicaKeyProps props) {
super(software.amazon.jsii.JsiiObject.InitializationMode.JSII);
software.amazon.jsii.JsiiEngine.getInstance().createNewObject(this, new Object[] { java.util.Objects.requireNonNull(scope, "scope is required"), java.util.Objects.requireNonNull(id, "id is required"), java.util.Objects.requireNonNull(props, "props is required") });
}
/**
* Examines the CloudFormation resource and discloses attributes.
*
* @param inspector - tree inspector to collect and process attributes. This parameter is required.
*/
@software.amazon.jsii.Stability(software.amazon.jsii.Stability.Level.Stable)
@Override
public void inspect(final @org.jetbrains.annotations.NotNull software.amazon.awscdk.core.TreeInspector inspector) {
software.amazon.jsii.Kernel.call(this, "inspect", software.amazon.jsii.NativeType.VOID, new Object[] { java.util.Objects.requireNonNull(inspector, "inspector is required") });
}
/**
* @param props This parameter is required.
*/
@software.amazon.jsii.Stability(software.amazon.jsii.Stability.Level.Stable)
@Override
protected @org.jetbrains.annotations.NotNull java.util.Map renderProperties(final @org.jetbrains.annotations.NotNull java.util.Map props) {
return java.util.Collections.unmodifiableMap(software.amazon.jsii.Kernel.call(this, "renderProperties", software.amazon.jsii.NativeType.mapOf(software.amazon.jsii.NativeType.forClass(java.lang.Object.class)), new Object[] { java.util.Objects.requireNonNull(props, "props is required") }));
}
/**
* The CloudFormation resource type name for this resource class.
*/
@software.amazon.jsii.Stability(software.amazon.jsii.Stability.Level.Stable)
public final static java.lang.String CFN_RESOURCE_TYPE_NAME;
/**
* The Amazon Resource Name (ARN) of the replica key, such as `arn:aws:kms:us-west-2:111122223333:key/mrk-1234abcd12ab34cd56ef1234567890ab` .
*
* The key ARNs of related multi-Region keys differ only in the Region value. For information about the key ARNs of multi-Region keys, see How multi-Region keys work in the AWS Key Management Service Developer Guide .
*/
@software.amazon.jsii.Stability(software.amazon.jsii.Stability.Level.Stable)
public @org.jetbrains.annotations.NotNull java.lang.String getAttrArn() {
return software.amazon.jsii.Kernel.get(this, "attrArn", software.amazon.jsii.NativeType.forClass(java.lang.String.class));
}
/**
* The key ID of the replica key, such as `mrk-1234abcd12ab34cd56ef1234567890ab` .
*
* Related multi-Region keys have the same key ID. For information about the key IDs of multi-Region keys, see How multi-Region keys work in the AWS Key Management Service Developer Guide .
*/
@software.amazon.jsii.Stability(software.amazon.jsii.Stability.Level.Stable)
public @org.jetbrains.annotations.NotNull java.lang.String getAttrKeyId() {
return software.amazon.jsii.Kernel.get(this, "attrKeyId", software.amazon.jsii.NativeType.forClass(java.lang.String.class));
}
/**
*/
@Override
@software.amazon.jsii.Stability(software.amazon.jsii.Stability.Level.Stable)
protected @org.jetbrains.annotations.NotNull java.util.Map getCfnProperties() {
return java.util.Collections.unmodifiableMap(software.amazon.jsii.Kernel.get(this, "cfnProperties", software.amazon.jsii.NativeType.mapOf(software.amazon.jsii.NativeType.forClass(java.lang.Object.class))));
}
/**
* Assigns one or more tags to the replica key.
*
*
*
* Tagging or untagging a KMS key can allow or deny permission to the KMS key. For details, see ABAC for AWS KMS in the AWS Key Management Service Developer Guide .
*
*
*
* Tags are not a shared property of multi-Region keys. You can specify the same tags or different tags for each key in a set of related multi-Region keys. AWS KMS does not synchronize this property.
*
* Each tag consists of a tag key and a tag value. Both the tag key and the tag value are required, but the tag value can be an empty (null) string. You cannot have more than one tag on a KMS key with the same tag key. If you specify an existing tag key with a different tag value, AWS KMS replaces the current tag value with the specified one.
*
* When you assign tags to an AWS resource, AWS generates a cost allocation report with usage and costs aggregated by tags. Tags can also be used to control access to a KMS key. For details, see Tagging keys .
*/
@software.amazon.jsii.Stability(software.amazon.jsii.Stability.Level.Stable)
public @org.jetbrains.annotations.NotNull software.amazon.awscdk.core.TagManager getTags() {
return software.amazon.jsii.Kernel.get(this, "tags", software.amazon.jsii.NativeType.forClass(software.amazon.awscdk.core.TagManager.class));
}
/**
* The key policy that authorizes use of the replica key.
*
* The key policy is not a shared property of multi-Region keys. You can specify the same key policy or a different key policy for each key in a set of related multi-Region keys. AWS KMS does not synchronize this property.
*
* The key policy must conform to the following rules.
*
*
* - The key policy must give the caller PutKeyPolicy permission on the KMS key. This reduces the risk that the KMS key becomes unmanageable. For more information, refer to the scenario in the Default key policy section of the AWS Key Management Service Developer Guide .
* - Each statement in the key policy must contain one or more principals. The principals in the key policy must exist and be visible to AWS KMS . When you create a new AWS principal (for example, an IAM user or role), you might need to enforce a delay before including the new principal in a key policy because the new principal might not be immediately visible to AWS KMS . For more information, see Changes that I make are not always immediately visible in the AWS Identity and Access Management User Guide .
* - The key policy size limit is 32 kilobytes (32768 bytes).
*
*
* Minimum : 1
*
* Maximum : 32768
*/
@software.amazon.jsii.Stability(software.amazon.jsii.Stability.Level.Stable)
public @org.jetbrains.annotations.NotNull java.lang.Object getKeyPolicy() {
return software.amazon.jsii.Kernel.get(this, "keyPolicy", software.amazon.jsii.NativeType.forClass(java.lang.Object.class));
}
/**
* The key policy that authorizes use of the replica key.
*
* The key policy is not a shared property of multi-Region keys. You can specify the same key policy or a different key policy for each key in a set of related multi-Region keys. AWS KMS does not synchronize this property.
*
* The key policy must conform to the following rules.
*
*
* - The key policy must give the caller PutKeyPolicy permission on the KMS key. This reduces the risk that the KMS key becomes unmanageable. For more information, refer to the scenario in the Default key policy section of the AWS Key Management Service Developer Guide .
* - Each statement in the key policy must contain one or more principals. The principals in the key policy must exist and be visible to AWS KMS . When you create a new AWS principal (for example, an IAM user or role), you might need to enforce a delay before including the new principal in a key policy because the new principal might not be immediately visible to AWS KMS . For more information, see Changes that I make are not always immediately visible in the AWS Identity and Access Management User Guide .
* - The key policy size limit is 32 kilobytes (32768 bytes).
*
*
* Minimum : 1
*
* Maximum : 32768
*/
@software.amazon.jsii.Stability(software.amazon.jsii.Stability.Level.Stable)
public void setKeyPolicy(final @org.jetbrains.annotations.NotNull java.lang.Object value) {
software.amazon.jsii.Kernel.set(this, "keyPolicy", java.util.Objects.requireNonNull(value, "keyPolicy is required"));
}
/**
* Specifies the multi-Region primary key to replicate.
*
* The primary key must be in a different AWS Region of the same AWS partition. You can create only one replica of a given primary key in each AWS Region .
*
*
*
* If you change the PrimaryKeyArn value of a replica key, the existing replica key is scheduled for deletion and a new replica key is created based on the specified primary key. While it is scheduled for deletion, the existing replica key becomes unusable. You can cancel the scheduled deletion of the key outside of CloudFormation.
*
* However, if you inadvertently delete a replica key, you can decrypt ciphertext encrypted by that replica key by using any related multi-Region key. If necessary, you can recreate the replica in the same Region after the previous one is completely deleted. For details, see Deleting multi-Region keys in the AWS Key Management Service Developer Guide
*
*
*
* Specify the key ARN of an existing multi-Region primary key. For example, arn:aws:kms:us-east-2:111122223333:key/mrk-1234abcd12ab34cd56ef1234567890ab .
*/
@software.amazon.jsii.Stability(software.amazon.jsii.Stability.Level.Stable)
public @org.jetbrains.annotations.NotNull java.lang.String getPrimaryKeyArn() {
return software.amazon.jsii.Kernel.get(this, "primaryKeyArn", software.amazon.jsii.NativeType.forClass(java.lang.String.class));
}
/**
* Specifies the multi-Region primary key to replicate.
*
* The primary key must be in a different AWS Region of the same AWS partition. You can create only one replica of a given primary key in each AWS Region .
*
*
*
* If you change the PrimaryKeyArn value of a replica key, the existing replica key is scheduled for deletion and a new replica key is created based on the specified primary key. While it is scheduled for deletion, the existing replica key becomes unusable. You can cancel the scheduled deletion of the key outside of CloudFormation.
*
* However, if you inadvertently delete a replica key, you can decrypt ciphertext encrypted by that replica key by using any related multi-Region key. If necessary, you can recreate the replica in the same Region after the previous one is completely deleted. For details, see Deleting multi-Region keys in the AWS Key Management Service Developer Guide
*
*
*
* Specify the key ARN of an existing multi-Region primary key. For example, arn:aws:kms:us-east-2:111122223333:key/mrk-1234abcd12ab34cd56ef1234567890ab .
*/
@software.amazon.jsii.Stability(software.amazon.jsii.Stability.Level.Stable)
public void setPrimaryKeyArn(final @org.jetbrains.annotations.NotNull java.lang.String value) {
software.amazon.jsii.Kernel.set(this, "primaryKeyArn", java.util.Objects.requireNonNull(value, "primaryKeyArn is required"));
}
/**
* A description of the KMS key.
*
* The default value is an empty string (no description).
*
* The description is not a shared property of multi-Region keys. You can specify the same description or a different description for each key in a set of related multi-Region keys. AWS Key Management Service does not synchronize this property.
*/
@software.amazon.jsii.Stability(software.amazon.jsii.Stability.Level.Stable)
public @org.jetbrains.annotations.Nullable java.lang.String getDescription() {
return software.amazon.jsii.Kernel.get(this, "description", software.amazon.jsii.NativeType.forClass(java.lang.String.class));
}
/**
* A description of the KMS key.
*
* The default value is an empty string (no description).
*
* The description is not a shared property of multi-Region keys. You can specify the same description or a different description for each key in a set of related multi-Region keys. AWS Key Management Service does not synchronize this property.
*/
@software.amazon.jsii.Stability(software.amazon.jsii.Stability.Level.Stable)
public void setDescription(final @org.jetbrains.annotations.Nullable java.lang.String value) {
software.amazon.jsii.Kernel.set(this, "description", value);
}
/**
* Specifies whether the replica key is enabled. Disabled KMS keys cannot be used in cryptographic operations.
*
* When Enabled is true , the key state of the KMS key is Enabled . When Enabled is false , the key state of the KMS key is Disabled . The default value is true .
*
* The actual key state of the replica might be affected by actions taken outside of CloudFormation, such as running the EnableKey , DisableKey , or ScheduleKeyDeletion operations. Also, while the replica key is being created, its key state is Creating . When the process is complete, the key state of the replica key changes to Enabled .
*
* For information about the key states of a KMS key, see Key state: Effect on your KMS key in the AWS Key Management Service Developer Guide .
*/
@software.amazon.jsii.Stability(software.amazon.jsii.Stability.Level.Stable)
public @org.jetbrains.annotations.Nullable java.lang.Object getEnabled() {
return software.amazon.jsii.Kernel.get(this, "enabled", software.amazon.jsii.NativeType.forClass(java.lang.Object.class));
}
/**
* Specifies whether the replica key is enabled. Disabled KMS keys cannot be used in cryptographic operations.
*
* When Enabled is true , the key state of the KMS key is Enabled . When Enabled is false , the key state of the KMS key is Disabled . The default value is true .
*
* The actual key state of the replica might be affected by actions taken outside of CloudFormation, such as running the EnableKey , DisableKey , or ScheduleKeyDeletion operations. Also, while the replica key is being created, its key state is Creating . When the process is complete, the key state of the replica key changes to Enabled .
*
* For information about the key states of a KMS key, see Key state: Effect on your KMS key in the AWS Key Management Service Developer Guide .
*/
@software.amazon.jsii.Stability(software.amazon.jsii.Stability.Level.Stable)
public void setEnabled(final @org.jetbrains.annotations.Nullable java.lang.Boolean value) {
software.amazon.jsii.Kernel.set(this, "enabled", value);
}
/**
* Specifies whether the replica key is enabled. Disabled KMS keys cannot be used in cryptographic operations.
*
* When Enabled is true , the key state of the KMS key is Enabled . When Enabled is false , the key state of the KMS key is Disabled . The default value is true .
*
* The actual key state of the replica might be affected by actions taken outside of CloudFormation, such as running the EnableKey , DisableKey , or ScheduleKeyDeletion operations. Also, while the replica key is being created, its key state is Creating . When the process is complete, the key state of the replica key changes to Enabled .
*
* For information about the key states of a KMS key, see Key state: Effect on your KMS key in the AWS Key Management Service Developer Guide .
*/
@software.amazon.jsii.Stability(software.amazon.jsii.Stability.Level.Stable)
public void setEnabled(final @org.jetbrains.annotations.Nullable software.amazon.awscdk.core.IResolvable value) {
software.amazon.jsii.Kernel.set(this, "enabled", value);
}
/**
* Specifies the number of days in the waiting period before AWS KMS deletes a replica key that has been removed from a CloudFormation stack.
*
* Enter a value between 7 and 30 days. The default value is 30 days.
*
* When you remove a replica key from a CloudFormation stack, AWS KMS schedules the replica key for deletion and starts the mandatory waiting period. The PendingWindowInDays property determines the length of waiting period. During the waiting period, the key state of replica key is Pending Deletion , which prevents it from being used in cryptographic operations. When the waiting period expires, AWS KMS permanently deletes the replica key.
*
* You cannot use a CloudFormation template to cancel deletion of the replica after you remove it from the stack, regardless of the waiting period. However, if you specify a replica key in your template that is based on the same primary key as the original replica key, CloudFormation creates a new replica key with the same key ID, key material, and other shared properties of the original replica key. This new replica key can decrypt ciphertext that was encrypted under the original replica key, or any related multi-Region key.
*
* For detailed information about deleting multi-Region keys, see Deleting multi-Region keys in the AWS Key Management Service Developer Guide .
*
* For information about the PendingDeletion key state, see Key state: Effect on your KMS key in the AWS Key Management Service Developer Guide . For more information about deleting KMS keys, see the ScheduleKeyDeletion operation in the AWS Key Management Service API Reference and Deleting KMS keys in the AWS Key Management Service Developer Guide .
*
* Minimum : 7
*
* Maximum : 30
*/
@software.amazon.jsii.Stability(software.amazon.jsii.Stability.Level.Stable)
public @org.jetbrains.annotations.Nullable java.lang.Number getPendingWindowInDays() {
return software.amazon.jsii.Kernel.get(this, "pendingWindowInDays", software.amazon.jsii.NativeType.forClass(java.lang.Number.class));
}
/**
* Specifies the number of days in the waiting period before AWS KMS deletes a replica key that has been removed from a CloudFormation stack.
*
* Enter a value between 7 and 30 days. The default value is 30 days.
*
* When you remove a replica key from a CloudFormation stack, AWS KMS schedules the replica key for deletion and starts the mandatory waiting period. The PendingWindowInDays property determines the length of waiting period. During the waiting period, the key state of replica key is Pending Deletion , which prevents it from being used in cryptographic operations. When the waiting period expires, AWS KMS permanently deletes the replica key.
*
* You cannot use a CloudFormation template to cancel deletion of the replica after you remove it from the stack, regardless of the waiting period. However, if you specify a replica key in your template that is based on the same primary key as the original replica key, CloudFormation creates a new replica key with the same key ID, key material, and other shared properties of the original replica key. This new replica key can decrypt ciphertext that was encrypted under the original replica key, or any related multi-Region key.
*
* For detailed information about deleting multi-Region keys, see Deleting multi-Region keys in the AWS Key Management Service Developer Guide .
*
* For information about the PendingDeletion key state, see Key state: Effect on your KMS key in the AWS Key Management Service Developer Guide . For more information about deleting KMS keys, see the ScheduleKeyDeletion operation in the AWS Key Management Service API Reference and Deleting KMS keys in the AWS Key Management Service Developer Guide .
*
* Minimum : 7
*
* Maximum : 30
*/
@software.amazon.jsii.Stability(software.amazon.jsii.Stability.Level.Stable)
public void setPendingWindowInDays(final @org.jetbrains.annotations.Nullable java.lang.Number value) {
software.amazon.jsii.Kernel.set(this, "pendingWindowInDays", value);
}
/**
* A fluent builder for {@link software.amazon.awscdk.services.kms.CfnReplicaKey}.
*/
@software.amazon.jsii.Stability(software.amazon.jsii.Stability.Level.Stable)
public static final class Builder implements software.amazon.jsii.Builder {
/**
* @return a new instance of {@link Builder}.
* @param scope - scope in which this resource is defined. This parameter is required.
* @param id - scoped id of the resource. This parameter is required.
*/
@software.amazon.jsii.Stability(software.amazon.jsii.Stability.Level.Stable)
public static Builder create(final software.amazon.awscdk.core.Construct scope, final java.lang.String id) {
return new Builder(scope, id);
}
private final software.amazon.awscdk.core.Construct scope;
private final java.lang.String id;
private final software.amazon.awscdk.services.kms.CfnReplicaKeyProps.Builder props;
private Builder(final software.amazon.awscdk.core.Construct scope, final java.lang.String id) {
this.scope = scope;
this.id = id;
this.props = new software.amazon.awscdk.services.kms.CfnReplicaKeyProps.Builder();
}
/**
* The key policy that authorizes use of the replica key.
*
* The key policy is not a shared property of multi-Region keys. You can specify the same key policy or a different key policy for each key in a set of related multi-Region keys. AWS KMS does not synchronize this property.
*
* The key policy must conform to the following rules.
*
*
* - The key policy must give the caller PutKeyPolicy permission on the KMS key. This reduces the risk that the KMS key becomes unmanageable. For more information, refer to the scenario in the Default key policy section of the AWS Key Management Service Developer Guide .
* - Each statement in the key policy must contain one or more principals. The principals in the key policy must exist and be visible to AWS KMS . When you create a new AWS principal (for example, an IAM user or role), you might need to enforce a delay before including the new principal in a key policy because the new principal might not be immediately visible to AWS KMS . For more information, see Changes that I make are not always immediately visible in the AWS Identity and Access Management User Guide .
* - The key policy size limit is 32 kilobytes (32768 bytes).
*
*
* Minimum : 1
*
* Maximum : 32768
*
* @return {@code this}
* @param keyPolicy The key policy that authorizes use of the replica key. This parameter is required.
*/
@software.amazon.jsii.Stability(software.amazon.jsii.Stability.Level.Stable)
public Builder keyPolicy(final java.lang.Object keyPolicy) {
this.props.keyPolicy(keyPolicy);
return this;
}
/**
* Specifies the multi-Region primary key to replicate.
*
* The primary key must be in a different AWS Region of the same AWS partition. You can create only one replica of a given primary key in each AWS Region .
*
*
*
* If you change the PrimaryKeyArn value of a replica key, the existing replica key is scheduled for deletion and a new replica key is created based on the specified primary key. While it is scheduled for deletion, the existing replica key becomes unusable. You can cancel the scheduled deletion of the key outside of CloudFormation.
*
* However, if you inadvertently delete a replica key, you can decrypt ciphertext encrypted by that replica key by using any related multi-Region key. If necessary, you can recreate the replica in the same Region after the previous one is completely deleted. For details, see Deleting multi-Region keys in the AWS Key Management Service Developer Guide
*
*
*
* Specify the key ARN of an existing multi-Region primary key. For example, arn:aws:kms:us-east-2:111122223333:key/mrk-1234abcd12ab34cd56ef1234567890ab .
*
* @return {@code this}
* @param primaryKeyArn Specifies the multi-Region primary key to replicate. This parameter is required.
*/
@software.amazon.jsii.Stability(software.amazon.jsii.Stability.Level.Stable)
public Builder primaryKeyArn(final java.lang.String primaryKeyArn) {
this.props.primaryKeyArn(primaryKeyArn);
return this;
}
/**
* A description of the KMS key.
*
* The default value is an empty string (no description).
*
* The description is not a shared property of multi-Region keys. You can specify the same description or a different description for each key in a set of related multi-Region keys. AWS Key Management Service does not synchronize this property.
*
* @return {@code this}
* @param description A description of the KMS key. This parameter is required.
*/
@software.amazon.jsii.Stability(software.amazon.jsii.Stability.Level.Stable)
public Builder description(final java.lang.String description) {
this.props.description(description);
return this;
}
/**
* Specifies whether the replica key is enabled. Disabled KMS keys cannot be used in cryptographic operations.
*
* When Enabled is true , the key state of the KMS key is Enabled . When Enabled is false , the key state of the KMS key is Disabled . The default value is true .
*
* The actual key state of the replica might be affected by actions taken outside of CloudFormation, such as running the EnableKey , DisableKey , or ScheduleKeyDeletion operations. Also, while the replica key is being created, its key state is Creating . When the process is complete, the key state of the replica key changes to Enabled .
*
* For information about the key states of a KMS key, see Key state: Effect on your KMS key in the AWS Key Management Service Developer Guide .
*
* @return {@code this}
* @param enabled Specifies whether the replica key is enabled. Disabled KMS keys cannot be used in cryptographic operations. This parameter is required.
*/
@software.amazon.jsii.Stability(software.amazon.jsii.Stability.Level.Stable)
public Builder enabled(final java.lang.Boolean enabled) {
this.props.enabled(enabled);
return this;
}
/**
* Specifies whether the replica key is enabled. Disabled KMS keys cannot be used in cryptographic operations.
*
* When Enabled is true , the key state of the KMS key is Enabled . When Enabled is false , the key state of the KMS key is Disabled . The default value is true .
*
* The actual key state of the replica might be affected by actions taken outside of CloudFormation, such as running the EnableKey , DisableKey , or ScheduleKeyDeletion operations. Also, while the replica key is being created, its key state is Creating . When the process is complete, the key state of the replica key changes to Enabled .
*
* For information about the key states of a KMS key, see Key state: Effect on your KMS key in the AWS Key Management Service Developer Guide .
*
* @return {@code this}
* @param enabled Specifies whether the replica key is enabled. Disabled KMS keys cannot be used in cryptographic operations. This parameter is required.
*/
@software.amazon.jsii.Stability(software.amazon.jsii.Stability.Level.Stable)
public Builder enabled(final software.amazon.awscdk.core.IResolvable enabled) {
this.props.enabled(enabled);
return this;
}
/**
* Specifies the number of days in the waiting period before AWS KMS deletes a replica key that has been removed from a CloudFormation stack.
*
* Enter a value between 7 and 30 days. The default value is 30 days.
*
* When you remove a replica key from a CloudFormation stack, AWS KMS schedules the replica key for deletion and starts the mandatory waiting period. The PendingWindowInDays property determines the length of waiting period. During the waiting period, the key state of replica key is Pending Deletion , which prevents it from being used in cryptographic operations. When the waiting period expires, AWS KMS permanently deletes the replica key.
*
* You cannot use a CloudFormation template to cancel deletion of the replica after you remove it from the stack, regardless of the waiting period. However, if you specify a replica key in your template that is based on the same primary key as the original replica key, CloudFormation creates a new replica key with the same key ID, key material, and other shared properties of the original replica key. This new replica key can decrypt ciphertext that was encrypted under the original replica key, or any related multi-Region key.
*
* For detailed information about deleting multi-Region keys, see Deleting multi-Region keys in the AWS Key Management Service Developer Guide .
*
* For information about the PendingDeletion key state, see Key state: Effect on your KMS key in the AWS Key Management Service Developer Guide . For more information about deleting KMS keys, see the ScheduleKeyDeletion operation in the AWS Key Management Service API Reference and Deleting KMS keys in the AWS Key Management Service Developer Guide .
*
* Minimum : 7
*
* Maximum : 30
*
* @return {@code this}
* @param pendingWindowInDays Specifies the number of days in the waiting period before AWS KMS deletes a replica key that has been removed from a CloudFormation stack. This parameter is required.
*/
@software.amazon.jsii.Stability(software.amazon.jsii.Stability.Level.Stable)
public Builder pendingWindowInDays(final java.lang.Number pendingWindowInDays) {
this.props.pendingWindowInDays(pendingWindowInDays);
return this;
}
/**
* Assigns one or more tags to the replica key.
*
*
*
* Tagging or untagging a KMS key can allow or deny permission to the KMS key. For details, see ABAC for AWS KMS in the AWS Key Management Service Developer Guide .
*
*
*
* Tags are not a shared property of multi-Region keys. You can specify the same tags or different tags for each key in a set of related multi-Region keys. AWS KMS does not synchronize this property.
*
* Each tag consists of a tag key and a tag value. Both the tag key and the tag value are required, but the tag value can be an empty (null) string. You cannot have more than one tag on a KMS key with the same tag key. If you specify an existing tag key with a different tag value, AWS KMS replaces the current tag value with the specified one.
*
* When you assign tags to an AWS resource, AWS generates a cost allocation report with usage and costs aggregated by tags. Tags can also be used to control access to a KMS key. For details, see Tagging keys .
*
* @return {@code this}
* @param tags Assigns one or more tags to the replica key. This parameter is required.
*/
@software.amazon.jsii.Stability(software.amazon.jsii.Stability.Level.Stable)
public Builder tags(final java.util.List tags) {
this.props.tags(tags);
return this;
}
/**
* @returns a newly built instance of {@link software.amazon.awscdk.services.kms.CfnReplicaKey}.
*/
@software.amazon.jsii.Stability(software.amazon.jsii.Stability.Level.Stable)
@Override
public software.amazon.awscdk.services.kms.CfnReplicaKey build() {
return new software.amazon.awscdk.services.kms.CfnReplicaKey(
this.scope,
this.id,
this.props.build()
);
}
}
}