Viewing docs for Formal v1.2.2
published on Wednesday, Jul 15, 2026 by Formal
published on Wednesday, Jul 15, 2026 by Formal
Viewing docs for Formal v1.2.2
published on Wednesday, Jul 15, 2026 by Formal
published on Wednesday, Jul 15, 2026 by Formal
Registering an Encryption Key with Formal.
Create EncryptionKey Resource
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax
new EncryptionKey(name: string, args: EncryptionKeyArgs, opts?: CustomResourceOptions);@overload
def EncryptionKey(resource_name: str,
args: EncryptionKeyArgs,
opts: Optional[ResourceOptions] = None)
@overload
def EncryptionKey(resource_name: str,
opts: Optional[ResourceOptions] = None,
key_id: Optional[str] = None,
key_provider: Optional[str] = None,
algorithm: Optional[str] = None,
decryptor_uri: Optional[str] = None,
public_key_pem: Optional[str] = None)func NewEncryptionKey(ctx *Context, name string, args EncryptionKeyArgs, opts ...ResourceOption) (*EncryptionKey, error)public EncryptionKey(string name, EncryptionKeyArgs args, CustomResourceOptions? opts = null)
public EncryptionKey(String name, EncryptionKeyArgs args)
public EncryptionKey(String name, EncryptionKeyArgs args, CustomResourceOptions options)
type: formal:EncryptionKey
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
resource "formal_encryption_key" "name" {
# resource properties
}Parameters
- name string
- The unique name of the resource.
- args EncryptionKeyArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args EncryptionKeyArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args EncryptionKeyArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args EncryptionKeyArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args EncryptionKeyArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
Constructor example
The following reference example uses placeholder values for all input properties.
var encryptionKeyResource = new Pulumi.EncryptionKey("encryptionKeyResource", new()
{
KeyId = "string",
KeyProvider = "string",
DecryptorUri = "string",
PublicKeyPem = "string",
});
example, err := formal.NewEncryptionKey(ctx, "encryptionKeyResource", &formal.EncryptionKeyArgs{
KeyId: pulumi.String("string"),
KeyProvider: pulumi.String("string"),
DecryptorUri: pulumi.String("string"),
PublicKeyPem: pulumi.String("string"),
})
resource "formal_encryption_key" "encryptionKeyResource" {
lifecycle {
create_before_destroy = true
}
key_id = "string"
key_provider = "string"
decryptor_uri = "string"
public_key_pem = "string"
}
var encryptionKeyResource = new EncryptionKey("encryptionKeyResource", EncryptionKeyArgs.builder()
.keyId("string")
.keyProvider("string")
.decryptorUri("string")
.publicKeyPem("string")
.build());
encryption_key_resource = formal.EncryptionKey("encryptionKeyResource",
key_id="string",
key_provider="string",
decryptor_uri="string",
public_key_pem="string")
const encryptionKeyResource = new formal.EncryptionKey("encryptionKeyResource", {
keyId: "string",
keyProvider: "string",
decryptorUri: "string",
publicKeyPem: "string",
});
type: formal:EncryptionKey
properties:
decryptorUri: string
keyId: string
keyProvider: string
publicKeyPem: string
EncryptionKey Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.
The EncryptionKey resource accepts the following input properties:
- Key
Id string - The ID of the key in the provider's system (key ARN for AWS KMS, or the crypto key version resource name for GCP KMS).
- Key
Provider string - The provider of the encryption key. One of 'aws-kms' or 'gcp-kms' ('aws' is a deprecated alias for 'aws-kms').
- Algorithm string
- Deprecated. Symmetric and deterministic algorithms ('aesrandom', 'aesdeterministic') are no longer supported. Encryption keys use asymmetric RSA ('rsaesoaepsha256'), which is the default.
- Decryptor
Uri string - The URI of the decryptor (e.g., a URL to a Lambda function, either directly or via API Gateway). This is used to decrypt the data on the frontend only (and is never called by the Formal Control Plane backend).
- Public
Key stringPem - PEM-encoded RSA public key for client-side encryption. Required for all encryption keys. Typically wired from another resource, e.g.
data.aws_kms_public_key.<name>.public_key_pemfor an asymmetric AWS KMS key.
- Key
Id string - The ID of the key in the provider's system (key ARN for AWS KMS, or the crypto key version resource name for GCP KMS).
- Key
Provider string - The provider of the encryption key. One of 'aws-kms' or 'gcp-kms' ('aws' is a deprecated alias for 'aws-kms').
- Algorithm string
- Deprecated. Symmetric and deterministic algorithms ('aesrandom', 'aesdeterministic') are no longer supported. Encryption keys use asymmetric RSA ('rsaesoaepsha256'), which is the default.
- Decryptor
Uri string - The URI of the decryptor (e.g., a URL to a Lambda function, either directly or via API Gateway). This is used to decrypt the data on the frontend only (and is never called by the Formal Control Plane backend).
- Public
Key stringPem - PEM-encoded RSA public key for client-side encryption. Required for all encryption keys. Typically wired from another resource, e.g.
data.aws_kms_public_key.<name>.public_key_pemfor an asymmetric AWS KMS key.
- key_
id string - The ID of the key in the provider's system (key ARN for AWS KMS, or the crypto key version resource name for GCP KMS).
- key_
provider string - The provider of the encryption key. One of 'aws-kms' or 'gcp-kms' ('aws' is a deprecated alias for 'aws-kms').
- algorithm string
- Deprecated. Symmetric and deterministic algorithms ('aesrandom', 'aesdeterministic') are no longer supported. Encryption keys use asymmetric RSA ('rsaesoaepsha256'), which is the default.
- decryptor_
uri string - The URI of the decryptor (e.g., a URL to a Lambda function, either directly or via API Gateway). This is used to decrypt the data on the frontend only (and is never called by the Formal Control Plane backend).
- public_
key_ stringpem - PEM-encoded RSA public key for client-side encryption. Required for all encryption keys. Typically wired from another resource, e.g.
data.aws_kms_public_key.<name>.public_key_pemfor an asymmetric AWS KMS key.
- key
Id String - The ID of the key in the provider's system (key ARN for AWS KMS, or the crypto key version resource name for GCP KMS).
- key
Provider String - The provider of the encryption key. One of 'aws-kms' or 'gcp-kms' ('aws' is a deprecated alias for 'aws-kms').
- algorithm String
- Deprecated. Symmetric and deterministic algorithms ('aesrandom', 'aesdeterministic') are no longer supported. Encryption keys use asymmetric RSA ('rsaesoaepsha256'), which is the default.
- decryptor
Uri String - The URI of the decryptor (e.g., a URL to a Lambda function, either directly or via API Gateway). This is used to decrypt the data on the frontend only (and is never called by the Formal Control Plane backend).
- public
Key StringPem - PEM-encoded RSA public key for client-side encryption. Required for all encryption keys. Typically wired from another resource, e.g.
data.aws_kms_public_key.<name>.public_key_pemfor an asymmetric AWS KMS key.
- key
Id string - The ID of the key in the provider's system (key ARN for AWS KMS, or the crypto key version resource name for GCP KMS).
- key
Provider string - The provider of the encryption key. One of 'aws-kms' or 'gcp-kms' ('aws' is a deprecated alias for 'aws-kms').
- algorithm string
- Deprecated. Symmetric and deterministic algorithms ('aesrandom', 'aesdeterministic') are no longer supported. Encryption keys use asymmetric RSA ('rsaesoaepsha256'), which is the default.
- decryptor
Uri string - The URI of the decryptor (e.g., a URL to a Lambda function, either directly or via API Gateway). This is used to decrypt the data on the frontend only (and is never called by the Formal Control Plane backend).
- public
Key stringPem - PEM-encoded RSA public key for client-side encryption. Required for all encryption keys. Typically wired from another resource, e.g.
data.aws_kms_public_key.<name>.public_key_pemfor an asymmetric AWS KMS key.
- key_
id str - The ID of the key in the provider's system (key ARN for AWS KMS, or the crypto key version resource name for GCP KMS).
- key_
provider str - The provider of the encryption key. One of 'aws-kms' or 'gcp-kms' ('aws' is a deprecated alias for 'aws-kms').
- algorithm str
- Deprecated. Symmetric and deterministic algorithms ('aesrandom', 'aesdeterministic') are no longer supported. Encryption keys use asymmetric RSA ('rsaesoaepsha256'), which is the default.
- decryptor_
uri str - The URI of the decryptor (e.g., a URL to a Lambda function, either directly or via API Gateway). This is used to decrypt the data on the frontend only (and is never called by the Formal Control Plane backend).
- public_
key_ strpem - PEM-encoded RSA public key for client-side encryption. Required for all encryption keys. Typically wired from another resource, e.g.
data.aws_kms_public_key.<name>.public_key_pemfor an asymmetric AWS KMS key.
- key
Id String - The ID of the key in the provider's system (key ARN for AWS KMS, or the crypto key version resource name for GCP KMS).
- key
Provider String - The provider of the encryption key. One of 'aws-kms' or 'gcp-kms' ('aws' is a deprecated alias for 'aws-kms').
- algorithm String
- Deprecated. Symmetric and deterministic algorithms ('aesrandom', 'aesdeterministic') are no longer supported. Encryption keys use asymmetric RSA ('rsaesoaepsha256'), which is the default.
- decryptor
Uri String - The URI of the decryptor (e.g., a URL to a Lambda function, either directly or via API Gateway). This is used to decrypt the data on the frontend only (and is never called by the Formal Control Plane backend).
- public
Key StringPem - PEM-encoded RSA public key for client-side encryption. Required for all encryption keys. Typically wired from another resource, e.g.
data.aws_kms_public_key.<name>.public_key_pemfor an asymmetric AWS KMS key.
Outputs
All input properties are implicitly available as output properties. Additionally, the EncryptionKey resource produces the following output properties:
- created_
at string - When the encryption key was created.
- id string
- The provider-assigned unique ID for this managed resource.
- updated_
at string - Last update time.
- created_
at str - When the encryption key was created.
- id str
- The provider-assigned unique ID for this managed resource.
- updated_
at str - Last update time.
Look up Existing EncryptionKey Resource
Get an existing EncryptionKey resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: EncryptionKeyState, opts?: CustomResourceOptions): EncryptionKey@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
algorithm: Optional[str] = None,
created_at: Optional[str] = None,
decryptor_uri: Optional[str] = None,
key_id: Optional[str] = None,
key_provider: Optional[str] = None,
public_key_pem: Optional[str] = None,
updated_at: Optional[str] = None) -> EncryptionKeyfunc GetEncryptionKey(ctx *Context, name string, id IDInput, state *EncryptionKeyState, opts ...ResourceOption) (*EncryptionKey, error)public static EncryptionKey Get(string name, Input<string> id, EncryptionKeyState? state, CustomResourceOptions? opts = null)public static EncryptionKey get(String name, Output<String> id, EncryptionKeyState state, CustomResourceOptions options)resources: _: type: formal:EncryptionKey get: id: ${id}import {
to = formal_encryption_key.example
id = "${id}"
}
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Algorithm string
- Deprecated. Symmetric and deterministic algorithms ('aesrandom', 'aesdeterministic') are no longer supported. Encryption keys use asymmetric RSA ('rsaesoaepsha256'), which is the default.
- Created
At string - When the encryption key was created.
- Decryptor
Uri string - The URI of the decryptor (e.g., a URL to a Lambda function, either directly or via API Gateway). This is used to decrypt the data on the frontend only (and is never called by the Formal Control Plane backend).
- Key
Id string - The ID of the key in the provider's system (key ARN for AWS KMS, or the crypto key version resource name for GCP KMS).
- Key
Provider string - The provider of the encryption key. One of 'aws-kms' or 'gcp-kms' ('aws' is a deprecated alias for 'aws-kms').
- Public
Key stringPem - PEM-encoded RSA public key for client-side encryption. Required for all encryption keys. Typically wired from another resource, e.g.
data.aws_kms_public_key.<name>.public_key_pemfor an asymmetric AWS KMS key. - Updated
At string - Last update time.
- Algorithm string
- Deprecated. Symmetric and deterministic algorithms ('aesrandom', 'aesdeterministic') are no longer supported. Encryption keys use asymmetric RSA ('rsaesoaepsha256'), which is the default.
- Created
At string - When the encryption key was created.
- Decryptor
Uri string - The URI of the decryptor (e.g., a URL to a Lambda function, either directly or via API Gateway). This is used to decrypt the data on the frontend only (and is never called by the Formal Control Plane backend).
- Key
Id string - The ID of the key in the provider's system (key ARN for AWS KMS, or the crypto key version resource name for GCP KMS).
- Key
Provider string - The provider of the encryption key. One of 'aws-kms' or 'gcp-kms' ('aws' is a deprecated alias for 'aws-kms').
- Public
Key stringPem - PEM-encoded RSA public key for client-side encryption. Required for all encryption keys. Typically wired from another resource, e.g.
data.aws_kms_public_key.<name>.public_key_pemfor an asymmetric AWS KMS key. - Updated
At string - Last update time.
- algorithm string
- Deprecated. Symmetric and deterministic algorithms ('aesrandom', 'aesdeterministic') are no longer supported. Encryption keys use asymmetric RSA ('rsaesoaepsha256'), which is the default.
- created_
at string - When the encryption key was created.
- decryptor_
uri string - The URI of the decryptor (e.g., a URL to a Lambda function, either directly or via API Gateway). This is used to decrypt the data on the frontend only (and is never called by the Formal Control Plane backend).
- key_
id string - The ID of the key in the provider's system (key ARN for AWS KMS, or the crypto key version resource name for GCP KMS).
- key_
provider string - The provider of the encryption key. One of 'aws-kms' or 'gcp-kms' ('aws' is a deprecated alias for 'aws-kms').
- public_
key_ stringpem - PEM-encoded RSA public key for client-side encryption. Required for all encryption keys. Typically wired from another resource, e.g.
data.aws_kms_public_key.<name>.public_key_pemfor an asymmetric AWS KMS key. - updated_
at string - Last update time.
- algorithm String
- Deprecated. Symmetric and deterministic algorithms ('aesrandom', 'aesdeterministic') are no longer supported. Encryption keys use asymmetric RSA ('rsaesoaepsha256'), which is the default.
- created
At String - When the encryption key was created.
- decryptor
Uri String - The URI of the decryptor (e.g., a URL to a Lambda function, either directly or via API Gateway). This is used to decrypt the data on the frontend only (and is never called by the Formal Control Plane backend).
- key
Id String - The ID of the key in the provider's system (key ARN for AWS KMS, or the crypto key version resource name for GCP KMS).
- key
Provider String - The provider of the encryption key. One of 'aws-kms' or 'gcp-kms' ('aws' is a deprecated alias for 'aws-kms').
- public
Key StringPem - PEM-encoded RSA public key for client-side encryption. Required for all encryption keys. Typically wired from another resource, e.g.
data.aws_kms_public_key.<name>.public_key_pemfor an asymmetric AWS KMS key. - updated
At String - Last update time.
- algorithm string
- Deprecated. Symmetric and deterministic algorithms ('aesrandom', 'aesdeterministic') are no longer supported. Encryption keys use asymmetric RSA ('rsaesoaepsha256'), which is the default.
- created
At string - When the encryption key was created.
- decryptor
Uri string - The URI of the decryptor (e.g., a URL to a Lambda function, either directly or via API Gateway). This is used to decrypt the data on the frontend only (and is never called by the Formal Control Plane backend).
- key
Id string - The ID of the key in the provider's system (key ARN for AWS KMS, or the crypto key version resource name for GCP KMS).
- key
Provider string - The provider of the encryption key. One of 'aws-kms' or 'gcp-kms' ('aws' is a deprecated alias for 'aws-kms').
- public
Key stringPem - PEM-encoded RSA public key for client-side encryption. Required for all encryption keys. Typically wired from another resource, e.g.
data.aws_kms_public_key.<name>.public_key_pemfor an asymmetric AWS KMS key. - updated
At string - Last update time.
- algorithm str
- Deprecated. Symmetric and deterministic algorithms ('aesrandom', 'aesdeterministic') are no longer supported. Encryption keys use asymmetric RSA ('rsaesoaepsha256'), which is the default.
- created_
at str - When the encryption key was created.
- decryptor_
uri str - The URI of the decryptor (e.g., a URL to a Lambda function, either directly or via API Gateway). This is used to decrypt the data on the frontend only (and is never called by the Formal Control Plane backend).
- key_
id str - The ID of the key in the provider's system (key ARN for AWS KMS, or the crypto key version resource name for GCP KMS).
- key_
provider str - The provider of the encryption key. One of 'aws-kms' or 'gcp-kms' ('aws' is a deprecated alias for 'aws-kms').
- public_
key_ strpem - PEM-encoded RSA public key for client-side encryption. Required for all encryption keys. Typically wired from another resource, e.g.
data.aws_kms_public_key.<name>.public_key_pemfor an asymmetric AWS KMS key. - updated_
at str - Last update time.
- algorithm String
- Deprecated. Symmetric and deterministic algorithms ('aesrandom', 'aesdeterministic') are no longer supported. Encryption keys use asymmetric RSA ('rsaesoaepsha256'), which is the default.
- created
At String - When the encryption key was created.
- decryptor
Uri String - The URI of the decryptor (e.g., a URL to a Lambda function, either directly or via API Gateway). This is used to decrypt the data on the frontend only (and is never called by the Formal Control Plane backend).
- key
Id String - The ID of the key in the provider's system (key ARN for AWS KMS, or the crypto key version resource name for GCP KMS).
- key
Provider String - The provider of the encryption key. One of 'aws-kms' or 'gcp-kms' ('aws' is a deprecated alias for 'aws-kms').
- public
Key StringPem - PEM-encoded RSA public key for client-side encryption. Required for all encryption keys. Typically wired from another resource, e.g.
data.aws_kms_public_key.<name>.public_key_pemfor an asymmetric AWS KMS key. - updated
At String - Last update time.
Package Details
- Repository
- formal formalco/pulumi-formal
- License
- MPL-2.0
- Notes
- This Pulumi package is based on the
formalTerraform Provider.
Viewing docs for Formal v1.2.2
published on Wednesday, Jul 15, 2026 by Formal
published on Wednesday, Jul 15, 2026 by Formal