AWS CDK Reference

Appearance

v2.274.0

CustomerManagedEncryptionConfiguration Class ​

Define a new CustomerManagedEncryptionConfiguration.

Source
aws-stepfunctions/lib/customer-managed-key-encryption-configuration.ts
Type last changed
v2.160.0 · 24 Sep 2024

Example ​

ts
import * as kms from 'aws-cdk-lib/aws-kms';
import * as cdk from 'aws-cdk-lib';

const kmsKey = new kms.Key(this, 'Key');
const stateMachine = new sfn.StateMachine(this, 'StateMachineWithCMKEncryptionConfiguration', {
  stateMachineName: 'StateMachineWithCMKEncryptionConfiguration',
  definitionBody: sfn.DefinitionBody.fromChainable(sfn.Chain.start(new sfn.Pass(this, 'Pass'))),
  stateMachineType: sfn.StateMachineType.STANDARD,
  encryptionConfiguration: new sfn.CustomerManagedEncryptionConfiguration(kmsKey, cdk.Duration.seconds(60)),
});
python
import aws_cdk.aws_kms as kms
import aws_cdk as cdk


kms_key = kms.Key(self, "Key")
state_machine = sfn.StateMachine(self, "StateMachineWithCMKEncryptionConfiguration",
    state_machine_name="StateMachineWithCMKEncryptionConfiguration",
    definition_body=sfn.DefinitionBody.from_chainable(sfn.Chain.start(sfn.Pass(self, "Pass"))),
    state_machine_type=sfn.StateMachineType.STANDARD,
    encryption_configuration=sfn.CustomerManagedEncryptionConfiguration(kms_key, cdk.Duration.seconds(60))
)
java
import software.amazon.awscdk.services.kms.*;
import software.amazon.awscdk.*;


Key kmsKey = new Key(this, "Key");
StateMachine stateMachine = StateMachine.Builder.create(this, "StateMachineWithCMKEncryptionConfiguration")
        .stateMachineName("StateMachineWithCMKEncryptionConfiguration")
        .definitionBody(DefinitionBody.fromChainable(Chain.start(new Pass(this, "Pass"))))
        .stateMachineType(StateMachineType.STANDARD)
        .encryptionConfiguration(new CustomerManagedEncryptionConfiguration(kmsKey, Duration.seconds(60)))
        .build();
csharp
// Install: dotnet add package Amazon.CDK.Lib
using Amazon.CDK.AWS.KMS;
using Amazon.CDK;


var kmsKey = new Key(this, "Key");
var stateMachine = new StateMachine(this, "StateMachineWithCMKEncryptionConfiguration", new StateMachineProps {
    StateMachineName = "StateMachineWithCMKEncryptionConfiguration",
    DefinitionBody = DefinitionBody.FromChainable(Chain.Start(new Pass(this, "Pass"))),
    StateMachineType = StateMachineType.STANDARD,
    EncryptionConfiguration = new CustomerManagedEncryptionConfiguration(kmsKey, Duration.Seconds(60))
});
go
// Install: go get github.com/aws/aws-cdk-go/awscdk/v2
import kms "github.com/aws/aws-cdk-go/awscdk"
import cdk "github.com/aws/aws-cdk-go/awscdk"


kmsKey := kms.NewKey(this, jsii.String("Key"))
stateMachine := sfn.NewStateMachine(this, jsii.String("StateMachineWithCMKEncryptionConfiguration"), &StateMachineProps{
	StateMachineName: jsii.String("StateMachineWithCMKEncryptionConfiguration"),
	DefinitionBody: sfn.DefinitionBody_FromChainable(sfn.Chain_Start(sfn.NewPass(this, jsii.String("Pass")))),
	StateMachineType: sfn.StateMachineType_STANDARD,
	EncryptionConfiguration: sfn.NewCustomerManagedEncryptionConfiguration(kmsKey, cdk.Duration_Seconds(jsii.Number(60))),
})

Initializer ​

ts
new CustomerManagedEncryptionConfiguration(kmsKey: IKey, kmsDataKeyReusePeriodSeconds?: Duration)
python
CustomerManagedEncryptionConfiguration(kms_key: IKey, kms_data_key_reuse_period_seconds: typing.Optional[Duration] = None)
java
new CustomerManagedEncryptionConfiguration(IKey kmsKey, Duration kmsDataKeyReusePeriodSeconds)
csharp
new CustomerManagedEncryptionConfiguration(IKey kmsKey, Duration? kmsDataKeyReusePeriodSeconds = null)
go
NewCustomerManagedEncryptionConfiguration(KmsKey IKey, KmsDataKeyReusePeriodSeconds Duration)

Properties ​

kmsDataKeyReusePeriodSecondsDurationkms_data_key_reuse_period_secondsDurationkmsDataKeyReusePeriodSecondsDurationKmsDataKeyReusePeriodSecondsDurationKmsDataKeyReusePeriodSecondsDuration= Duration.seconds(300)#
Maximum duration that Step Functions will reuse customer managed data keys. When the period expires, Step Functions will call GenerateDataKey.

Must be between 60 and 900 seconds.

kmsKeyIKeykms_keyIKeykmsKeyIKeyKmsKeyIKeyKmsKeyIKeyrequired#
The symmetric customer managed KMS key for server-side encryption of the state machine definition, and execution history or activity inputs.

Default: data is transparently encrypted using an AWS owned key

Step Functions will reuse the key for a maximum of kmsDataKeyReusePeriodSeconds.

typestringtypestrtypeStringTypestringType*stringrequired#
Encryption option for the state machine or activity.

Can be either CUSTOMER_MANAGED_KMS_KEY or AWS_OWNED_KEY.