Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Scaleway
  4. API Docs
  5. keymanager
  6. KeyMaterial
Viewing docs for Scaleway v1.55.1
published on Wednesday, Sep 9, 2026 by pulumiverse
Schema (JSON)
pulumiverse/pulumi-scaleway

scaleway.keymanager.KeyMaterial

scaleway logo
Viewing docs for Scaleway v1.55.1
published on Wednesday, Sep 9, 2026 by pulumiverse
Schema (JSON)
pulumiverse/pulumi-scaleway

    Import externally generated key material into Key Manager to derive a new cryptographic key. The key’s origin must be external.

    Security Best Practice: For enhanced security, we recommend using the keyMaterialWo and saltWo write-only arguments instead of the regular keyMaterial and salt arguments. This ensures your sensitive cryptographic material is never stored in Terraform state files, providing superior protection against accidental exposure. Write-Only arguments are supported in Terraform 1.11.0 and later.

    Note: When using write-only arguments (keyMaterialWo and saltWo), you must also provide the corresponding version fields (keyMaterialWoVersion and saltWoVersion) to enable proper resource lifecycle management.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as random from "@pulumi/random";
import * as scaleway from "@pulumiverse/scaleway";
import * as std from "@pulumi/std";

const main = new scaleway.keymanager.Key("main", {
    name: "my-external-key",
    description: "Key with externally imported material",
    usage: "symmetric_encryption",
    algorithm: "aes_256_gcm",
    origin: "external",
    region: "fr-par",
});
const keyMaterial = new random.index.Bytes("key_material", {length: 32});
const mainKeyMaterial = new scaleway.keymanager.KeyMaterial("main", {
    keyId: main.id,
    keyMaterialWo: std.base64encode({
        input: keyMaterial.base64,
    }).then(invoke => invoke.result),
    keyMaterialWoVersion: 1,
});

    import pulumi
import pulumi_random as random
import pulumi_std as std
import pulumiverse_scaleway as scaleway

main = scaleway.keymanager.Key("main",
    name="my-external-key",
    description="Key with externally imported material",
    usage="symmetric_encryption",
    algorithm="aes_256_gcm",
    origin="external",
    region="fr-par")
key_material = random.Bytes("key_material", length=32)
main_key_material = scaleway.keymanager.KeyMaterial("main",
    key_id=main.id,
    key_material_wo=std.base64encode(input=key_material["base64"]).result,
    key_material_wo_version=1)

    package main

import (
	"github.com/pulumi/pulumi-random/sdk/v4/go/random"
	"github.com/pulumi/pulumi-std/sdk/go/std"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	"github.com/pulumiverse/pulumi-scaleway/sdk/go/scaleway/keymanager"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		main, err := keymanager.NewKey(ctx, "main", &keymanager.KeyArgs{
			Name:        pulumi.String("my-external-key"),
			Description: pulumi.String("Key with externally imported material"),
			Usage:       pulumi.String("symmetric_encryption"),
			Algorithm:   pulumi.String("aes_256_gcm"),
			Origin:      pulumi.String("external"),
			Region:      pulumi.String("fr-par"),
		})
		if err != nil {
			return err
		}
		keyMaterial, err := random.NewBytes(ctx, "key_material", &random.BytesArgs{
			Length: 32,
		})
		if err != nil {
			return err
		}
		invokeBase64encode, err := std.Base64encode(ctx, &std.Base64encodeArgs{
			Input: keyMaterial.Base64,
		}, nil)
		if err != nil {
			return err
		}
		_, err = keymanager.NewKeyMaterial(ctx, "main", &keymanager.KeyMaterialArgs{
			KeyId:                main.ID().ToIDOutput().ToStringOutput(),
			KeyMaterialWo:        pulumi.String(invokeBase64encode.Result),
			KeyMaterialWoVersion: pulumi.Int(1),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Random = Pulumi.Random;
using Scaleway = Pulumiverse.Scaleway;
using Std = Pulumi.Std;

return await Deployment.RunAsync(() => 
{
    var main = new Scaleway.Keymanager.Key("main", new()
    {
        Name = "my-external-key",
        Description = "Key with externally imported material",
        Usage = "symmetric_encryption",
        Algorithm = "aes_256_gcm",
        Origin = "external",
        Region = "fr-par",
    });

    var keyMaterial = new Random.Bytes("key_material", new()
    {
        Length = 32,
    });

    var mainKeyMaterial = new Scaleway.Keymanager.KeyMaterial("main", new()
    {
        KeyId = main.Id,
        KeyMaterialWo = Std.Base64encode.Invoke(new()
        {
            Input = keyMaterial.Base64,
        }).Apply(invoke => invoke.Result),
        KeyMaterialWoVersion = 1,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.scaleway.keymanager.Key;
import com.pulumi.scaleway.keymanager.KeyArgs;
import com.pulumi.random.Bytes;
import com.pulumi.random.BytesArgs;
import com.pulumi.scaleway.keymanager.KeyMaterial;
import com.pulumi.scaleway.keymanager.KeyMaterialArgs;
import com.pulumi.std.StdFunctions;
import com.pulumi.std.inputs.Base64encodeArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var main = new Key("main", KeyArgs.builder()
            .name("my-external-key")
            .description("Key with externally imported material")
            .usage("symmetric_encryption")
            .algorithm("aes_256_gcm")
            .origin("external")
            .region("fr-par")
            .build());

        var keyMaterial = new Bytes("keyMaterial", BytesArgs.builder()
            .length(32)
            .build());

        var mainKeyMaterial = new KeyMaterial("mainKeyMaterial", KeyMaterialArgs.builder()
            .keyId(main.id())
            .keyMaterialWo(StdFunctions.base64encode(Base64encodeArgs.builder()
                .input(keyMaterial.base64())
                .build()).result())
            .keyMaterialWoVersion(1)
            .build());

    }
}

    resources:
  main:
    type: scaleway:keymanager:Key
    properties:
      name: my-external-key
      description: Key with externally imported material
      usage: symmetric_encryption
      algorithm: aes_256_gcm
      origin: external
      region: fr-par
  keyMaterial:
    type: random:Bytes
    name: key_material
    properties:
      length: 32 # 256-bit key for AES-256
  mainKeyMaterial:
    type: scaleway:keymanager:KeyMaterial
    name: main
    properties:
      keyId: ${main.id}
      keyMaterialWo:
        fn::invoke:
          function: std:base64encode
          arguments:
            input: ${keyMaterial.base64}
          return: result
      keyMaterialWoVersion: 1

    pulumi {
  required_providers {
    random = {
      source = "pulumi/random"
    }
    scaleway = {
      source = "pulumi/scaleway"
    }
    std = {
      source = "pulumi/std"
    }
  }
}

resource "scaleway_keymanager_key" "main" {
  name        = "my-external-key"
  description = "Key with externally imported material"
  usage       = "symmetric_encryption"
  algorithm   = "aes_256_gcm"
  origin      = "external"
  region      = "fr-par"
}
resource "random_bytes" "key_material" {
  length = 32 # 256-bit key for AES-256
}
resource "scaleway_keymanager_keymaterial" "main" {
  key_id                  = scaleway_keymanager_key.main.id
  key_material_wo         = base64encode(random_bytes.key_material.base64)
  key_material_wo_version = 1
}

    import * as pulumi from "@pulumi/pulumi";
import * as random from "@pulumi/random";
import * as scaleway from "@pulumiverse/scaleway";
import * as std from "@pulumi/std";

const main = new scaleway.keymanager.Key("main", {
    name: "my-external-key",
    description: "Key with externally imported material and salt",
    usage: "symmetric_encryption",
    algorithm: "aes_256_gcm",
    origin: "external",
    region: "fr-par",
});
const keyMaterial = new random.index.Bytes("key_material", {length: 32});
const salt = new random.index.Bytes("salt", {length: 16});
const mainKeyMaterial = new scaleway.keymanager.KeyMaterial("main", {
    keyId: main.id,
    keyMaterialWo: std.base64encode({
        input: keyMaterial.base64,
    }).then(invoke => invoke.result),
    keyMaterialWoVersion: 1,
    saltWo: std.base64encode({
        input: salt.base64,
    }).then(invoke => invoke.result),
    saltWoVersion: 1,
});

    import pulumi
import pulumi_random as random
import pulumi_std as std
import pulumiverse_scaleway as scaleway

main = scaleway.keymanager.Key("main",
    name="my-external-key",
    description="Key with externally imported material and salt",
    usage="symmetric_encryption",
    algorithm="aes_256_gcm",
    origin="external",
    region="fr-par")
key_material = random.Bytes("key_material", length=32)
salt = random.Bytes("salt", length=16)
main_key_material = scaleway.keymanager.KeyMaterial("main",
    key_id=main.id,
    key_material_wo=std.base64encode(input=key_material["base64"]).result,
    key_material_wo_version=1,
    salt_wo=std.base64encode(input=salt["base64"]).result,
    salt_wo_version=1)

    package main

import (
	"github.com/pulumi/pulumi-random/sdk/v4/go/random"
	"github.com/pulumi/pulumi-std/sdk/go/std"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	"github.com/pulumiverse/pulumi-scaleway/sdk/go/scaleway/keymanager"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		main, err := keymanager.NewKey(ctx, "main", &keymanager.KeyArgs{
			Name:        pulumi.String("my-external-key"),
			Description: pulumi.String("Key with externally imported material and salt"),
			Usage:       pulumi.String("symmetric_encryption"),
			Algorithm:   pulumi.String("aes_256_gcm"),
			Origin:      pulumi.String("external"),
			Region:      pulumi.String("fr-par"),
		})
		if err != nil {
			return err
		}
		keyMaterial, err := random.NewBytes(ctx, "key_material", &random.BytesArgs{
			Length: 32,
		})
		if err != nil {
			return err
		}
		salt, err := random.NewBytes(ctx, "salt", &random.BytesArgs{
			Length: 16,
		})
		if err != nil {
			return err
		}
		invokeBase64encode, err := std.Base64encode(ctx, &std.Base64encodeArgs{
			Input: keyMaterial.Base64,
		}, nil)
		if err != nil {
			return err
		}
		invokeBase64encode1, err := std.Base64encode(ctx, &std.Base64encodeArgs{
			Input: salt.Base64,
		}, nil)
		if err != nil {
			return err
		}
		_, err = keymanager.NewKeyMaterial(ctx, "main", &keymanager.KeyMaterialArgs{
			KeyId:                main.ID().ToIDOutput().ToStringOutput(),
			KeyMaterialWo:        pulumi.String(invokeBase64encode.Result),
			KeyMaterialWoVersion: pulumi.Int(1),
			SaltWo:               pulumi.String(invokeBase64encode1.Result),
			SaltWoVersion:        pulumi.Int(1),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Random = Pulumi.Random;
using Scaleway = Pulumiverse.Scaleway;
using Std = Pulumi.Std;

return await Deployment.RunAsync(() => 
{
    var main = new Scaleway.Keymanager.Key("main", new()
    {
        Name = "my-external-key",
        Description = "Key with externally imported material and salt",
        Usage = "symmetric_encryption",
        Algorithm = "aes_256_gcm",
        Origin = "external",
        Region = "fr-par",
    });

    var keyMaterial = new Random.Bytes("key_material", new()
    {
        Length = 32,
    });

    var salt = new Random.Bytes("salt", new()
    {
        Length = 16,
    });

    var mainKeyMaterial = new Scaleway.Keymanager.KeyMaterial("main", new()
    {
        KeyId = main.Id,
        KeyMaterialWo = Std.Base64encode.Invoke(new()
        {
            Input = keyMaterial.Base64,
        }).Apply(invoke => invoke.Result),
        KeyMaterialWoVersion = 1,
        SaltWo = Std.Base64encode.Invoke(new()
        {
            Input = salt.Base64,
        }).Apply(invoke => invoke.Result),
        SaltWoVersion = 1,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.scaleway.keymanager.Key;
import com.pulumi.scaleway.keymanager.KeyArgs;
import com.pulumi.random.Bytes;
import com.pulumi.random.BytesArgs;
import com.pulumi.scaleway.keymanager.KeyMaterial;
import com.pulumi.scaleway.keymanager.KeyMaterialArgs;
import com.pulumi.std.StdFunctions;
import com.pulumi.std.inputs.Base64encodeArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var main = new Key("main", KeyArgs.builder()
            .name("my-external-key")
            .description("Key with externally imported material and salt")
            .usage("symmetric_encryption")
            .algorithm("aes_256_gcm")
            .origin("external")
            .region("fr-par")
            .build());

        var keyMaterial = new Bytes("keyMaterial", BytesArgs.builder()
            .length(32)
            .build());

        var salt = new Bytes("salt", BytesArgs.builder()
            .length(16)
            .build());

        var mainKeyMaterial = new KeyMaterial("mainKeyMaterial", KeyMaterialArgs.builder()
            .keyId(main.id())
            .keyMaterialWo(StdFunctions.base64encode(Base64encodeArgs.builder()
                .input(keyMaterial.base64())
                .build()).result())
            .keyMaterialWoVersion(1)
            .saltWo(StdFunctions.base64encode(Base64encodeArgs.builder()
                .input(salt.base64())
                .build()).result())
            .saltWoVersion(1)
            .build());

    }
}

    resources:
  main:
    type: scaleway:keymanager:Key
    properties:
      name: my-external-key
      description: Key with externally imported material and salt
      usage: symmetric_encryption
      algorithm: aes_256_gcm
      origin: external
      region: fr-par
  keyMaterial:
    type: random:Bytes
    name: key_material
    properties:
      length: 32 # 256-bit key for AES-256
  salt:
    type: random:Bytes
    properties:
      length: 16 # 128-bit salt
  mainKeyMaterial:
    type: scaleway:keymanager:KeyMaterial
    name: main
    properties:
      keyId: ${main.id}
      keyMaterialWo:
        fn::invoke:
          function: std:base64encode
          arguments:
            input: ${keyMaterial.base64}
          return: result
      keyMaterialWoVersion: 1
      saltWo:
        fn::invoke:
          function: std:base64encode
          arguments:
            input: ${salt.base64}
          return: result
      saltWoVersion: 1

    pulumi {
  required_providers {
    random = {
      source = "pulumi/random"
    }
    scaleway = {
      source = "pulumi/scaleway"
    }
    std = {
      source = "pulumi/std"
    }
  }
}

resource "scaleway_keymanager_key" "main" {
  name        = "my-external-key"
  description = "Key with externally imported material and salt"
  usage       = "symmetric_encryption"
  algorithm   = "aes_256_gcm"
  origin      = "external"
  region      = "fr-par"
}
resource "random_bytes" "key_material" {
  length = 32 # 256-bit key for AES-256
}
resource "random_bytes" "salt" {
  length = 16 # 128-bit salt
}
resource "scaleway_keymanager_keymaterial" "main" {
  key_id                  = scaleway_keymanager_key.main.id
  key_material_wo         = base64encode(random_bytes.key_material.base64)
  key_material_wo_version = 1
  salt_wo                 = base64encode(random_bytes.salt.base64)
  salt_wo_version         = 1
}

    Create KeyMaterial Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new KeyMaterial(name: string, args: KeyMaterialArgs, opts?: CustomResourceOptions);
    @overload
def KeyMaterial(resource_name: str,
                args: KeyMaterialArgs,
                opts: Optional[ResourceOptions] = None)

@overload
def KeyMaterial(resource_name: str,
                opts: Optional[ResourceOptions] = None,
                key_id: Optional[str] = None,
                key_material: Optional[str] = None,
                key_material_wo: Optional[str] = None,
                key_material_wo_version: Optional[int] = None,
                region: Optional[str] = None,
                salt: Optional[str] = None,
                salt_wo: Optional[str] = None,
                salt_wo_version: Optional[int] = None)
    func NewKeyMaterial(ctx *Context, name string, args KeyMaterialArgs, opts ...ResourceOption) (*KeyMaterial, error)
    public KeyMaterial(string name, KeyMaterialArgs args, CustomResourceOptions? opts = null)
    public KeyMaterial(String name, KeyMaterialArgs args)
public KeyMaterial(String name, KeyMaterialArgs args, CustomResourceOptions options)

    type: scaleway:keymanager:KeyMaterial
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "scaleway_keymanager_key_material" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args KeyMaterialArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args KeyMaterialArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args KeyMaterialArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args KeyMaterialArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args KeyMaterialArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var keyMaterialResource = new Scaleway.Keymanager.KeyMaterial("keyMaterialResource", new()
{
    KeyId = "string",
    KeyMaterialRw = "string",
    KeyMaterialWo = "string",
    KeyMaterialWoVersion = 0,
    Region = "string",
    SaltRw = "string",
    SaltWo = "string",
    SaltWoVersion = 0,
});

    example, err := keymanager.NewKeyMaterial(ctx, "keyMaterialResource", &keymanager.KeyMaterialArgs{
	KeyId:                pulumi.String("string"),
	KeyMaterial:          pulumi.String("string"),
	KeyMaterialWo:        pulumi.String("string"),
	KeyMaterialWoVersion: pulumi.Int(0),
	Region:               pulumi.String("string"),
	Salt:                 pulumi.String("string"),
	SaltWo:               pulumi.String("string"),
	SaltWoVersion:        pulumi.Int(0),
})

    resource "scaleway_keymanager_key_material" "keyMaterialResource" {
  lifecycle {
    create_before_destroy = true
  }
  key_id                  = "string"
  key_material            = "string"
  key_material_wo         = "string"
  key_material_wo_version = 0
  region                  = "string"
  salt                    = "string"
  salt_wo                 = "string"
  salt_wo_version         = 0
}

    var keyMaterialResource = new KeyMaterial("keyMaterialResource", KeyMaterialArgs.builder()
    .keyId("string")
    .keyMaterial("string")
    .keyMaterialWo("string")
    .keyMaterialWoVersion(0)
    .region("string")
    .salt("string")
    .saltWo("string")
    .saltWoVersion(0)
    .build());

    key_material_resource = scaleway.keymanager.KeyMaterial("keyMaterialResource",
    key_id="string",
    key_material="string",
    key_material_wo="string",
    key_material_wo_version=0,
    region="string",
    salt="string",
    salt_wo="string",
    salt_wo_version=0)

    const keyMaterialResource = new scaleway.keymanager.KeyMaterial("keyMaterialResource", {
    keyId: "string",
    keyMaterial: "string",
    keyMaterialWo: "string",
    keyMaterialWoVersion: 0,
    region: "string",
    salt: "string",
    saltWo: "string",
    saltWoVersion: 0,
});

    type: scaleway:keymanager:KeyMaterial
properties:
    keyId: string
    keyMaterial: string
    keyMaterialWo: string
    keyMaterialWoVersion: 0
    region: string
    salt: string
    saltWo: string
    saltWoVersion: 0

    KeyMaterial Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The KeyMaterial resource accepts the following input properties:

    KeyId string
    The ID of the key to import key material into. The key's origin must be external (UUID format). Can be a plain UUID or a regional ID.
    KeyMaterialRw string
    The key material to import. The key material is a random sequence of bytes used to derive a cryptographic key. Can be provided as raw bytes or a base64-encoded string (the provider will automatically normalize the input).
    KeyMaterialWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The key material to import in write-only mode. The key material is a random sequence of bytes used to derive a cryptographic key. Must be provided as a base64-encoded string. The key material will not be stored in the Terraform state. Either keyMaterial or keyMaterialWo must be specified.
    KeyMaterialWoVersion int
    Version number to track changes to the write-only key material. Increment this value to recreate the resource with new key material. Required when using keyMaterialWo.
    Region string
    region) The region of the key. If not set, the region is derived from the keyId when possible or from the provider configuration.
    SaltRw string
    Optional salt for key derivation. A salt is random data added to key material to ensure unique derived keys, even if the input is similar. It helps strengthen security when the key material has low randomness (low entropy). Can be provided as raw bytes or a base64-encoded string (the provider will automatically normalize the input). Only one of salt or saltWo can be specified.
    SaltWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Optional salt for key derivation in write-only mode. A salt is random data added to key material to ensure unique derived keys. Must be provided as a base64-encoded string. The salt will not be stored in the Terraform state. Only one of salt or saltWo can be specified.
    SaltWoVersion int
    Version number to track changes to the write-only salt. Increment this value to recreate the resource with new salt. Required when using saltWo.
    KeyId string
    The ID of the key to import key material into. The key's origin must be external (UUID format). Can be a plain UUID or a regional ID.
    KeyMaterial string
    The key material to import. The key material is a random sequence of bytes used to derive a cryptographic key. Can be provided as raw bytes or a base64-encoded string (the provider will automatically normalize the input).
    KeyMaterialWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The key material to import in write-only mode. The key material is a random sequence of bytes used to derive a cryptographic key. Must be provided as a base64-encoded string. The key material will not be stored in the Terraform state. Either keyMaterial or keyMaterialWo must be specified.
    KeyMaterialWoVersion int
    Version number to track changes to the write-only key material. Increment this value to recreate the resource with new key material. Required when using keyMaterialWo.
    Region string
    region) The region of the key. If not set, the region is derived from the keyId when possible or from the provider configuration.
    Salt string
    Optional salt for key derivation. A salt is random data added to key material to ensure unique derived keys, even if the input is similar. It helps strengthen security when the key material has low randomness (low entropy). Can be provided as raw bytes or a base64-encoded string (the provider will automatically normalize the input). Only one of salt or saltWo can be specified.
    SaltWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Optional salt for key derivation in write-only mode. A salt is random data added to key material to ensure unique derived keys. Must be provided as a base64-encoded string. The salt will not be stored in the Terraform state. Only one of salt or saltWo can be specified.
    SaltWoVersion int
    Version number to track changes to the write-only salt. Increment this value to recreate the resource with new salt. Required when using saltWo.
    key_id string
    The ID of the key to import key material into. The key's origin must be external (UUID format). Can be a plain UUID or a regional ID.
    key_material string
    The key material to import. The key material is a random sequence of bytes used to derive a cryptographic key. Can be provided as raw bytes or a base64-encoded string (the provider will automatically normalize the input).
    key_material_wo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The key material to import in write-only mode. The key material is a random sequence of bytes used to derive a cryptographic key. Must be provided as a base64-encoded string. The key material will not be stored in the Terraform state. Either keyMaterial or keyMaterialWo must be specified.
    key_material_wo_version number
    Version number to track changes to the write-only key material. Increment this value to recreate the resource with new key material. Required when using keyMaterialWo.
    region string
    region) The region of the key. If not set, the region is derived from the keyId when possible or from the provider configuration.
    salt string
    Optional salt for key derivation. A salt is random data added to key material to ensure unique derived keys, even if the input is similar. It helps strengthen security when the key material has low randomness (low entropy). Can be provided as raw bytes or a base64-encoded string (the provider will automatically normalize the input). Only one of salt or saltWo can be specified.
    salt_wo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Optional salt for key derivation in write-only mode. A salt is random data added to key material to ensure unique derived keys. Must be provided as a base64-encoded string. The salt will not be stored in the Terraform state. Only one of salt or saltWo can be specified.
    salt_wo_version number
    Version number to track changes to the write-only salt. Increment this value to recreate the resource with new salt. Required when using saltWo.
    keyId String
    The ID of the key to import key material into. The key's origin must be external (UUID format). Can be a plain UUID or a regional ID.
    keyMaterial String
    The key material to import. The key material is a random sequence of bytes used to derive a cryptographic key. Can be provided as raw bytes or a base64-encoded string (the provider will automatically normalize the input).
    keyMaterialWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The key material to import in write-only mode. The key material is a random sequence of bytes used to derive a cryptographic key. Must be provided as a base64-encoded string. The key material will not be stored in the Terraform state. Either keyMaterial or keyMaterialWo must be specified.
    keyMaterialWoVersion Integer
    Version number to track changes to the write-only key material. Increment this value to recreate the resource with new key material. Required when using keyMaterialWo.
    region String
    region) The region of the key. If not set, the region is derived from the keyId when possible or from the provider configuration.
    salt String
    Optional salt for key derivation. A salt is random data added to key material to ensure unique derived keys, even if the input is similar. It helps strengthen security when the key material has low randomness (low entropy). Can be provided as raw bytes or a base64-encoded string (the provider will automatically normalize the input). Only one of salt or saltWo can be specified.
    saltWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Optional salt for key derivation in write-only mode. A salt is random data added to key material to ensure unique derived keys. Must be provided as a base64-encoded string. The salt will not be stored in the Terraform state. Only one of salt or saltWo can be specified.
    saltWoVersion Integer
    Version number to track changes to the write-only salt. Increment this value to recreate the resource with new salt. Required when using saltWo.
    keyId string
    The ID of the key to import key material into. The key's origin must be external (UUID format). Can be a plain UUID or a regional ID.
    keyMaterial string
    The key material to import. The key material is a random sequence of bytes used to derive a cryptographic key. Can be provided as raw bytes or a base64-encoded string (the provider will automatically normalize the input).
    keyMaterialWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The key material to import in write-only mode. The key material is a random sequence of bytes used to derive a cryptographic key. Must be provided as a base64-encoded string. The key material will not be stored in the Terraform state. Either keyMaterial or keyMaterialWo must be specified.
    keyMaterialWoVersion number
    Version number to track changes to the write-only key material. Increment this value to recreate the resource with new key material. Required when using keyMaterialWo.
    region string
    region) The region of the key. If not set, the region is derived from the keyId when possible or from the provider configuration.
    salt string
    Optional salt for key derivation. A salt is random data added to key material to ensure unique derived keys, even if the input is similar. It helps strengthen security when the key material has low randomness (low entropy). Can be provided as raw bytes or a base64-encoded string (the provider will automatically normalize the input). Only one of salt or saltWo can be specified.
    saltWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Optional salt for key derivation in write-only mode. A salt is random data added to key material to ensure unique derived keys. Must be provided as a base64-encoded string. The salt will not be stored in the Terraform state. Only one of salt or saltWo can be specified.
    saltWoVersion number
    Version number to track changes to the write-only salt. Increment this value to recreate the resource with new salt. Required when using saltWo.
    key_id str
    The ID of the key to import key material into. The key's origin must be external (UUID format). Can be a plain UUID or a regional ID.
    key_material str
    The key material to import. The key material is a random sequence of bytes used to derive a cryptographic key. Can be provided as raw bytes or a base64-encoded string (the provider will automatically normalize the input).
    key_material_wo str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The key material to import in write-only mode. The key material is a random sequence of bytes used to derive a cryptographic key. Must be provided as a base64-encoded string. The key material will not be stored in the Terraform state. Either keyMaterial or keyMaterialWo must be specified.
    key_material_wo_version int
    Version number to track changes to the write-only key material. Increment this value to recreate the resource with new key material. Required when using keyMaterialWo.
    region str
    region) The region of the key. If not set, the region is derived from the keyId when possible or from the provider configuration.
    salt str
    Optional salt for key derivation. A salt is random data added to key material to ensure unique derived keys, even if the input is similar. It helps strengthen security when the key material has low randomness (low entropy). Can be provided as raw bytes or a base64-encoded string (the provider will automatically normalize the input). Only one of salt or saltWo can be specified.
    salt_wo str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Optional salt for key derivation in write-only mode. A salt is random data added to key material to ensure unique derived keys. Must be provided as a base64-encoded string. The salt will not be stored in the Terraform state. Only one of salt or saltWo can be specified.
    salt_wo_version int
    Version number to track changes to the write-only salt. Increment this value to recreate the resource with new salt. Required when using saltWo.
    keyId String
    The ID of the key to import key material into. The key's origin must be external (UUID format). Can be a plain UUID or a regional ID.
    keyMaterial String
    The key material to import. The key material is a random sequence of bytes used to derive a cryptographic key. Can be provided as raw bytes or a base64-encoded string (the provider will automatically normalize the input).
    keyMaterialWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The key material to import in write-only mode. The key material is a random sequence of bytes used to derive a cryptographic key. Must be provided as a base64-encoded string. The key material will not be stored in the Terraform state. Either keyMaterial or keyMaterialWo must be specified.
    keyMaterialWoVersion Number
    Version number to track changes to the write-only key material. Increment this value to recreate the resource with new key material. Required when using keyMaterialWo.
    region String
    region) The region of the key. If not set, the region is derived from the keyId when possible or from the provider configuration.
    salt String
    Optional salt for key derivation. A salt is random data added to key material to ensure unique derived keys, even if the input is similar. It helps strengthen security when the key material has low randomness (low entropy). Can be provided as raw bytes or a base64-encoded string (the provider will automatically normalize the input). Only one of salt or saltWo can be specified.
    saltWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Optional salt for key derivation in write-only mode. A salt is random data added to key material to ensure unique derived keys. Must be provided as a base64-encoded string. The salt will not be stored in the Terraform state. Only one of salt or saltWo can be specified.
    saltWoVersion Number
    Version number to track changes to the write-only salt. Increment this value to recreate the resource with new salt. Required when using saltWo.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the KeyMaterial resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    KeyState string
    The current state of the key (enabled, disabled, pending_key_material).
    Origin string
    The origin of the key (should be 'external').
    Id string
    The provider-assigned unique ID for this managed resource.
    KeyState string
    The current state of the key (enabled, disabled, pending_key_material).
    Origin string
    The origin of the key (should be 'external').
    id string
    The provider-assigned unique ID for this managed resource.
    key_state string
    The current state of the key (enabled, disabled, pending_key_material).
    origin string
    The origin of the key (should be 'external').
    id String
    The provider-assigned unique ID for this managed resource.
    keyState String
    The current state of the key (enabled, disabled, pending_key_material).
    origin String
    The origin of the key (should be 'external').
    id string
    The provider-assigned unique ID for this managed resource.
    keyState string
    The current state of the key (enabled, disabled, pending_key_material).
    origin string
    The origin of the key (should be 'external').
    id str
    The provider-assigned unique ID for this managed resource.
    key_state str
    The current state of the key (enabled, disabled, pending_key_material).
    origin str
    The origin of the key (should be 'external').
    id String
    The provider-assigned unique ID for this managed resource.
    keyState String
    The current state of the key (enabled, disabled, pending_key_material).
    origin String
    The origin of the key (should be 'external').

    Look up Existing KeyMaterial Resource

    Get an existing KeyMaterial resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: KeyMaterialState, opts?: CustomResourceOptions): KeyMaterial
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        key_id: Optional[str] = None,
        key_material: Optional[str] = None,
        key_material_wo: Optional[str] = None,
        key_material_wo_version: Optional[int] = None,
        key_state: Optional[str] = None,
        origin: Optional[str] = None,
        region: Optional[str] = None,
        salt: Optional[str] = None,
        salt_wo: Optional[str] = None,
        salt_wo_version: Optional[int] = None) -> KeyMaterial
    func GetKeyMaterial(ctx *Context, name string, id IDInput, state *KeyMaterialState, opts ...ResourceOption) (*KeyMaterial, error)
    public static KeyMaterial Get(string name, Input<string> id, KeyMaterialState? state, CustomResourceOptions? opts = null)
    public static KeyMaterial get(String name, Output<String> id, KeyMaterialState state, CustomResourceOptions options)
    resources:  _:    type: scaleway:keymanager:KeyMaterial    get:      id: ${id}
    import {
  to = scaleway_keymanager_key_material.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    KeyId string
    The ID of the key to import key material into. The key's origin must be external (UUID format). Can be a plain UUID or a regional ID.
    KeyMaterialRw string
    The key material to import. The key material is a random sequence of bytes used to derive a cryptographic key. Can be provided as raw bytes or a base64-encoded string (the provider will automatically normalize the input).
    KeyMaterialWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The key material to import in write-only mode. The key material is a random sequence of bytes used to derive a cryptographic key. Must be provided as a base64-encoded string. The key material will not be stored in the Terraform state. Either keyMaterial or keyMaterialWo must be specified.
    KeyMaterialWoVersion int
    Version number to track changes to the write-only key material. Increment this value to recreate the resource with new key material. Required when using keyMaterialWo.
    KeyState string
    The current state of the key (enabled, disabled, pending_key_material).
    Origin string
    The origin of the key (should be 'external').
    Region string
    region) The region of the key. If not set, the region is derived from the keyId when possible or from the provider configuration.
    SaltRw string
    Optional salt for key derivation. A salt is random data added to key material to ensure unique derived keys, even if the input is similar. It helps strengthen security when the key material has low randomness (low entropy). Can be provided as raw bytes or a base64-encoded string (the provider will automatically normalize the input). Only one of salt or saltWo can be specified.
    SaltWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Optional salt for key derivation in write-only mode. A salt is random data added to key material to ensure unique derived keys. Must be provided as a base64-encoded string. The salt will not be stored in the Terraform state. Only one of salt or saltWo can be specified.
    SaltWoVersion int
    Version number to track changes to the write-only salt. Increment this value to recreate the resource with new salt. Required when using saltWo.
    KeyId string
    The ID of the key to import key material into. The key's origin must be external (UUID format). Can be a plain UUID or a regional ID.
    KeyMaterial string
    The key material to import. The key material is a random sequence of bytes used to derive a cryptographic key. Can be provided as raw bytes or a base64-encoded string (the provider will automatically normalize the input).
    KeyMaterialWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The key material to import in write-only mode. The key material is a random sequence of bytes used to derive a cryptographic key. Must be provided as a base64-encoded string. The key material will not be stored in the Terraform state. Either keyMaterial or keyMaterialWo must be specified.
    KeyMaterialWoVersion int
    Version number to track changes to the write-only key material. Increment this value to recreate the resource with new key material. Required when using keyMaterialWo.
    KeyState string
    The current state of the key (enabled, disabled, pending_key_material).
    Origin string
    The origin of the key (should be 'external').
    Region string
    region) The region of the key. If not set, the region is derived from the keyId when possible or from the provider configuration.
    Salt string
    Optional salt for key derivation. A salt is random data added to key material to ensure unique derived keys, even if the input is similar. It helps strengthen security when the key material has low randomness (low entropy). Can be provided as raw bytes or a base64-encoded string (the provider will automatically normalize the input). Only one of salt or saltWo can be specified.
    SaltWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Optional salt for key derivation in write-only mode. A salt is random data added to key material to ensure unique derived keys. Must be provided as a base64-encoded string. The salt will not be stored in the Terraform state. Only one of salt or saltWo can be specified.
    SaltWoVersion int
    Version number to track changes to the write-only salt. Increment this value to recreate the resource with new salt. Required when using saltWo.
    key_id string
    The ID of the key to import key material into. The key's origin must be external (UUID format). Can be a plain UUID or a regional ID.
    key_material string
    The key material to import. The key material is a random sequence of bytes used to derive a cryptographic key. Can be provided as raw bytes or a base64-encoded string (the provider will automatically normalize the input).
    key_material_wo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The key material to import in write-only mode. The key material is a random sequence of bytes used to derive a cryptographic key. Must be provided as a base64-encoded string. The key material will not be stored in the Terraform state. Either keyMaterial or keyMaterialWo must be specified.
    key_material_wo_version number
    Version number to track changes to the write-only key material. Increment this value to recreate the resource with new key material. Required when using keyMaterialWo.
    key_state string
    The current state of the key (enabled, disabled, pending_key_material).
    origin string
    The origin of the key (should be 'external').
    region string
    region) The region of the key. If not set, the region is derived from the keyId when possible or from the provider configuration.
    salt string
    Optional salt for key derivation. A salt is random data added to key material to ensure unique derived keys, even if the input is similar. It helps strengthen security when the key material has low randomness (low entropy). Can be provided as raw bytes or a base64-encoded string (the provider will automatically normalize the input). Only one of salt or saltWo can be specified.
    salt_wo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Optional salt for key derivation in write-only mode. A salt is random data added to key material to ensure unique derived keys. Must be provided as a base64-encoded string. The salt will not be stored in the Terraform state. Only one of salt or saltWo can be specified.
    salt_wo_version number
    Version number to track changes to the write-only salt. Increment this value to recreate the resource with new salt. Required when using saltWo.
    keyId String
    The ID of the key to import key material into. The key's origin must be external (UUID format). Can be a plain UUID or a regional ID.
    keyMaterial String
    The key material to import. The key material is a random sequence of bytes used to derive a cryptographic key. Can be provided as raw bytes or a base64-encoded string (the provider will automatically normalize the input).
    keyMaterialWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The key material to import in write-only mode. The key material is a random sequence of bytes used to derive a cryptographic key. Must be provided as a base64-encoded string. The key material will not be stored in the Terraform state. Either keyMaterial or keyMaterialWo must be specified.
    keyMaterialWoVersion Integer
    Version number to track changes to the write-only key material. Increment this value to recreate the resource with new key material. Required when using keyMaterialWo.
    keyState String
    The current state of the key (enabled, disabled, pending_key_material).
    origin String
    The origin of the key (should be 'external').
    region String
    region) The region of the key. If not set, the region is derived from the keyId when possible or from the provider configuration.
    salt String
    Optional salt for key derivation. A salt is random data added to key material to ensure unique derived keys, even if the input is similar. It helps strengthen security when the key material has low randomness (low entropy). Can be provided as raw bytes or a base64-encoded string (the provider will automatically normalize the input). Only one of salt or saltWo can be specified.
    saltWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Optional salt for key derivation in write-only mode. A salt is random data added to key material to ensure unique derived keys. Must be provided as a base64-encoded string. The salt will not be stored in the Terraform state. Only one of salt or saltWo can be specified.
    saltWoVersion Integer
    Version number to track changes to the write-only salt. Increment this value to recreate the resource with new salt. Required when using saltWo.
    keyId string
    The ID of the key to import key material into. The key's origin must be external (UUID format). Can be a plain UUID or a regional ID.
    keyMaterial string
    The key material to import. The key material is a random sequence of bytes used to derive a cryptographic key. Can be provided as raw bytes or a base64-encoded string (the provider will automatically normalize the input).
    keyMaterialWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The key material to import in write-only mode. The key material is a random sequence of bytes used to derive a cryptographic key. Must be provided as a base64-encoded string. The key material will not be stored in the Terraform state. Either keyMaterial or keyMaterialWo must be specified.
    keyMaterialWoVersion number
    Version number to track changes to the write-only key material. Increment this value to recreate the resource with new key material. Required when using keyMaterialWo.
    keyState string
    The current state of the key (enabled, disabled, pending_key_material).
    origin string
    The origin of the key (should be 'external').
    region string
    region) The region of the key. If not set, the region is derived from the keyId when possible or from the provider configuration.
    salt string
    Optional salt for key derivation. A salt is random data added to key material to ensure unique derived keys, even if the input is similar. It helps strengthen security when the key material has low randomness (low entropy). Can be provided as raw bytes or a base64-encoded string (the provider will automatically normalize the input). Only one of salt or saltWo can be specified.
    saltWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Optional salt for key derivation in write-only mode. A salt is random data added to key material to ensure unique derived keys. Must be provided as a base64-encoded string. The salt will not be stored in the Terraform state. Only one of salt or saltWo can be specified.
    saltWoVersion number
    Version number to track changes to the write-only salt. Increment this value to recreate the resource with new salt. Required when using saltWo.
    key_id str
    The ID of the key to import key material into. The key's origin must be external (UUID format). Can be a plain UUID or a regional ID.
    key_material str
    The key material to import. The key material is a random sequence of bytes used to derive a cryptographic key. Can be provided as raw bytes or a base64-encoded string (the provider will automatically normalize the input).
    key_material_wo str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The key material to import in write-only mode. The key material is a random sequence of bytes used to derive a cryptographic key. Must be provided as a base64-encoded string. The key material will not be stored in the Terraform state. Either keyMaterial or keyMaterialWo must be specified.
    key_material_wo_version int
    Version number to track changes to the write-only key material. Increment this value to recreate the resource with new key material. Required when using keyMaterialWo.
    key_state str
    The current state of the key (enabled, disabled, pending_key_material).
    origin str
    The origin of the key (should be 'external').
    region str
    region) The region of the key. If not set, the region is derived from the keyId when possible or from the provider configuration.
    salt str
    Optional salt for key derivation. A salt is random data added to key material to ensure unique derived keys, even if the input is similar. It helps strengthen security when the key material has low randomness (low entropy). Can be provided as raw bytes or a base64-encoded string (the provider will automatically normalize the input). Only one of salt or saltWo can be specified.
    salt_wo str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Optional salt for key derivation in write-only mode. A salt is random data added to key material to ensure unique derived keys. Must be provided as a base64-encoded string. The salt will not be stored in the Terraform state. Only one of salt or saltWo can be specified.
    salt_wo_version int
    Version number to track changes to the write-only salt. Increment this value to recreate the resource with new salt. Required when using saltWo.
    keyId String
    The ID of the key to import key material into. The key's origin must be external (UUID format). Can be a plain UUID or a regional ID.
    keyMaterial String
    The key material to import. The key material is a random sequence of bytes used to derive a cryptographic key. Can be provided as raw bytes or a base64-encoded string (the provider will automatically normalize the input).
    keyMaterialWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The key material to import in write-only mode. The key material is a random sequence of bytes used to derive a cryptographic key. Must be provided as a base64-encoded string. The key material will not be stored in the Terraform state. Either keyMaterial or keyMaterialWo must be specified.
    keyMaterialWoVersion Number
    Version number to track changes to the write-only key material. Increment this value to recreate the resource with new key material. Required when using keyMaterialWo.
    keyState String
    The current state of the key (enabled, disabled, pending_key_material).
    origin String
    The origin of the key (should be 'external').
    region String
    region) The region of the key. If not set, the region is derived from the keyId when possible or from the provider configuration.
    salt String
    Optional salt for key derivation. A salt is random data added to key material to ensure unique derived keys, even if the input is similar. It helps strengthen security when the key material has low randomness (low entropy). Can be provided as raw bytes or a base64-encoded string (the provider will automatically normalize the input). Only one of salt or saltWo can be specified.
    saltWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Optional salt for key derivation in write-only mode. A salt is random data added to key material to ensure unique derived keys. Must be provided as a base64-encoded string. The salt will not be stored in the Terraform state. Only one of salt or saltWo can be specified.
    saltWoVersion Number
    Version number to track changes to the write-only salt. Increment this value to recreate the resource with new salt. Required when using saltWo.

    Package Details

    Repository
    scaleway pulumiverse/pulumi-scaleway
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the scaleway Terraform Provider.
    scaleway logo
    Viewing docs for Scaleway v1.55.1
    published on Wednesday, Sep 9, 2026 by pulumiverse
    Schema (JSON)
    pulumiverse/pulumi-scaleway

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial