IKey Interface
A KMS Key, either managed by this CDK app, or imported.
This interface does double duty: it represents an actual KMS keys, but it also represents things that can behave like KMS keys, like a key alias.
Properties
envResourceEnvironmentenvResourceEnvironmentenvResourceEnvironmentEnvResourceEnvironmentEnvResourceEnvironmentrequired#The environment this resource belongs to.
notes
For resources that are created and managed in a Stack (those created by creating new class instances like new Role(), new Bucket(), etc.), this is always the same as the environment of the stack they belong to.
For referenced resources (those obtained from referencing methods like Role.fromRoleArn(), Bucket.fromBucketName(), etc.), they might be different than the stack they were imported into.
The ARN of the key.
The ID of the key (the part that looks something like: 1234abcd-12ab-34cd-56ef-1234567890ab).
keyRefKeyReferencekey_refKeyReferencekeyRefKeyReferenceKeyRefKeyReferenceKeyRefKeyReferencerequired#A reference to a Key resource.
Methods
addAlias(alias: string): Aliasdef add_alias(self, alias: str) -> Aliaspublic Alias addAlias(String alias)public Alias AddAlias(string alias)func AddAlias(Alias *string) Alias#Defines a new alias for the key.
addToResourcePolicy(statement: PolicyStatement, allowNoOp?: boolean): AddToResourcePolicyResultdef add_to_resource_policy(self, statement: PolicyStatement, allow_no_op: typing.Optional[bool] = None) -> AddToResourcePolicyResultpublic AddToResourcePolicyResult addToResourcePolicy(PolicyStatement statement, Boolean allowNoOp)public AddToResourcePolicyResult AddToResourcePolicy(PolicyStatement statement, bool? allowNoOp = null)func AddToResourcePolicy(Statement PolicyStatement, AllowNoOp *bool) AddToResourcePolicyResult#Adds a statement to the KMS key resource policy.
2 parameters
Parameters
statementstatementstatementstatementStatement— The policy statement to add.allowNoOpallow_no_opallowNoOpallowNoOpAllowNoOp— If this is set tofalseand there is no policy defined (i.e. external key), the operation will fail. Otherwise, it will no-op.
applyRemovalPolicy(policy: RemovalPolicy): voiddef apply_removal_policy(self, policy: RemovalPolicy) -> Nonepublic void applyRemovalPolicy(RemovalPolicy policy)public void ApplyRemovalPolicy(RemovalPolicy policy)func ApplyRemovalPolicy(Policy RemovalPolicy)#Apply the given removal policy to this resource.
notes
The Removal Policy controls what happens to this resource when it stops being managed by CloudFormation, either because you've removed it from the CDK application or because you've made a change that requires the resource to be replaced.
The resource can be deleted (RemovalPolicy.DESTROY), or left in your AWS account for data recovery and cleanup later (RemovalPolicy.RETAIN).
grant(grantee: IGrantable, ...actions: string[]): Grantdef grant(self, grantee: IGrantable, actions: str) -> Grantpublic Grant grant(IGrantable grantee, String actions)public Grant Grant(IGrantable grantee, string actions)func Grant(Grantee IGrantable, Actions *string) Grant#Grant the indicated permissions on this key to the given principal.
grantDecrypt(grantee: IGrantable): Grantdef grant_decrypt(self, grantee: IGrantable) -> Grantpublic Grant grantDecrypt(IGrantable grantee)public Grant GrantDecrypt(IGrantable grantee)func GrantDecrypt(Grantee IGrantable) Grant#Grant decryption permissions using this key to the given principal.
grantEncrypt(grantee: IGrantable): Grantdef grant_encrypt(self, grantee: IGrantable) -> Grantpublic Grant grantEncrypt(IGrantable grantee)public Grant GrantEncrypt(IGrantable grantee)func GrantEncrypt(Grantee IGrantable) Grant#Grant encryption permissions using this key to the given principal.
grantEncryptDecrypt(grantee: IGrantable): Grantdef grant_encrypt_decrypt(self, grantee: IGrantable) -> Grantpublic Grant grantEncryptDecrypt(IGrantable grantee)public Grant GrantEncryptDecrypt(IGrantable grantee)func GrantEncryptDecrypt(Grantee IGrantable) Grant#Grant encryption and decryption permissions using this key to the given principal.
grantGenerateMac(grantee: IGrantable): Grantdef grant_generate_mac(self, grantee: IGrantable) -> Grantpublic Grant grantGenerateMac(IGrantable grantee)public Grant GrantGenerateMac(IGrantable grantee)func GrantGenerateMac(Grantee IGrantable) Grant#Grant permissions to generating MACs to the given principal.
grantSign(grantee: IGrantable): Grantdef grant_sign(self, grantee: IGrantable) -> Grantpublic Grant grantSign(IGrantable grantee)public Grant GrantSign(IGrantable grantee)func GrantSign(Grantee IGrantable) Grant#Grant sign permissions using this key to the given principal.
grantSignVerify(grantee: IGrantable): Grantdef grant_sign_verify(self, grantee: IGrantable) -> Grantpublic Grant grantSignVerify(IGrantable grantee)public Grant GrantSignVerify(IGrantable grantee)func GrantSignVerify(Grantee IGrantable) Grant#Grant sign and verify permissions using this key to the given principal.
grantVerify(grantee: IGrantable): Grantdef grant_verify(self, grantee: IGrantable) -> Grantpublic Grant grantVerify(IGrantable grantee)public Grant GrantVerify(IGrantable grantee)func GrantVerify(Grantee IGrantable) Grant#Grant verify permissions using this key to the given principal.
grantVerifyMac(grantee: IGrantable): Grantdef grant_verify_mac(self, grantee: IGrantable) -> Grantpublic Grant grantVerifyMac(IGrantable grantee)public Grant GrantVerifyMac(IGrantable grantee)func GrantVerifyMac(Grantee IGrantable) Grant#Grant permissions to verifying MACs to the given principal.
with(...mixins: IMixin[]): IConstructdef with(self, mixins: IMixin) -> IConstructpublic IConstruct with(IMixin mixins)public IConstruct With(IMixin mixins)func With(Mixins IMixin) IConstruct#Applies one or more mixins to this construct.
Mixins are applied in order. The list of constructs is captured at the start of the call, so constructs added by a mixin will not be visited.
1 parameter · returns
Parameters
mixinsmixinsmixinsmixinsMixins— The mixins to apply.
Returns: This construct for chaining