Sign in Dashboard Get started
  1. Packages
  2. Packages
  3. Ibm Provider
  4. API Docs
  5. KmsCryptounits
Viewing docs for ibm 2.5.0-beta0
published on Thursday, Jul 23, 2026 by ibm-cloud
Schema (JSON)
ibm-cloud/terraform-provider-ibm

ibm.KmsCryptounits

Viewing docs for ibm 2.5.0-beta0
published on Thursday, Jul 23, 2026 by ibm-cloud
Schema (JSON)
ibm-cloud/terraform-provider-ibm

    Create KmsCryptounits Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new KmsCryptounits(name: string, args: KmsCryptounitsArgs, opts?: CustomResourceOptions);
    @overload
def KmsCryptounits(resource_name: str,
                   args: KmsCryptounitsArgs,
                   opts: Optional[ResourceOptions] = None)

@overload
def KmsCryptounits(resource_name: str,
                   opts: Optional[ResourceOptions] = None,
                   instance_id: Optional[str] = None,
                   master_key: Optional[KmsCryptounitsMasterKeyArgs] = None,
                   signature_key: Optional[KmsCryptounitsSignatureKeyArgs] = None,
                   kms_cryptounits_id: Optional[str] = None,
                   region: Optional[str] = None,
                   should_zeroize: Optional[bool] = None,
                   timeouts: Optional[KmsCryptounitsTimeoutsArgs] = None,
                   url: Optional[str] = None,
                   use_private_endpoint: Optional[bool] = None)
    func NewKmsCryptounits(ctx *Context, name string, args KmsCryptounitsArgs, opts ...ResourceOption) (*KmsCryptounits, error)
    public KmsCryptounits(string name, KmsCryptounitsArgs args, CustomResourceOptions? opts = null)
    public KmsCryptounits(String name, KmsCryptounitsArgs args)
public KmsCryptounits(String name, KmsCryptounitsArgs args, CustomResourceOptions options)

    type: ibm:KmsCryptounits
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "ibm_kms_cryptounits" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args KmsCryptounitsArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args KmsCryptounitsArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args KmsCryptounitsArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args KmsCryptounitsArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args KmsCryptounitsArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var kmsCryptounitsResource = new Ibm.KmsCryptounits("kmsCryptounitsResource", new()
{
    InstanceId = "string",
    MasterKey = new Ibm.Inputs.KmsCryptounitsMasterKeyArgs
    {
        Keyname = "string",
        Keysharefiles = new[]
        {
            new Ibm.Inputs.KmsCryptounitsMasterKeyKeysharefileArgs
            {
                Filepath = "string",
                Passphrase = "string",
            },
        },
    },
    SignatureKey = new Ibm.Inputs.KmsCryptounitsSignatureKeyArgs
    {
        Filepath = "string",
        Passphrase = "string",
        Owner = "string",
    },
    KmsCryptounitsId = "string",
    Region = "string",
    ShouldZeroize = false,
    Timeouts = new Ibm.Inputs.KmsCryptounitsTimeoutsArgs
    {
        Create = "string",
        Update = "string",
    },
    Url = "string",
    UsePrivateEndpoint = false,
});

    example, err := ibm.NewKmsCryptounits(ctx, "kmsCryptounitsResource", &ibm.KmsCryptounitsArgs{
	InstanceId: pulumi.String("string"),
	MasterKey: &ibm.KmsCryptounitsMasterKeyArgs{
		Keyname: pulumi.String("string"),
		Keysharefiles: ibm.KmsCryptounitsMasterKeyKeysharefileArray{
			&ibm.KmsCryptounitsMasterKeyKeysharefileArgs{
				Filepath:   pulumi.String("string"),
				Passphrase: pulumi.String("string"),
			},
		},
	},
	SignatureKey: &ibm.KmsCryptounitsSignatureKeyArgs{
		Filepath:   pulumi.String("string"),
		Passphrase: pulumi.String("string"),
		Owner:      pulumi.String("string"),
	},
	KmsCryptounitsId: pulumi.String("string"),
	Region:           pulumi.String("string"),
	ShouldZeroize:    pulumi.Bool(false),
	Timeouts: &ibm.KmsCryptounitsTimeoutsArgs{
		Create: pulumi.String("string"),
		Update: pulumi.String("string"),
	},
	Url:                pulumi.String("string"),
	UsePrivateEndpoint: pulumi.Bool(false),
})

    resource "ibm_kms_cryptounits" "kmsCryptounitsResource" {
  lifecycle {
    create_before_destroy = true
  }
  instance_id = "string"
  master_key = {
    keyname = "string"
    keysharefiles = [{
      filepath   = "string"
      passphrase = "string"
    }]
  }
  signature_key = {
    filepath   = "string"
    passphrase = "string"
    owner      = "string"
  }
  kms_cryptounits_id = "string"
  region             = "string"
  should_zeroize     = false
  timeouts = {
    create = "string"
    update = "string"
  }
  url                  = "string"
  use_private_endpoint = false
}

    var kmsCryptounitsResource = new KmsCryptounits("kmsCryptounitsResource", KmsCryptounitsArgs.builder()
    .instanceId("string")
    .masterKey(KmsCryptounitsMasterKeyArgs.builder()
        .keyname("string")
        .keysharefiles(KmsCryptounitsMasterKeyKeysharefileArgs.builder()
            .filepath("string")
            .passphrase("string")
            .build())
        .build())
    .signatureKey(KmsCryptounitsSignatureKeyArgs.builder()
        .filepath("string")
        .passphrase("string")
        .owner("string")
        .build())
    .kmsCryptounitsId("string")
    .region("string")
    .shouldZeroize(false)
    .timeouts(KmsCryptounitsTimeoutsArgs.builder()
        .create("string")
        .update("string")
        .build())
    .url("string")
    .usePrivateEndpoint(false)
    .build());

    kms_cryptounits_resource = ibm.KmsCryptounits("kmsCryptounitsResource",
    instance_id="string",
    master_key={
        "keyname": "string",
        "keysharefiles": [{
            "filepath": "string",
            "passphrase": "string",
        }],
    },
    signature_key={
        "filepath": "string",
        "passphrase": "string",
        "owner": "string",
    },
    kms_cryptounits_id="string",
    region="string",
    should_zeroize=False,
    timeouts={
        "create": "string",
        "update": "string",
    },
    url="string",
    use_private_endpoint=False)

    const kmsCryptounitsResource = new ibm.KmsCryptounits("kmsCryptounitsResource", {
    instanceId: "string",
    masterKey: {
        keyname: "string",
        keysharefiles: [{
            filepath: "string",
            passphrase: "string",
        }],
    },
    signatureKey: {
        filepath: "string",
        passphrase: "string",
        owner: "string",
    },
    kmsCryptounitsId: "string",
    region: "string",
    shouldZeroize: false,
    timeouts: {
        create: "string",
        update: "string",
    },
    url: "string",
    usePrivateEndpoint: false,
});

    type: ibm:KmsCryptounits
properties:
    instanceId: string
    kmsCryptounitsId: string
    masterKey:
        keyname: string
        keysharefiles:
            - filepath: string
              passphrase: string
    region: string
    shouldZeroize: false
    signatureKey:
        filepath: string
        owner: string
        passphrase: string
    timeouts:
        create: string
        update: string
    url: string
    usePrivateEndpoint: false

    KmsCryptounits Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The KmsCryptounits resource accepts the following input properties:

    InstanceId string
    The Key Protect Dedicated instance GUID or CRN.
    MasterKey KmsCryptounitsMasterKey

    Configuration for the master backup key.

    Nested scheme for master_key:

    SignatureKey KmsCryptounitsSignatureKey

    Credentials for the administrator who will create sessions with the cryptounits.

    IMPORTANT: This field will create a signature key or use an existing one found in the filepath.

    Nested scheme for signature_key:

    KmsCryptounitsId string
    (String) The unique identifier of the crypto unit.
    Region string
    The region where the Key Protect Dedicated instance resides (e.g., "us-south"). Required if url is not provided.
    ShouldZeroize bool
    set to true if the resource should be zeroized. Zeroizing if harmful if not understood. Set to false as a safe default
    Timeouts KmsCryptounitsTimeouts
    Url string
    The URL to use when targeting the resource. If not provided, the URL will be constructed from instance_id and region.
    UsePrivateEndpoint bool
    Set to true to use the private endpoint, otherwise false. Default is false.
    InstanceId string
    The Key Protect Dedicated instance GUID or CRN.
    MasterKey KmsCryptounitsMasterKeyArgs

    Configuration for the master backup key.

    Nested scheme for master_key:

    SignatureKey KmsCryptounitsSignatureKeyArgs

    Credentials for the administrator who will create sessions with the cryptounits.

    IMPORTANT: This field will create a signature key or use an existing one found in the filepath.

    Nested scheme for signature_key:

    KmsCryptounitsId string
    (String) The unique identifier of the crypto unit.
    Region string
    The region where the Key Protect Dedicated instance resides (e.g., "us-south"). Required if url is not provided.
    ShouldZeroize bool
    set to true if the resource should be zeroized. Zeroizing if harmful if not understood. Set to false as a safe default
    Timeouts KmsCryptounitsTimeoutsArgs
    Url string
    The URL to use when targeting the resource. If not provided, the URL will be constructed from instance_id and region.
    UsePrivateEndpoint bool
    Set to true to use the private endpoint, otherwise false. Default is false.
    instance_id string
    The Key Protect Dedicated instance GUID or CRN.
    master_key object

    Configuration for the master backup key.

    Nested scheme for master_key:

    signature_key object

    Credentials for the administrator who will create sessions with the cryptounits.

    IMPORTANT: This field will create a signature key or use an existing one found in the filepath.

    Nested scheme for signature_key:

    kms_cryptounits_id string
    (String) The unique identifier of the crypto unit.
    region string
    The region where the Key Protect Dedicated instance resides (e.g., "us-south"). Required if url is not provided.
    should_zeroize bool
    set to true if the resource should be zeroized. Zeroizing if harmful if not understood. Set to false as a safe default
    timeouts object
    url string
    The URL to use when targeting the resource. If not provided, the URL will be constructed from instance_id and region.
    use_private_endpoint bool
    Set to true to use the private endpoint, otherwise false. Default is false.
    instanceId String
    The Key Protect Dedicated instance GUID or CRN.
    masterKey KmsCryptounitsMasterKey

    Configuration for the master backup key.

    Nested scheme for master_key:

    signatureKey KmsCryptounitsSignatureKey

    Credentials for the administrator who will create sessions with the cryptounits.

    IMPORTANT: This field will create a signature key or use an existing one found in the filepath.

    Nested scheme for signature_key:

    kmsCryptounitsId String
    (String) The unique identifier of the crypto unit.
    region String
    The region where the Key Protect Dedicated instance resides (e.g., "us-south"). Required if url is not provided.
    shouldZeroize Boolean
    set to true if the resource should be zeroized. Zeroizing if harmful if not understood. Set to false as a safe default
    timeouts KmsCryptounitsTimeouts
    url String
    The URL to use when targeting the resource. If not provided, the URL will be constructed from instance_id and region.
    usePrivateEndpoint Boolean
    Set to true to use the private endpoint, otherwise false. Default is false.
    instanceId string
    The Key Protect Dedicated instance GUID or CRN.
    masterKey KmsCryptounitsMasterKey

    Configuration for the master backup key.

    Nested scheme for master_key:

    signatureKey KmsCryptounitsSignatureKey

    Credentials for the administrator who will create sessions with the cryptounits.

    IMPORTANT: This field will create a signature key or use an existing one found in the filepath.

    Nested scheme for signature_key:

    kmsCryptounitsId string
    (String) The unique identifier of the crypto unit.
    region string
    The region where the Key Protect Dedicated instance resides (e.g., "us-south"). Required if url is not provided.
    shouldZeroize boolean
    set to true if the resource should be zeroized. Zeroizing if harmful if not understood. Set to false as a safe default
    timeouts KmsCryptounitsTimeouts
    url string
    The URL to use when targeting the resource. If not provided, the URL will be constructed from instance_id and region.
    usePrivateEndpoint boolean
    Set to true to use the private endpoint, otherwise false. Default is false.
    instance_id str
    The Key Protect Dedicated instance GUID or CRN.
    master_key KmsCryptounitsMasterKeyArgs

    Configuration for the master backup key.

    Nested scheme for master_key:

    signature_key KmsCryptounitsSignatureKeyArgs

    Credentials for the administrator who will create sessions with the cryptounits.

    IMPORTANT: This field will create a signature key or use an existing one found in the filepath.

    Nested scheme for signature_key:

    kms_cryptounits_id str
    (String) The unique identifier of the crypto unit.
    region str
    The region where the Key Protect Dedicated instance resides (e.g., "us-south"). Required if url is not provided.
    should_zeroize bool
    set to true if the resource should be zeroized. Zeroizing if harmful if not understood. Set to false as a safe default
    timeouts KmsCryptounitsTimeoutsArgs
    url str
    The URL to use when targeting the resource. If not provided, the URL will be constructed from instance_id and region.
    use_private_endpoint bool
    Set to true to use the private endpoint, otherwise false. Default is false.
    instanceId String
    The Key Protect Dedicated instance GUID or CRN.
    masterKey Property Map

    Configuration for the master backup key.

    Nested scheme for master_key:

    signatureKey Property Map

    Credentials for the administrator who will create sessions with the cryptounits.

    IMPORTANT: This field will create a signature key or use an existing one found in the filepath.

    Nested scheme for signature_key:

    kmsCryptounitsId String
    (String) The unique identifier of the crypto unit.
    region String
    The region where the Key Protect Dedicated instance resides (e.g., "us-south"). Required if url is not provided.
    shouldZeroize Boolean
    set to true if the resource should be zeroized. Zeroizing if harmful if not understood. Set to false as a safe default
    timeouts Property Map
    url String
    The URL to use when targeting the resource. If not provided, the URL will be constructed from instance_id and region.
    usePrivateEndpoint Boolean
    Set to true to use the private endpoint, otherwise false. Default is false.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the KmsCryptounits resource produces the following output properties:

    Cryptounits List<KmsCryptounitsCryptounit>
    (Set) A set of cryptounit objects representing the cryptounits associated with the Key Protect Dedicated instance.
    Id string
    The provider-assigned unique ID for this managed resource.
    Cryptounits []KmsCryptounitsCryptounit
    (Set) A set of cryptounit objects representing the cryptounits associated with the Key Protect Dedicated instance.
    Id string
    The provider-assigned unique ID for this managed resource.
    cryptounits list(object)
    (Set) A set of cryptounit objects representing the cryptounits associated with the Key Protect Dedicated instance.
    id string
    The provider-assigned unique ID for this managed resource.
    cryptounits List<KmsCryptounitsCryptounit>
    (Set) A set of cryptounit objects representing the cryptounits associated with the Key Protect Dedicated instance.
    id String
    The provider-assigned unique ID for this managed resource.
    cryptounits KmsCryptounitsCryptounit[]
    (Set) A set of cryptounit objects representing the cryptounits associated with the Key Protect Dedicated instance.
    id string
    The provider-assigned unique ID for this managed resource.
    cryptounits Sequence[KmsCryptounitsCryptounit]
    (Set) A set of cryptounit objects representing the cryptounits associated with the Key Protect Dedicated instance.
    id str
    The provider-assigned unique ID for this managed resource.
    cryptounits List<Property Map>
    (Set) A set of cryptounit objects representing the cryptounits associated with the Key Protect Dedicated instance.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing KmsCryptounits Resource

    Get an existing KmsCryptounits resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: KmsCryptounitsState, opts?: CustomResourceOptions): KmsCryptounits
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        cryptounits: Optional[Sequence[KmsCryptounitsCryptounitArgs]] = None,
        instance_id: Optional[str] = None,
        kms_cryptounits_id: Optional[str] = None,
        master_key: Optional[KmsCryptounitsMasterKeyArgs] = None,
        region: Optional[str] = None,
        should_zeroize: Optional[bool] = None,
        signature_key: Optional[KmsCryptounitsSignatureKeyArgs] = None,
        timeouts: Optional[KmsCryptounitsTimeoutsArgs] = None,
        url: Optional[str] = None,
        use_private_endpoint: Optional[bool] = None) -> KmsCryptounits
    func GetKmsCryptounits(ctx *Context, name string, id IDInput, state *KmsCryptounitsState, opts ...ResourceOption) (*KmsCryptounits, error)
    public static KmsCryptounits Get(string name, Input<string> id, KmsCryptounitsState? state, CustomResourceOptions? opts = null)
    public static KmsCryptounits get(String name, Output<String> id, KmsCryptounitsState state, CustomResourceOptions options)
    resources:  _:    type: ibm:KmsCryptounits    get:      id: ${id}
    import {
  to = ibm_kms_cryptounits.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Cryptounits List<KmsCryptounitsCryptounit>
    (Set) A set of cryptounit objects representing the cryptounits associated with the Key Protect Dedicated instance.
    InstanceId string
    The Key Protect Dedicated instance GUID or CRN.
    KmsCryptounitsId string
    (String) The unique identifier of the crypto unit.
    MasterKey KmsCryptounitsMasterKey

    Configuration for the master backup key.

    Nested scheme for master_key:

    Region string
    The region where the Key Protect Dedicated instance resides (e.g., "us-south"). Required if url is not provided.
    ShouldZeroize bool
    set to true if the resource should be zeroized. Zeroizing if harmful if not understood. Set to false as a safe default
    SignatureKey KmsCryptounitsSignatureKey

    Credentials for the administrator who will create sessions with the cryptounits.

    IMPORTANT: This field will create a signature key or use an existing one found in the filepath.

    Nested scheme for signature_key:

    Timeouts KmsCryptounitsTimeouts
    Url string
    The URL to use when targeting the resource. If not provided, the URL will be constructed from instance_id and region.
    UsePrivateEndpoint bool
    Set to true to use the private endpoint, otherwise false. Default is false.
    Cryptounits []KmsCryptounitsCryptounitArgs
    (Set) A set of cryptounit objects representing the cryptounits associated with the Key Protect Dedicated instance.
    InstanceId string
    The Key Protect Dedicated instance GUID or CRN.
    KmsCryptounitsId string
    (String) The unique identifier of the crypto unit.
    MasterKey KmsCryptounitsMasterKeyArgs

    Configuration for the master backup key.

    Nested scheme for master_key:

    Region string
    The region where the Key Protect Dedicated instance resides (e.g., "us-south"). Required if url is not provided.
    ShouldZeroize bool
    set to true if the resource should be zeroized. Zeroizing if harmful if not understood. Set to false as a safe default
    SignatureKey KmsCryptounitsSignatureKeyArgs

    Credentials for the administrator who will create sessions with the cryptounits.

    IMPORTANT: This field will create a signature key or use an existing one found in the filepath.

    Nested scheme for signature_key:

    Timeouts KmsCryptounitsTimeoutsArgs
    Url string
    The URL to use when targeting the resource. If not provided, the URL will be constructed from instance_id and region.
    UsePrivateEndpoint bool
    Set to true to use the private endpoint, otherwise false. Default is false.
    cryptounits list(object)
    (Set) A set of cryptounit objects representing the cryptounits associated with the Key Protect Dedicated instance.
    instance_id string
    The Key Protect Dedicated instance GUID or CRN.
    kms_cryptounits_id string
    (String) The unique identifier of the crypto unit.
    master_key object

    Configuration for the master backup key.

    Nested scheme for master_key:

    region string
    The region where the Key Protect Dedicated instance resides (e.g., "us-south"). Required if url is not provided.
    should_zeroize bool
    set to true if the resource should be zeroized. Zeroizing if harmful if not understood. Set to false as a safe default
    signature_key object

    Credentials for the administrator who will create sessions with the cryptounits.

    IMPORTANT: This field will create a signature key or use an existing one found in the filepath.

    Nested scheme for signature_key:

    timeouts object
    url string
    The URL to use when targeting the resource. If not provided, the URL will be constructed from instance_id and region.
    use_private_endpoint bool
    Set to true to use the private endpoint, otherwise false. Default is false.
    cryptounits List<KmsCryptounitsCryptounit>
    (Set) A set of cryptounit objects representing the cryptounits associated with the Key Protect Dedicated instance.
    instanceId String
    The Key Protect Dedicated instance GUID or CRN.
    kmsCryptounitsId String
    (String) The unique identifier of the crypto unit.
    masterKey KmsCryptounitsMasterKey

    Configuration for the master backup key.

    Nested scheme for master_key:

    region String
    The region where the Key Protect Dedicated instance resides (e.g., "us-south"). Required if url is not provided.
    shouldZeroize Boolean
    set to true if the resource should be zeroized. Zeroizing if harmful if not understood. Set to false as a safe default
    signatureKey KmsCryptounitsSignatureKey

    Credentials for the administrator who will create sessions with the cryptounits.

    IMPORTANT: This field will create a signature key or use an existing one found in the filepath.

    Nested scheme for signature_key:

    timeouts KmsCryptounitsTimeouts
    url String
    The URL to use when targeting the resource. If not provided, the URL will be constructed from instance_id and region.
    usePrivateEndpoint Boolean
    Set to true to use the private endpoint, otherwise false. Default is false.
    cryptounits KmsCryptounitsCryptounit[]
    (Set) A set of cryptounit objects representing the cryptounits associated with the Key Protect Dedicated instance.
    instanceId string
    The Key Protect Dedicated instance GUID or CRN.
    kmsCryptounitsId string
    (String) The unique identifier of the crypto unit.
    masterKey KmsCryptounitsMasterKey

    Configuration for the master backup key.

    Nested scheme for master_key:

    region string
    The region where the Key Protect Dedicated instance resides (e.g., "us-south"). Required if url is not provided.
    shouldZeroize boolean
    set to true if the resource should be zeroized. Zeroizing if harmful if not understood. Set to false as a safe default
    signatureKey KmsCryptounitsSignatureKey

    Credentials for the administrator who will create sessions with the cryptounits.

    IMPORTANT: This field will create a signature key or use an existing one found in the filepath.

    Nested scheme for signature_key:

    timeouts KmsCryptounitsTimeouts
    url string
    The URL to use when targeting the resource. If not provided, the URL will be constructed from instance_id and region.
    usePrivateEndpoint boolean
    Set to true to use the private endpoint, otherwise false. Default is false.
    cryptounits Sequence[KmsCryptounitsCryptounitArgs]
    (Set) A set of cryptounit objects representing the cryptounits associated with the Key Protect Dedicated instance.
    instance_id str
    The Key Protect Dedicated instance GUID or CRN.
    kms_cryptounits_id str
    (String) The unique identifier of the crypto unit.
    master_key KmsCryptounitsMasterKeyArgs

    Configuration for the master backup key.

    Nested scheme for master_key:

    region str
    The region where the Key Protect Dedicated instance resides (e.g., "us-south"). Required if url is not provided.
    should_zeroize bool
    set to true if the resource should be zeroized. Zeroizing if harmful if not understood. Set to false as a safe default
    signature_key KmsCryptounitsSignatureKeyArgs

    Credentials for the administrator who will create sessions with the cryptounits.

    IMPORTANT: This field will create a signature key or use an existing one found in the filepath.

    Nested scheme for signature_key:

    timeouts KmsCryptounitsTimeoutsArgs
    url str
    The URL to use when targeting the resource. If not provided, the URL will be constructed from instance_id and region.
    use_private_endpoint bool
    Set to true to use the private endpoint, otherwise false. Default is false.
    cryptounits List<Property Map>
    (Set) A set of cryptounit objects representing the cryptounits associated with the Key Protect Dedicated instance.
    instanceId String
    The Key Protect Dedicated instance GUID or CRN.
    kmsCryptounitsId String
    (String) The unique identifier of the crypto unit.
    masterKey Property Map

    Configuration for the master backup key.

    Nested scheme for master_key:

    region String
    The region where the Key Protect Dedicated instance resides (e.g., "us-south"). Required if url is not provided.
    shouldZeroize Boolean
    set to true if the resource should be zeroized. Zeroizing if harmful if not understood. Set to false as a safe default
    signatureKey Property Map

    Credentials for the administrator who will create sessions with the cryptounits.

    IMPORTANT: This field will create a signature key or use an existing one found in the filepath.

    Nested scheme for signature_key:

    timeouts Property Map
    url String
    The URL to use when targeting the resource. If not provided, the URL will be constructed from instance_id and region.
    usePrivateEndpoint Boolean
    Set to true to use the private endpoint, otherwise false. Default is false.

    Supporting Types

    KmsCryptounitsCryptounit, KmsCryptounitsCryptounitArgs

    Id string
    (String) The unique identifier of the crypto unit.
    State string
    (String) The current state of the crypto unit (e.g., CryptoUnitStateInitialized, CryptoUnitStateKMSInitialized, CryptoUnitStateZeroized).
    Id string
    (String) The unique identifier of the crypto unit.
    State string
    (String) The current state of the crypto unit (e.g., CryptoUnitStateInitialized, CryptoUnitStateKMSInitialized, CryptoUnitStateZeroized).
    id string
    (String) The unique identifier of the crypto unit.
    state string
    (String) The current state of the crypto unit (e.g., CryptoUnitStateInitialized, CryptoUnitStateKMSInitialized, CryptoUnitStateZeroized).
    id String
    (String) The unique identifier of the crypto unit.
    state String
    (String) The current state of the crypto unit (e.g., CryptoUnitStateInitialized, CryptoUnitStateKMSInitialized, CryptoUnitStateZeroized).
    id string
    (String) The unique identifier of the crypto unit.
    state string
    (String) The current state of the crypto unit (e.g., CryptoUnitStateInitialized, CryptoUnitStateKMSInitialized, CryptoUnitStateZeroized).
    id str
    (String) The unique identifier of the crypto unit.
    state str
    (String) The current state of the crypto unit (e.g., CryptoUnitStateInitialized, CryptoUnitStateKMSInitialized, CryptoUnitStateZeroized).
    id String
    (String) The unique identifier of the crypto unit.
    state String
    (String) The current state of the crypto unit (e.g., CryptoUnitStateInitialized, CryptoUnitStateKMSInitialized, CryptoUnitStateZeroized).

    KmsCryptounitsMasterKey, KmsCryptounitsMasterKeyArgs

    Keyname string
    The name of the master backup key as shown on the cryptounit. Must be 8 characters or less.
    Keysharefiles List<KmsCryptounitsMasterKeyKeysharefile>

    two or more key share file configurations. Each key share file represents a part of the master key.

    IMPORTANT: This field will create a signature key or use an existing one found in the filepaths of the keysharefile. WARNING: This field currently enforces K = N for master key generation, requiring all generated key shares to reconstruct or use the master key.

    Nested scheme for keysharefile:

    Keyname string
    The name of the master backup key as shown on the cryptounit. Must be 8 characters or less.
    Keysharefiles []KmsCryptounitsMasterKeyKeysharefile

    two or more key share file configurations. Each key share file represents a part of the master key.

    IMPORTANT: This field will create a signature key or use an existing one found in the filepaths of the keysharefile. WARNING: This field currently enforces K = N for master key generation, requiring all generated key shares to reconstruct or use the master key.

    Nested scheme for keysharefile:

    keyname string
    The name of the master backup key as shown on the cryptounit. Must be 8 characters or less.
    keysharefiles list(object)

    two or more key share file configurations. Each key share file represents a part of the master key.

    IMPORTANT: This field will create a signature key or use an existing one found in the filepaths of the keysharefile. WARNING: This field currently enforces K = N for master key generation, requiring all generated key shares to reconstruct or use the master key.

    Nested scheme for keysharefile:

    keyname String
    The name of the master backup key as shown on the cryptounit. Must be 8 characters or less.
    keysharefiles List<KmsCryptounitsMasterKeyKeysharefile>

    two or more key share file configurations. Each key share file represents a part of the master key.

    IMPORTANT: This field will create a signature key or use an existing one found in the filepaths of the keysharefile. WARNING: This field currently enforces K = N for master key generation, requiring all generated key shares to reconstruct or use the master key.

    Nested scheme for keysharefile:

    keyname string
    The name of the master backup key as shown on the cryptounit. Must be 8 characters or less.
    keysharefiles KmsCryptounitsMasterKeyKeysharefile[]

    two or more key share file configurations. Each key share file represents a part of the master key.

    IMPORTANT: This field will create a signature key or use an existing one found in the filepaths of the keysharefile. WARNING: This field currently enforces K = N for master key generation, requiring all generated key shares to reconstruct or use the master key.

    Nested scheme for keysharefile:

    keyname str
    The name of the master backup key as shown on the cryptounit. Must be 8 characters or less.
    keysharefiles Sequence[KmsCryptounitsMasterKeyKeysharefile]

    two or more key share file configurations. Each key share file represents a part of the master key.

    IMPORTANT: This field will create a signature key or use an existing one found in the filepaths of the keysharefile. WARNING: This field currently enforces K = N for master key generation, requiring all generated key shares to reconstruct or use the master key.

    Nested scheme for keysharefile:

    keyname String
    The name of the master backup key as shown on the cryptounit. Must be 8 characters or less.
    keysharefiles List<Property Map>

    two or more key share file configurations. Each key share file represents a part of the master key.

    IMPORTANT: This field will create a signature key or use an existing one found in the filepaths of the keysharefile. WARNING: This field currently enforces K = N for master key generation, requiring all generated key shares to reconstruct or use the master key.

    Nested scheme for keysharefile:

    KmsCryptounitsMasterKeyKeysharefile, KmsCryptounitsMasterKeyKeysharefileArgs

    Filepath string
    The filepath to store the key share file or find an existing one
    Passphrase string
    The passphrase associated with the key share file. This value is sensitive and will not be stored in state.
    Filepath string
    The filepath to store the key share file or find an existing one
    Passphrase string
    The passphrase associated with the key share file. This value is sensitive and will not be stored in state.
    filepath string
    The filepath to store the key share file or find an existing one
    passphrase string
    The passphrase associated with the key share file. This value is sensitive and will not be stored in state.
    filepath String
    The filepath to store the key share file or find an existing one
    passphrase String
    The passphrase associated with the key share file. This value is sensitive and will not be stored in state.
    filepath string
    The filepath to store the key share file or find an existing one
    passphrase string
    The passphrase associated with the key share file. This value is sensitive and will not be stored in state.
    filepath str
    The filepath to store the key share file or find an existing one
    passphrase str
    The passphrase associated with the key share file. This value is sensitive and will not be stored in state.
    filepath String
    The filepath to store the key share file or find an existing one
    passphrase String
    The passphrase associated with the key share file. This value is sensitive and will not be stored in state.

    KmsCryptounitsSignatureKey, KmsCryptounitsSignatureKeyArgs

    Filepath string
    The filepath to store the signature key or find an exisiting signature key
    Passphrase string
    The passphrase for the signature key. This value is sensitive and will not be stored in state.
    Owner string
    The owner of the signature_key
    Filepath string
    The filepath to store the signature key or find an exisiting signature key
    Passphrase string
    The passphrase for the signature key. This value is sensitive and will not be stored in state.
    Owner string
    The owner of the signature_key
    filepath string
    The filepath to store the signature key or find an exisiting signature key
    passphrase string
    The passphrase for the signature key. This value is sensitive and will not be stored in state.
    owner string
    The owner of the signature_key
    filepath String
    The filepath to store the signature key or find an exisiting signature key
    passphrase String
    The passphrase for the signature key. This value is sensitive and will not be stored in state.
    owner String
    The owner of the signature_key
    filepath string
    The filepath to store the signature key or find an exisiting signature key
    passphrase string
    The passphrase for the signature key. This value is sensitive and will not be stored in state.
    owner string
    The owner of the signature_key
    filepath str
    The filepath to store the signature key or find an exisiting signature key
    passphrase str
    The passphrase for the signature key. This value is sensitive and will not be stored in state.
    owner str
    The owner of the signature_key
    filepath String
    The filepath to store the signature key or find an exisiting signature key
    passphrase String
    The passphrase for the signature key. This value is sensitive and will not be stored in state.
    owner String
    The owner of the signature_key

    KmsCryptounitsTimeouts, KmsCryptounitsTimeoutsArgs

    Create string
    Update string
    Create string
    Update string
    create string
    update string
    create String
    update String
    create string
    update string
    create str
    update str
    create String
    update String

    Package Details

    Repository
    ibm ibm-cloud/terraform-provider-ibm
    License
    Notes
    This Pulumi package is based on the ibm Terraform Provider.
    Viewing docs for ibm 2.5.0-beta0
    published on Thursday, Jul 23, 2026 by ibm-cloud
    Schema (JSON)
    ibm-cloud/terraform-provider-ibm

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial