EncryptionConfiguration
How a resource's data at rest is encrypted.
kmsKeyArn is required when encryptionStrategy is CUSTOMER_MANAGED and must be absent when it is AWS_OWNED; a mismatch is a ValidationException rather than a silently ignored field, so a caller that selects AWS_OWNED while still passing a key learns that the key was not applied.
Contents
- encryptionStrategy
-
Which kind of key to use. Required.
Type: String
Valid Values:
AWS_OWNED | CUSTOMER_MANAGEDRequired: Yes
- kmsKeyArn
-
Customer managed KMS key ARN. Required when
encryptionStrategyis CUSTOMER_MANAGED, and must be omitted when it is AWS_OWNED. Must be a symmetric ENCRYPT_DECRYPT key in the caller's account and region.Type: String
Pattern:
arn:aws[a-zA-Z-]*:kms:[a-z0-9-]+:[0-9]{12}:key/(mrk-)?[a-f0-9-]+Required: No
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
