Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. AWS
  4. API Docs
  5. directconnect
  6. MacsecKeyAssociation
Viewing docs for AWS v7.52.1
published on Wednesday, Oct 28, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-aws

aws.directconnect.MacsecKeyAssociation

aws logo aws logo
Viewing docs for AWS v7.52.1
published on Wednesday, Oct 28, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-aws

    Manages a MAC Security (MACSec) secret key association for use with Direct Connect. See MACsec prerequisites for information about MAC Security (MACsec) prerequisites.

    Creating this resource will also create a resource of type aws.secretsmanager.Secret which is managed by Direct Connect. While you can import this resource into your state, because this secret is managed by Direct Connect, you will not be able to make any modifications to it. See How AWS Direct Connect uses AWS Secrets Manager for details.

    Note: The ckn and cak arguments are stored in the raw state as plain-text. Use cknWo and cakWo instead to avoid storing these values in the plan or state. When cknWo is configured, the API-returned CKN is not stored in ckn.

    Note: The secretArn argument can only be used to reference a previously created MACSec key. You cannot associate a Secrets Manager secret created outside of the aws.directconnect.MacsecKeyAssociation resource.

    Example Usage

    Basic Usage

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = aws.directconnect.getConnection({
    name: "tf-dx-connection",
});
const exampleMacsecKeyAssociation = new aws.directconnect.MacsecKeyAssociation("example", {
    connectionId: example.then(example => example.id),
    ckn: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
    cak: "abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789",
});

    import pulumi
import pulumi_aws as aws

example = aws.directconnect.get_connection(name="tf-dx-connection")
example_macsec_key_association = aws.directconnect.MacsecKeyAssociation("example",
    connection_id=example.id,
    ckn="0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
    cak="abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789")

    package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/directconnect"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := directconnect.LookupConnection(ctx, &directconnect.LookupConnectionArgs{
			Name: "tf-dx-connection",
		}, nil)
		if err != nil {
			return err
		}
		_, err = directconnect.NewMacsecKeyAssociation(ctx, "example", &directconnect.MacsecKeyAssociationArgs{
			ConnectionId: pulumi.String(example.Id),
			Ckn:          pulumi.String("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"),
			Cak:          pulumi.String("abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var example = Aws.DirectConnect.GetConnection.Invoke(new()
    {
        Name = "tf-dx-connection",
    });

    var exampleMacsecKeyAssociation = new Aws.DirectConnect.MacsecKeyAssociation("example", new()
    {
        ConnectionId = example.Apply(getConnectionResult => getConnectionResult.Id),
        Ckn = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
        Cak = "abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.directconnect.DirectconnectFunctions;
import com.pulumi.aws.directconnect.inputs.GetConnectionArgs;
import com.pulumi.aws.directconnect.MacsecKeyAssociation;
import com.pulumi.aws.directconnect.MacsecKeyAssociationArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var example = DirectconnectFunctions.getConnection(GetConnectionArgs.builder()
            .name("tf-dx-connection")
            .build());

        var exampleMacsecKeyAssociation = new MacsecKeyAssociation("exampleMacsecKeyAssociation", MacsecKeyAssociationArgs.builder()
            .connectionId(example.id())
            .ckn("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef")
            .cak("abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789")
            .build());

    }
}

    resources:
  exampleMacsecKeyAssociation:
    type: aws:directconnect:MacsecKeyAssociation
    name: example
    properties:
      connectionId: ${example.id}
      ckn: 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
      cak: abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789
variables:
  example:
    fn::invoke:
      function: aws:directconnect:getConnection
      arguments:
        name: tf-dx-connection

    terraform {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

data "aws_directconnect_connection" "example" {
  name = "tf-dx-connection"
}

resource "aws_directconnect_macsec_key_association" "example" {
  lifecycle {
    create_before_destroy = true
  }
  connection_id = data.aws_directconnect_connection.example.id
  ckn           = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
  cak           = "abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789"
}

    Create MACSec key with write-only CKN and CAK

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = aws.directconnect.getConnection({
    name: "tf-dx-connection",
});
const config = new pulumi.Config();
const cak = config.require("cak");
const ckn = config.require("ckn");
const exampleMacsecKeyAssociation = new aws.directconnect.MacsecKeyAssociation("example", {
    connectionId: example.then(example => example.id),
    cakWo: cak,
    cakWoVersion: 1,
    cknWo: ckn,
    cknWoVersion: 1,
});

    import pulumi
import pulumi_aws as aws

example = aws.directconnect.get_connection(name="tf-dx-connection")
config = pulumi.Config()
cak = config.require("cak")
ckn = config.require("ckn")
example_macsec_key_association = aws.directconnect.MacsecKeyAssociation("example",
    connection_id=example.id,
    cak_wo=cak,
    cak_wo_version=1,
    ckn_wo=ckn,
    ckn_wo_version=1)

    package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/directconnect"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi/config"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := directconnect.LookupConnection(ctx, &directconnect.LookupConnectionArgs{
			Name: "tf-dx-connection",
		}, nil)
		if err != nil {
			return err
		}
		cfg := config.New(ctx, "")
		cak := cfg.Require("cak")
		ckn := cfg.Require("ckn")
		_, err = directconnect.NewMacsecKeyAssociation(ctx, "example", &directconnect.MacsecKeyAssociationArgs{
			ConnectionId: pulumi.String(example.Id),
			CakWo:        pulumi.String(cak),
			CakWoVersion: pulumi.Int(1),
			CknWo:        pulumi.String(ckn),
			CknWoVersion: pulumi.Int(1),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var example = Aws.DirectConnect.GetConnection.Invoke(new()
    {
        Name = "tf-dx-connection",
    });

    var config = new Config();
    var cak = config.Require("cak");
    var ckn = config.Require("ckn");
    var exampleMacsecKeyAssociation = new Aws.DirectConnect.MacsecKeyAssociation("example", new()
    {
        ConnectionId = example.Apply(getConnectionResult => getConnectionResult.Id),
        CakWo = cak,
        CakWoVersion = 1,
        CknWo = ckn,
        CknWoVersion = 1,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.directconnect.DirectconnectFunctions;
import com.pulumi.aws.directconnect.inputs.GetConnectionArgs;
import com.pulumi.aws.directconnect.MacsecKeyAssociation;
import com.pulumi.aws.directconnect.MacsecKeyAssociationArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var config = ctx.config();
        final var example = DirectconnectFunctions.getConnection(GetConnectionArgs.builder()
            .name("tf-dx-connection")
            .build());

        final var cak = config.require("cak");
        final var ckn = config.require("ckn");
        var exampleMacsecKeyAssociation = new MacsecKeyAssociation("exampleMacsecKeyAssociation", MacsecKeyAssociationArgs.builder()
            .connectionId(example.id())
            .cakWo(cak)
            .cakWoVersion(1)
            .cknWo(ckn)
            .cknWoVersion(1)
            .build());

    }
}

    configuration:
  cak:
    type: string
  ckn:
    type: string
resources:
  exampleMacsecKeyAssociation:
    type: aws:directconnect:MacsecKeyAssociation
    name: example
    properties:
      connectionId: ${example.id}
      cakWo: ${cak}
      cakWoVersion: 1
      cknWo: ${ckn}
      cknWoVersion: 1
variables:
  example:
    fn::invoke:
      function: aws:directconnect:getConnection
      arguments:
        name: tf-dx-connection

    terraform {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

data "aws_directconnect_connection" "example" {
  name = "tf-dx-connection"
}

resource "aws_directconnect_macsec_key_association" "example" {
  lifecycle {
    create_before_destroy = true
  }
  connection_id  = data.aws_directconnect_connection.example.id
  cak_wo         = var.cak
  cak_wo_version = 1
  ckn_wo         = var.ckn
  ckn_wo_version = 1
}
variable "cak" {
  type = string
}
variable "ckn" {
  type = string
}

    Changing a write-only value alone does not trigger a change. Increment its corresponding cakWoVersion or cknWoVersion to replace the association with the new key material. The version counters are independent; increment both when changing both values.

    Create MACSec key with existing Secrets Manager secret

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = aws.directconnect.getConnection({
    name: "tf-dx-connection",
});
const exampleGetSecret = aws.secretsmanager.getSecret({
    name: "directconnect!prod/us-east-1/directconnect/0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
});
const exampleMacsecKeyAssociation = new aws.directconnect.MacsecKeyAssociation("example", {
    connectionId: example.then(example => example.id),
    secretArn: exampleGetSecret.then(exampleGetSecret => exampleGetSecret.arn),
});

    import pulumi
import pulumi_aws as aws

example = aws.directconnect.get_connection(name="tf-dx-connection")
example_get_secret = aws.secretsmanager.get_secret(name="directconnect!prod/us-east-1/directconnect/0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef")
example_macsec_key_association = aws.directconnect.MacsecKeyAssociation("example",
    connection_id=example.id,
    secret_arn=example_get_secret.arn)

    package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/directconnect"
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/secretsmanager"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := directconnect.LookupConnection(ctx, &directconnect.LookupConnectionArgs{
			Name: "tf-dx-connection",
		}, nil)
		if err != nil {
			return err
		}
		exampleGetSecret, err := secretsmanager.LookupSecret(ctx, &secretsmanager.LookupSecretArgs{
			Name: pulumi.StringRef("directconnect!prod/us-east-1/directconnect/0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"),
		}, nil)
		if err != nil {
			return err
		}
		_, err = directconnect.NewMacsecKeyAssociation(ctx, "example", &directconnect.MacsecKeyAssociationArgs{
			ConnectionId: pulumi.String(example.Id),
			SecretArn:    pulumi.String(exampleGetSecret.Arn),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var example = Aws.DirectConnect.GetConnection.Invoke(new()
    {
        Name = "tf-dx-connection",
    });

    var exampleGetSecret = Aws.SecretsManager.GetSecret.Invoke(new()
    {
        Name = "directconnect!prod/us-east-1/directconnect/0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
    });

    var exampleMacsecKeyAssociation = new Aws.DirectConnect.MacsecKeyAssociation("example", new()
    {
        ConnectionId = example.Apply(getConnectionResult => getConnectionResult.Id),
        SecretArn = exampleGetSecret.Apply(getSecretResult => getSecretResult.Arn),
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.directconnect.DirectconnectFunctions;
import com.pulumi.aws.directconnect.inputs.GetConnectionArgs;
import com.pulumi.aws.secretsmanager.SecretsmanagerFunctions;
import com.pulumi.aws.secretsmanager.inputs.GetSecretArgs;
import com.pulumi.aws.directconnect.MacsecKeyAssociation;
import com.pulumi.aws.directconnect.MacsecKeyAssociationArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var example = DirectconnectFunctions.getConnection(GetConnectionArgs.builder()
            .name("tf-dx-connection")
            .build());

        final var exampleGetSecret = SecretsmanagerFunctions.getSecret(GetSecretArgs.builder()
            .name("directconnect!prod/us-east-1/directconnect/0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef")
            .build());

        var exampleMacsecKeyAssociation = new MacsecKeyAssociation("exampleMacsecKeyAssociation", MacsecKeyAssociationArgs.builder()
            .connectionId(example.id())
            .secretArn(exampleGetSecret.arn())
            .build());

    }
}

    resources:
  exampleMacsecKeyAssociation:
    type: aws:directconnect:MacsecKeyAssociation
    name: example
    properties:
      connectionId: ${example.id}
      secretArn: ${exampleGetSecret.arn}
variables:
  example:
    fn::invoke:
      function: aws:directconnect:getConnection
      arguments:
        name: tf-dx-connection
  exampleGetSecret:
    fn::invoke:
      function: aws:secretsmanager:getSecret
      arguments:
        name: directconnect!prod/us-east-1/directconnect/0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef

    terraform {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

data "aws_directconnect_connection" "example" {
  name = "tf-dx-connection"
}
data "aws_secretsmanager_secret" "exampleGetSecret" {
  name = "directconnect!prod/us-east-1/directconnect/0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
}

resource "aws_directconnect_macsec_key_association" "example" {
  lifecycle {
    create_before_destroy = true
  }
  connection_id = data.aws_directconnect_connection.example.id
  secret_arn    = data.aws_secretsmanager_secret.exampleGetSecret.arn
}

    Create MacsecKeyAssociation Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new MacsecKeyAssociation(name: string, args: MacsecKeyAssociationArgs, opts?: CustomResourceOptions);
    @overload
def MacsecKeyAssociation(resource_name: str,
                         args: MacsecKeyAssociationArgs,
                         opts: Optional[ResourceOptions] = None)

@overload
def MacsecKeyAssociation(resource_name: str,
                         opts: Optional[ResourceOptions] = None,
                         connection_id: Optional[str] = None,
                         cak: Optional[str] = None,
                         cak_wo: Optional[str] = None,
                         cak_wo_version: Optional[int] = None,
                         ckn: Optional[str] = None,
                         ckn_wo: Optional[str] = None,
                         ckn_wo_version: Optional[int] = None,
                         region: Optional[str] = None,
                         secret_arn: Optional[str] = None)
    func NewMacsecKeyAssociation(ctx *Context, name string, args MacsecKeyAssociationArgs, opts ...ResourceOption) (*MacsecKeyAssociation, error)
    public MacsecKeyAssociation(string name, MacsecKeyAssociationArgs args, CustomResourceOptions? opts = null)
    public MacsecKeyAssociation(String name, MacsecKeyAssociationArgs args)
public MacsecKeyAssociation(String name, MacsecKeyAssociationArgs args, CustomResourceOptions options)

    type: aws:directconnect:MacsecKeyAssociation
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "aws_directconnect_macsec_key_association" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args MacsecKeyAssociationArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args MacsecKeyAssociationArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args MacsecKeyAssociationArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args MacsecKeyAssociationArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args MacsecKeyAssociationArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var macsecKeyAssociationResource = new Aws.DirectConnect.MacsecKeyAssociation("macsecKeyAssociationResource", new()
{
    ConnectionId = "string",
    Cak = "string",
    CakWo = "string",
    CakWoVersion = 0,
    Ckn = "string",
    CknWo = "string",
    CknWoVersion = 0,
    Region = "string",
    SecretArn = "string",
});

    example, err := directconnect.NewMacsecKeyAssociation(ctx, "macsecKeyAssociationResource", &directconnect.MacsecKeyAssociationArgs{
	ConnectionId: pulumi.String("string"),
	Cak:          pulumi.String("string"),
	CakWo:        pulumi.String("string"),
	CakWoVersion: pulumi.Int(0),
	Ckn:          pulumi.String("string"),
	CknWo:        pulumi.String("string"),
	CknWoVersion: pulumi.Int(0),
	Region:       pulumi.String("string"),
	SecretArn:    pulumi.String("string"),
})

    resource "aws_directconnect_macsec_key_association" "macsecKeyAssociationResource" {
  lifecycle {
    create_before_destroy = true
  }
  connection_id  = "string"
  cak            = "string"
  cak_wo         = "string"
  cak_wo_version = 0
  ckn            = "string"
  ckn_wo         = "string"
  ckn_wo_version = 0
  region         = "string"
  secret_arn     = "string"
}

    var macsecKeyAssociationResource = new MacsecKeyAssociation("macsecKeyAssociationResource", MacsecKeyAssociationArgs.builder()
    .connectionId("string")
    .cak("string")
    .cakWo("string")
    .cakWoVersion(0)
    .ckn("string")
    .cknWo("string")
    .cknWoVersion(0)
    .region("string")
    .secretArn("string")
    .build());

    macsec_key_association_resource = aws.directconnect.MacsecKeyAssociation("macsecKeyAssociationResource",
    connection_id="string",
    cak="string",
    cak_wo="string",
    cak_wo_version=0,
    ckn="string",
    ckn_wo="string",
    ckn_wo_version=0,
    region="string",
    secret_arn="string")

    const macsecKeyAssociationResource = new aws.directconnect.MacsecKeyAssociation("macsecKeyAssociationResource", {
    connectionId: "string",
    cak: "string",
    cakWo: "string",
    cakWoVersion: 0,
    ckn: "string",
    cknWo: "string",
    cknWoVersion: 0,
    region: "string",
    secretArn: "string",
});

    type: aws:directconnect:MacsecKeyAssociation
properties:
    cak: string
    cakWo: string
    cakWoVersion: 0
    ckn: string
    cknWo: string
    cknWoVersion: 0
    connectionId: string
    region: string
    secretArn: string

    MacsecKeyAssociation Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The MacsecKeyAssociation resource accepts the following input properties:

    ConnectionId string

    ID of the dedicated Direct Connect connection. The connection must be a dedicated connection in the AVAILABLE state.

    The following arguments are optional:

    Cak string
    MAC Security (MACsec) CAK to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Required with ckn or cknWo unless cakWo is configured. Conflicts with cakWo. Changing this argument replaces the association.
    CakWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only MAC Security (MACsec) CAK to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Requires cakWoVersion and either ckn or cknWo. Conflicts with cak and secretArn. This value is not stored in the plan or state.
    CakWoVersion int
    Positive integer used to trigger replacement when cakWo changes. Required with cakWo. Increment this value to replace the association using the current write-only values.
    Ckn string
    MAC Security (MACsec) CKN to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Required with cak or cakWo unless cknWo is configured. Conflicts with cknWo. Changing this argument replaces the association.
    CknWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only MAC Security (MACsec) CKN to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Requires cknWoVersion and either cak or cakWo. Conflicts with ckn and secretArn. This value is not stored in the plan or state.
    CknWoVersion int
    Positive integer used to trigger replacement when cknWo changes. Required with cknWo. Increment this value to replace the association using the current write-only values.
    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    SecretArn string

    ARN of the MAC Security (MACsec) secret key to associate with the dedicated connection.

    Note: Supply either a CAK/CKN pair (using regular or write-only arguments) or secretArn. Do not combine key arguments with secretArn.

    ConnectionId string

    ID of the dedicated Direct Connect connection. The connection must be a dedicated connection in the AVAILABLE state.

    The following arguments are optional:

    Cak string
    MAC Security (MACsec) CAK to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Required with ckn or cknWo unless cakWo is configured. Conflicts with cakWo. Changing this argument replaces the association.
    CakWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only MAC Security (MACsec) CAK to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Requires cakWoVersion and either ckn or cknWo. Conflicts with cak and secretArn. This value is not stored in the plan or state.
    CakWoVersion int
    Positive integer used to trigger replacement when cakWo changes. Required with cakWo. Increment this value to replace the association using the current write-only values.
    Ckn string
    MAC Security (MACsec) CKN to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Required with cak or cakWo unless cknWo is configured. Conflicts with cknWo. Changing this argument replaces the association.
    CknWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only MAC Security (MACsec) CKN to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Requires cknWoVersion and either cak or cakWo. Conflicts with ckn and secretArn. This value is not stored in the plan or state.
    CknWoVersion int
    Positive integer used to trigger replacement when cknWo changes. Required with cknWo. Increment this value to replace the association using the current write-only values.
    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    SecretArn string

    ARN of the MAC Security (MACsec) secret key to associate with the dedicated connection.

    Note: Supply either a CAK/CKN pair (using regular or write-only arguments) or secretArn. Do not combine key arguments with secretArn.

    connection_id string

    ID of the dedicated Direct Connect connection. The connection must be a dedicated connection in the AVAILABLE state.

    The following arguments are optional:

    cak string
    MAC Security (MACsec) CAK to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Required with ckn or cknWo unless cakWo is configured. Conflicts with cakWo. Changing this argument replaces the association.
    cak_wo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only MAC Security (MACsec) CAK to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Requires cakWoVersion and either ckn or cknWo. Conflicts with cak and secretArn. This value is not stored in the plan or state.
    cak_wo_version number
    Positive integer used to trigger replacement when cakWo changes. Required with cakWo. Increment this value to replace the association using the current write-only values.
    ckn string
    MAC Security (MACsec) CKN to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Required with cak or cakWo unless cknWo is configured. Conflicts with cknWo. Changing this argument replaces the association.
    ckn_wo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only MAC Security (MACsec) CKN to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Requires cknWoVersion and either cak or cakWo. Conflicts with ckn and secretArn. This value is not stored in the plan or state.
    ckn_wo_version number
    Positive integer used to trigger replacement when cknWo changes. Required with cknWo. Increment this value to replace the association using the current write-only values.
    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    secret_arn string

    ARN of the MAC Security (MACsec) secret key to associate with the dedicated connection.

    Note: Supply either a CAK/CKN pair (using regular or write-only arguments) or secretArn. Do not combine key arguments with secretArn.

    connectionId String

    ID of the dedicated Direct Connect connection. The connection must be a dedicated connection in the AVAILABLE state.

    The following arguments are optional:

    cak String
    MAC Security (MACsec) CAK to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Required with ckn or cknWo unless cakWo is configured. Conflicts with cakWo. Changing this argument replaces the association.
    cakWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only MAC Security (MACsec) CAK to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Requires cakWoVersion and either ckn or cknWo. Conflicts with cak and secretArn. This value is not stored in the plan or state.
    cakWoVersion Integer
    Positive integer used to trigger replacement when cakWo changes. Required with cakWo. Increment this value to replace the association using the current write-only values.
    ckn String
    MAC Security (MACsec) CKN to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Required with cak or cakWo unless cknWo is configured. Conflicts with cknWo. Changing this argument replaces the association.
    cknWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only MAC Security (MACsec) CKN to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Requires cknWoVersion and either cak or cakWo. Conflicts with ckn and secretArn. This value is not stored in the plan or state.
    cknWoVersion Integer
    Positive integer used to trigger replacement when cknWo changes. Required with cknWo. Increment this value to replace the association using the current write-only values.
    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    secretArn String

    ARN of the MAC Security (MACsec) secret key to associate with the dedicated connection.

    Note: Supply either a CAK/CKN pair (using regular or write-only arguments) or secretArn. Do not combine key arguments with secretArn.

    connectionId string

    ID of the dedicated Direct Connect connection. The connection must be a dedicated connection in the AVAILABLE state.

    The following arguments are optional:

    cak string
    MAC Security (MACsec) CAK to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Required with ckn or cknWo unless cakWo is configured. Conflicts with cakWo. Changing this argument replaces the association.
    cakWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only MAC Security (MACsec) CAK to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Requires cakWoVersion and either ckn or cknWo. Conflicts with cak and secretArn. This value is not stored in the plan or state.
    cakWoVersion number
    Positive integer used to trigger replacement when cakWo changes. Required with cakWo. Increment this value to replace the association using the current write-only values.
    ckn string
    MAC Security (MACsec) CKN to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Required with cak or cakWo unless cknWo is configured. Conflicts with cknWo. Changing this argument replaces the association.
    cknWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only MAC Security (MACsec) CKN to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Requires cknWoVersion and either cak or cakWo. Conflicts with ckn and secretArn. This value is not stored in the plan or state.
    cknWoVersion number
    Positive integer used to trigger replacement when cknWo changes. Required with cknWo. Increment this value to replace the association using the current write-only values.
    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    secretArn string

    ARN of the MAC Security (MACsec) secret key to associate with the dedicated connection.

    Note: Supply either a CAK/CKN pair (using regular or write-only arguments) or secretArn. Do not combine key arguments with secretArn.

    connection_id str

    ID of the dedicated Direct Connect connection. The connection must be a dedicated connection in the AVAILABLE state.

    The following arguments are optional:

    cak str
    MAC Security (MACsec) CAK to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Required with ckn or cknWo unless cakWo is configured. Conflicts with cakWo. Changing this argument replaces the association.
    cak_wo str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only MAC Security (MACsec) CAK to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Requires cakWoVersion and either ckn or cknWo. Conflicts with cak and secretArn. This value is not stored in the plan or state.
    cak_wo_version int
    Positive integer used to trigger replacement when cakWo changes. Required with cakWo. Increment this value to replace the association using the current write-only values.
    ckn str
    MAC Security (MACsec) CKN to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Required with cak or cakWo unless cknWo is configured. Conflicts with cknWo. Changing this argument replaces the association.
    ckn_wo str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only MAC Security (MACsec) CKN to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Requires cknWoVersion and either cak or cakWo. Conflicts with ckn and secretArn. This value is not stored in the plan or state.
    ckn_wo_version int
    Positive integer used to trigger replacement when cknWo changes. Required with cknWo. Increment this value to replace the association using the current write-only values.
    region str
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    secret_arn str

    ARN of the MAC Security (MACsec) secret key to associate with the dedicated connection.

    Note: Supply either a CAK/CKN pair (using regular or write-only arguments) or secretArn. Do not combine key arguments with secretArn.

    connectionId String

    ID of the dedicated Direct Connect connection. The connection must be a dedicated connection in the AVAILABLE state.

    The following arguments are optional:

    cak String
    MAC Security (MACsec) CAK to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Required with ckn or cknWo unless cakWo is configured. Conflicts with cakWo. Changing this argument replaces the association.
    cakWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only MAC Security (MACsec) CAK to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Requires cakWoVersion and either ckn or cknWo. Conflicts with cak and secretArn. This value is not stored in the plan or state.
    cakWoVersion Number
    Positive integer used to trigger replacement when cakWo changes. Required with cakWo. Increment this value to replace the association using the current write-only values.
    ckn String
    MAC Security (MACsec) CKN to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Required with cak or cakWo unless cknWo is configured. Conflicts with cknWo. Changing this argument replaces the association.
    cknWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only MAC Security (MACsec) CKN to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Requires cknWoVersion and either cak or cakWo. Conflicts with ckn and secretArn. This value is not stored in the plan or state.
    cknWoVersion Number
    Positive integer used to trigger replacement when cknWo changes. Required with cknWo. Increment this value to replace the association using the current write-only values.
    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    secretArn String

    ARN of the MAC Security (MACsec) secret key to associate with the dedicated connection.

    Note: Supply either a CAK/CKN pair (using regular or write-only arguments) or secretArn. Do not combine key arguments with secretArn.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the MacsecKeyAssociation resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    StartOn string
    The date in UTC format that the MAC Security (MACsec) secret key takes effect.
    State string
    The state of the MAC Security (MACsec) secret key. The possible values are: associating, associated, disassociating, disassociated. See MacSecKey for descriptions of each state.
    Id string
    The provider-assigned unique ID for this managed resource.
    StartOn string
    The date in UTC format that the MAC Security (MACsec) secret key takes effect.
    State string
    The state of the MAC Security (MACsec) secret key. The possible values are: associating, associated, disassociating, disassociated. See MacSecKey for descriptions of each state.
    id string
    The provider-assigned unique ID for this managed resource.
    start_on string
    The date in UTC format that the MAC Security (MACsec) secret key takes effect.
    state string
    The state of the MAC Security (MACsec) secret key. The possible values are: associating, associated, disassociating, disassociated. See MacSecKey for descriptions of each state.
    id String
    The provider-assigned unique ID for this managed resource.
    startOn String
    The date in UTC format that the MAC Security (MACsec) secret key takes effect.
    state String
    The state of the MAC Security (MACsec) secret key. The possible values are: associating, associated, disassociating, disassociated. See MacSecKey for descriptions of each state.
    id string
    The provider-assigned unique ID for this managed resource.
    startOn string
    The date in UTC format that the MAC Security (MACsec) secret key takes effect.
    state string
    The state of the MAC Security (MACsec) secret key. The possible values are: associating, associated, disassociating, disassociated. See MacSecKey for descriptions of each state.
    id str
    The provider-assigned unique ID for this managed resource.
    start_on str
    The date in UTC format that the MAC Security (MACsec) secret key takes effect.
    state str
    The state of the MAC Security (MACsec) secret key. The possible values are: associating, associated, disassociating, disassociated. See MacSecKey for descriptions of each state.
    id String
    The provider-assigned unique ID for this managed resource.
    startOn String
    The date in UTC format that the MAC Security (MACsec) secret key takes effect.
    state String
    The state of the MAC Security (MACsec) secret key. The possible values are: associating, associated, disassociating, disassociated. See MacSecKey for descriptions of each state.

    Look up Existing MacsecKeyAssociation Resource

    Get an existing MacsecKeyAssociation resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: MacsecKeyAssociationState, opts?: CustomResourceOptions): MacsecKeyAssociation
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        cak: Optional[str] = None,
        cak_wo: Optional[str] = None,
        cak_wo_version: Optional[int] = None,
        ckn: Optional[str] = None,
        ckn_wo: Optional[str] = None,
        ckn_wo_version: Optional[int] = None,
        connection_id: Optional[str] = None,
        region: Optional[str] = None,
        secret_arn: Optional[str] = None,
        start_on: Optional[str] = None,
        state: Optional[str] = None) -> MacsecKeyAssociation
    func GetMacsecKeyAssociation(ctx *Context, name string, id IDInput, state *MacsecKeyAssociationState, opts ...ResourceOption) (*MacsecKeyAssociation, error)
    public static MacsecKeyAssociation Get(string name, Input<string> id, MacsecKeyAssociationState? state, CustomResourceOptions? opts = null)
    public static MacsecKeyAssociation get(String name, Output<String> id, MacsecKeyAssociationState state, CustomResourceOptions options)
    resources:  _:    type: aws:directconnect:MacsecKeyAssociation    get:      id: ${id}
    import {
  to = aws_directconnect_macsec_key_association.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Cak string
    MAC Security (MACsec) CAK to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Required with ckn or cknWo unless cakWo is configured. Conflicts with cakWo. Changing this argument replaces the association.
    CakWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only MAC Security (MACsec) CAK to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Requires cakWoVersion and either ckn or cknWo. Conflicts with cak and secretArn. This value is not stored in the plan or state.
    CakWoVersion int
    Positive integer used to trigger replacement when cakWo changes. Required with cakWo. Increment this value to replace the association using the current write-only values.
    Ckn string
    MAC Security (MACsec) CKN to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Required with cak or cakWo unless cknWo is configured. Conflicts with cknWo. Changing this argument replaces the association.
    CknWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only MAC Security (MACsec) CKN to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Requires cknWoVersion and either cak or cakWo. Conflicts with ckn and secretArn. This value is not stored in the plan or state.
    CknWoVersion int
    Positive integer used to trigger replacement when cknWo changes. Required with cknWo. Increment this value to replace the association using the current write-only values.
    ConnectionId string

    ID of the dedicated Direct Connect connection. The connection must be a dedicated connection in the AVAILABLE state.

    The following arguments are optional:

    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    SecretArn string

    ARN of the MAC Security (MACsec) secret key to associate with the dedicated connection.

    Note: Supply either a CAK/CKN pair (using regular or write-only arguments) or secretArn. Do not combine key arguments with secretArn.

    StartOn string
    The date in UTC format that the MAC Security (MACsec) secret key takes effect.
    State string
    The state of the MAC Security (MACsec) secret key. The possible values are: associating, associated, disassociating, disassociated. See MacSecKey for descriptions of each state.
    Cak string
    MAC Security (MACsec) CAK to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Required with ckn or cknWo unless cakWo is configured. Conflicts with cakWo. Changing this argument replaces the association.
    CakWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only MAC Security (MACsec) CAK to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Requires cakWoVersion and either ckn or cknWo. Conflicts with cak and secretArn. This value is not stored in the plan or state.
    CakWoVersion int
    Positive integer used to trigger replacement when cakWo changes. Required with cakWo. Increment this value to replace the association using the current write-only values.
    Ckn string
    MAC Security (MACsec) CKN to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Required with cak or cakWo unless cknWo is configured. Conflicts with cknWo. Changing this argument replaces the association.
    CknWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only MAC Security (MACsec) CKN to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Requires cknWoVersion and either cak or cakWo. Conflicts with ckn and secretArn. This value is not stored in the plan or state.
    CknWoVersion int
    Positive integer used to trigger replacement when cknWo changes. Required with cknWo. Increment this value to replace the association using the current write-only values.
    ConnectionId string

    ID of the dedicated Direct Connect connection. The connection must be a dedicated connection in the AVAILABLE state.

    The following arguments are optional:

    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    SecretArn string

    ARN of the MAC Security (MACsec) secret key to associate with the dedicated connection.

    Note: Supply either a CAK/CKN pair (using regular or write-only arguments) or secretArn. Do not combine key arguments with secretArn.

    StartOn string
    The date in UTC format that the MAC Security (MACsec) secret key takes effect.
    State string
    The state of the MAC Security (MACsec) secret key. The possible values are: associating, associated, disassociating, disassociated. See MacSecKey for descriptions of each state.
    cak string
    MAC Security (MACsec) CAK to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Required with ckn or cknWo unless cakWo is configured. Conflicts with cakWo. Changing this argument replaces the association.
    cak_wo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only MAC Security (MACsec) CAK to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Requires cakWoVersion and either ckn or cknWo. Conflicts with cak and secretArn. This value is not stored in the plan or state.
    cak_wo_version number
    Positive integer used to trigger replacement when cakWo changes. Required with cakWo. Increment this value to replace the association using the current write-only values.
    ckn string
    MAC Security (MACsec) CKN to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Required with cak or cakWo unless cknWo is configured. Conflicts with cknWo. Changing this argument replaces the association.
    ckn_wo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only MAC Security (MACsec) CKN to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Requires cknWoVersion and either cak or cakWo. Conflicts with ckn and secretArn. This value is not stored in the plan or state.
    ckn_wo_version number
    Positive integer used to trigger replacement when cknWo changes. Required with cknWo. Increment this value to replace the association using the current write-only values.
    connection_id string

    ID of the dedicated Direct Connect connection. The connection must be a dedicated connection in the AVAILABLE state.

    The following arguments are optional:

    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    secret_arn string

    ARN of the MAC Security (MACsec) secret key to associate with the dedicated connection.

    Note: Supply either a CAK/CKN pair (using regular or write-only arguments) or secretArn. Do not combine key arguments with secretArn.

    start_on string
    The date in UTC format that the MAC Security (MACsec) secret key takes effect.
    state string
    The state of the MAC Security (MACsec) secret key. The possible values are: associating, associated, disassociating, disassociated. See MacSecKey for descriptions of each state.
    cak String
    MAC Security (MACsec) CAK to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Required with ckn or cknWo unless cakWo is configured. Conflicts with cakWo. Changing this argument replaces the association.
    cakWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only MAC Security (MACsec) CAK to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Requires cakWoVersion and either ckn or cknWo. Conflicts with cak and secretArn. This value is not stored in the plan or state.
    cakWoVersion Integer
    Positive integer used to trigger replacement when cakWo changes. Required with cakWo. Increment this value to replace the association using the current write-only values.
    ckn String
    MAC Security (MACsec) CKN to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Required with cak or cakWo unless cknWo is configured. Conflicts with cknWo. Changing this argument replaces the association.
    cknWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only MAC Security (MACsec) CKN to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Requires cknWoVersion and either cak or cakWo. Conflicts with ckn and secretArn. This value is not stored in the plan or state.
    cknWoVersion Integer
    Positive integer used to trigger replacement when cknWo changes. Required with cknWo. Increment this value to replace the association using the current write-only values.
    connectionId String

    ID of the dedicated Direct Connect connection. The connection must be a dedicated connection in the AVAILABLE state.

    The following arguments are optional:

    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    secretArn String

    ARN of the MAC Security (MACsec) secret key to associate with the dedicated connection.

    Note: Supply either a CAK/CKN pair (using regular or write-only arguments) or secretArn. Do not combine key arguments with secretArn.

    startOn String
    The date in UTC format that the MAC Security (MACsec) secret key takes effect.
    state String
    The state of the MAC Security (MACsec) secret key. The possible values are: associating, associated, disassociating, disassociated. See MacSecKey for descriptions of each state.
    cak string
    MAC Security (MACsec) CAK to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Required with ckn or cknWo unless cakWo is configured. Conflicts with cakWo. Changing this argument replaces the association.
    cakWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only MAC Security (MACsec) CAK to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Requires cakWoVersion and either ckn or cknWo. Conflicts with cak and secretArn. This value is not stored in the plan or state.
    cakWoVersion number
    Positive integer used to trigger replacement when cakWo changes. Required with cakWo. Increment this value to replace the association using the current write-only values.
    ckn string
    MAC Security (MACsec) CKN to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Required with cak or cakWo unless cknWo is configured. Conflicts with cknWo. Changing this argument replaces the association.
    cknWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only MAC Security (MACsec) CKN to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Requires cknWoVersion and either cak or cakWo. Conflicts with ckn and secretArn. This value is not stored in the plan or state.
    cknWoVersion number
    Positive integer used to trigger replacement when cknWo changes. Required with cknWo. Increment this value to replace the association using the current write-only values.
    connectionId string

    ID of the dedicated Direct Connect connection. The connection must be a dedicated connection in the AVAILABLE state.

    The following arguments are optional:

    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    secretArn string

    ARN of the MAC Security (MACsec) secret key to associate with the dedicated connection.

    Note: Supply either a CAK/CKN pair (using regular or write-only arguments) or secretArn. Do not combine key arguments with secretArn.

    startOn string
    The date in UTC format that the MAC Security (MACsec) secret key takes effect.
    state string
    The state of the MAC Security (MACsec) secret key. The possible values are: associating, associated, disassociating, disassociated. See MacSecKey for descriptions of each state.
    cak str
    MAC Security (MACsec) CAK to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Required with ckn or cknWo unless cakWo is configured. Conflicts with cakWo. Changing this argument replaces the association.
    cak_wo str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only MAC Security (MACsec) CAK to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Requires cakWoVersion and either ckn or cknWo. Conflicts with cak and secretArn. This value is not stored in the plan or state.
    cak_wo_version int
    Positive integer used to trigger replacement when cakWo changes. Required with cakWo. Increment this value to replace the association using the current write-only values.
    ckn str
    MAC Security (MACsec) CKN to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Required with cak or cakWo unless cknWo is configured. Conflicts with cknWo. Changing this argument replaces the association.
    ckn_wo str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only MAC Security (MACsec) CKN to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Requires cknWoVersion and either cak or cakWo. Conflicts with ckn and secretArn. This value is not stored in the plan or state.
    ckn_wo_version int
    Positive integer used to trigger replacement when cknWo changes. Required with cknWo. Increment this value to replace the association using the current write-only values.
    connection_id str

    ID of the dedicated Direct Connect connection. The connection must be a dedicated connection in the AVAILABLE state.

    The following arguments are optional:

    region str
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    secret_arn str

    ARN of the MAC Security (MACsec) secret key to associate with the dedicated connection.

    Note: Supply either a CAK/CKN pair (using regular or write-only arguments) or secretArn. Do not combine key arguments with secretArn.

    start_on str
    The date in UTC format that the MAC Security (MACsec) secret key takes effect.
    state str
    The state of the MAC Security (MACsec) secret key. The possible values are: associating, associated, disassociating, disassociated. See MacSecKey for descriptions of each state.
    cak String
    MAC Security (MACsec) CAK to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Required with ckn or cknWo unless cakWo is configured. Conflicts with cakWo. Changing this argument replaces the association.
    cakWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only MAC Security (MACsec) CAK to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Requires cakWoVersion and either ckn or cknWo. Conflicts with cak and secretArn. This value is not stored in the plan or state.
    cakWoVersion Number
    Positive integer used to trigger replacement when cakWo changes. Required with cakWo. Increment this value to replace the association using the current write-only values.
    ckn String
    MAC Security (MACsec) CKN to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Required with cak or cakWo unless cknWo is configured. Conflicts with cknWo. Changing this argument replaces the association.
    cknWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only MAC Security (MACsec) CKN to associate with the dedicated connection. Valid values are 64 hexadecimal characters (0-9, A-F). Requires cknWoVersion and either cak or cakWo. Conflicts with ckn and secretArn. This value is not stored in the plan or state.
    cknWoVersion Number
    Positive integer used to trigger replacement when cknWo changes. Required with cknWo. Increment this value to replace the association using the current write-only values.
    connectionId String

    ID of the dedicated Direct Connect connection. The connection must be a dedicated connection in the AVAILABLE state.

    The following arguments are optional:

    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    secretArn String

    ARN of the MAC Security (MACsec) secret key to associate with the dedicated connection.

    Note: Supply either a CAK/CKN pair (using regular or write-only arguments) or secretArn. Do not combine key arguments with secretArn.

    startOn String
    The date in UTC format that the MAC Security (MACsec) secret key takes effect.
    state String
    The state of the MAC Security (MACsec) secret key. The possible values are: associating, associated, disassociating, disassociated. See MacSecKey for descriptions of each state.

    Package Details

    Repository
    AWS Classic pulumi/pulumi-aws
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the aws Terraform Provider.
    aws logo aws logo
    Viewing docs for AWS v7.52.1
    published on Wednesday, Oct 28, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-aws

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial