KMSKey | Praxis resources

Resource definition

What this resource looks like

This is the CUE shape a Praxis template uses to declare a KMSKey. The resource key is local to the template; metadata.name supplies its stable Praxis identity.

resources: {
  encryption: {
  	apiVersion: "praxis.io/alpha"
  	kind:       "KMSKey"
  	metadata: name: "\(variables.name)/application"
  	spec: {
  		region:            variables.region
  		description:       "Application data key"
  		enableKeyRotation: true
  		tags:              _tags
  	}
  }
}

Excerpted from examples/stacks/foundation-services.cue. Open the complete example for its variables and related resources.

Complete examples in the repository

stacks foundation services

Desired state

Configuration

The spec block accepts 7 fields. 2 are required by the schema; fields with defaults can be omitted.

regionRequired

Region.

string

String

descriptionOptional

Mutable — a human-readable description converged in place.

string

String

keyUsageOptional

Immutable after creation — changes surface as informational, requires-replacement diffs during reconciliation.

"ENCRYPT_DECRYPT" | "SIGN_VERIFY" | "GENERATE_VERIFY_MAC" | *"ENCRYPT_DECRYPT"

EnumDefault "ENCRYPT_DECRYPT"

keySpecOptional

Key Spec.

string | *"SYMMETRIC_DEFAULT"

EnumDefault "SYMMETRIC_DEFAULT"

enableKeyRotationOptional

Mutable — whether automatic annual key rotation is enabled.

bool | *false

BooleanDefault false

deletionWindowInDaysOptional

Used only at delete time: the waiting period (in days) before AWS permanently deletes the key after ScheduleKeyDeletion.

int & >=7 & <=30 | *30

IntegerDefault 30

tagsRequired

Tags.

[string]: string

Map

Observed values

Outputs

Praxis records these values after observation. A dependent resource can read one with ${resources.<name>.outputs.<field>}.

arnString

keyIdString

aliasNameString

Read without ownership

Data-source lookup

A data block reads an existing KMSKey and exposes its outputs without storing lifecycle state. The generic filter surface accepts id, name, and tag; supported combinations depend on the AWS identity used by this resource.

data: existing: {
  kind: "KMSKey"
  region: "us-west-2"
  filter: {
    name: "replace-with-provider-name"
  }
}

Understand data sources and filters →

Adopt existing infrastructure

Import

Import persists Praxis state for an existing AWS resource. For this kind, supply: Provider identifier for the existing KMSKey. The example starts in observed mode so Praxis reports drift without correcting it.

praxis import KMSKey \
  --id <provider-identifier> \
  --region us-west-2 \
  --account production \
  --observe

Choose managed or observed ownership →

Canonical contract

Complete CUE schema

The field guide above is derived from this definition. The schema remains the source of truth for accepted values, defaults, validation constraints, and outputs in the current alpha revision.

Show the complete schema

package kms

#KMSKey: {
	apiVersion: "praxis.io/alpha"
	kind:       "KMSKey"

	metadata: {
		// The alias short name (without the "alias/" prefix). Alias names are
		// 1-256 chars: letters, digits, and the characters _ - / . The driver
		// derives the full alias "alias/<name>" internally.
		name: string & =~"^[a-zA-Z0-9][a-zA-Z0-9/_-]{0,250}$"
		labels: [string]: string
	}

	spec: {
		region: string

		// Mutable — a human-readable description converged in place.
		description?: string

		// Immutable after creation — changes surface as informational,
		// requires-replacement diffs during reconciliation.
		keyUsage: "ENCRYPT_DECRYPT" | "SIGN_VERIFY" | "GENERATE_VERIFY_MAC" | *"ENCRYPT_DECRYPT"
		keySpec:  string | *"SYMMETRIC_DEFAULT"

		// Mutable — whether automatic annual key rotation is enabled.
		enableKeyRotation: bool | *false

		// Used only at delete time: the waiting period (in days) before AWS
		// permanently deletes the key after ScheduleKeyDeletion.
		deletionWindowInDays: int & >=7 & <=30 | *30

		tags: [string]: string
	}

	outputs?: {
		arn:       string
		keyId:     string
		aliasName: string
	}
}

View this schema on GitHub →