Required

alias Required
string

Alias for the KMS key. Must start with 'alias/' (e.g., alias/my-app-encryption).

Optional

Description of the KMS key. Include purpose and which services or applications use it.

bool Default: true

Whether to enable automatic key rotation. AWS rotates the key material annually when enabled.

number Default: 30

Duration in days before the key is deleted. Minimum 7, maximum 30.

map(string)

Tags to apply to all resources

bool Default: true

Publish KMS key metadata to SSM Parameter Store for discovery by other modules