Sign in Dashboard Get started
  1. Packages
  2. Packages
  3. HashiCorp Vault Provider
  4. API Docs
  5. keymgmt
  6. AwsKms
Viewing docs for HashiCorp Vault v7.11.0
published on Wednesday, Jul 22, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

vault.keymgmt.AwsKms

vault logo vault logo
Viewing docs for HashiCorp Vault v7.11.0
published on Wednesday, Jul 22, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

    Manages an AWS KMS provider in the Vault Key Management secrets engine. This resource configures Vault to integrate with AWS Key Management Service, allowing keys created in Vault to be distributed to AWS KMS for use in AWS services.

    Once configured, keys can be distributed to AWS KMS using the vault.keymgmt.DistributeKey resource.

    Important This resource requires Terraform 1.11+ for write-only attribute support. The credentialsWo field is write-only and will never be stored in Terraform state. See the main provider documentation for more details.

    For more information on managing AWS KMS with Vault, please refer to the Vault documentation.

    Note this feature is available only with Vault Enterprise.

    Example Usage

    Basic Configuration

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const keymgmt = new vault.Mount("keymgmt", {
    path: "keymgmt",
    type: "keymgmt",
});
const usWest = new vault.keymgmt.AwsKms("us_west", {
    mount: keymgmt.path,
    name: "aws-us-west-2",
    keyCollection: "us-west-2",
    credentialsWo: {
        access_key: awsAccessKeyId,
        secret_key: awsSecretAccessKey,
    },
    credentialsWoVersion: 1,
});

    import pulumi
import pulumi_vault as vault

keymgmt = vault.Mount("keymgmt",
    path="keymgmt",
    type="keymgmt")
us_west = vault.keymgmt.AwsKms("us_west",
    mount=keymgmt.path,
    name="aws-us-west-2",
    key_collection="us-west-2",
    credentials_wo={
        "access_key": aws_access_key_id,
        "secret_key": aws_secret_access_key,
    },
    credentials_wo_version=1)

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/keymgmt"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		keymgmt2, err := vault.NewMount(ctx, "keymgmt", &vault.MountArgs{
			Path: pulumi.String("keymgmt"),
			Type: pulumi.String("keymgmt"),
		})
		if err != nil {
			return err
		}
		_, err = keymgmt.NewAwsKms(ctx, "us_west", &keymgmt.AwsKmsArgs{
			Mount:         keymgmt2.Path,
			Name:          pulumi.String("aws-us-west-2"),
			KeyCollection: pulumi.String("us-west-2"),
			CredentialsWo: pulumi.StringMap{
				"access_key": pulumi.Any(awsAccessKeyId),
				"secret_key": pulumi.Any(awsSecretAccessKey),
			},
			CredentialsWoVersion: pulumi.Int(1),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var keymgmt = new Vault.Mount("keymgmt", new()
    {
        Path = "keymgmt",
        Type = "keymgmt",
    });

    var usWest = new Vault.KeyMgmt.AwsKms("us_west", new()
    {
        Mount = keymgmt.Path,
        Name = "aws-us-west-2",
        KeyCollection = "us-west-2",
        CredentialsWo = 
        {
            { "access_key", awsAccessKeyId },
            { "secret_key", awsSecretAccessKey },
        },
        CredentialsWoVersion = 1,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Mount;
import com.pulumi.vault.MountArgs;
import com.pulumi.vault.keymgmt.AwsKms;
import com.pulumi.vault.keymgmt.AwsKmsArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var keymgmt = new Mount("keymgmt", MountArgs.builder()
            .path("keymgmt")
            .type("keymgmt")
            .build());

        var usWest = new AwsKms("usWest", AwsKmsArgs.builder()
            .mount(keymgmt.path())
            .name("aws-us-west-2")
            .keyCollection("us-west-2")
            .credentialsWo(Map.ofEntries(
                Map.entry("access_key", awsAccessKeyId),
                Map.entry("secret_key", awsSecretAccessKey)
            ))
            .credentialsWoVersion(1)
            .build());

    }
}

    resources:
  keymgmt:
    type: vault:Mount
    properties:
      path: keymgmt
      type: keymgmt
  usWest:
    type: vault:keymgmt:AwsKms
    name: us_west
    properties:
      mount: ${keymgmt.path}
      name: aws-us-west-2
      keyCollection: us-west-2
      credentialsWo:
        access_key: ${awsAccessKeyId}
        secret_key: ${awsSecretAccessKey}
      credentialsWoVersion: 1

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_mount" "keymgmt" {
  path = "keymgmt"
  type = "keymgmt"
}
resource "vault_keymgmt_awskms" "us_west" {
  mount          = vault_mount.keymgmt.path
  name           = "aws-us-west-2"
  key_collection = "us-west-2"
  credentials_wo = {
    "access_key" = awsAccessKeyId
    "secret_key" = awsSecretAccessKey
  }
  credentials_wo_version = 1
}

    Using AWS Environment Variables or IAM Roles

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

// When credentials are not provided, Vault will use AWS SDK's credential chain:
// 1. Environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN)
// 2. Shared credentials file (~/.aws/credentials)
// 3. IAM instance profile (when running on EC2)
// 4. ECS task credentials (when running on ECS)
const production = new vault.keymgmt.AwsKms("production", {
    mount: keymgmt.path,
    name: "aws-production",
    keyCollection: "us-east-1",
});
// Distribute a key to AWS KMS
const encryptionKey = new vault.keymgmt.Key("encryption_key", {
    mount: keymgmt.path,
    name: "aws-encryption-key",
    type: "aes256-gcm96",
});
const awsDist = new vault.keymgmt.DistributeKey("aws_dist", {
    path: keymgmt.path,
    kmsName: production.name,
    keyName: encryptionKey.name,
    purposes: [
        "encrypt",
        "decrypt",
    ],
});

    import pulumi
import pulumi_vault as vault

# When credentials are not provided, Vault will use AWS SDK's credential chain:
# 1. Environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN)
# 2. Shared credentials file (~/.aws/credentials)
# 3. IAM instance profile (when running on EC2)
# 4. ECS task credentials (when running on ECS)
production = vault.keymgmt.AwsKms("production",
    mount=keymgmt["path"],
    name="aws-production",
    key_collection="us-east-1")
# Distribute a key to AWS KMS
encryption_key = vault.keymgmt.Key("encryption_key",
    mount=keymgmt["path"],
    name="aws-encryption-key",
    type="aes256-gcm96")
aws_dist = vault.keymgmt.DistributeKey("aws_dist",
    path=keymgmt["path"],
    kms_name=production.name,
    key_name=encryption_key.name,
    purposes=[
        "encrypt",
        "decrypt",
    ])

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/keymgmt"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		// When credentials are not provided, Vault will use AWS SDK's credential chain:
		// 1. Environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN)
		// 2. Shared credentials file (~/.aws/credentials)
		// 3. IAM instance profile (when running on EC2)
		// 4. ECS task credentials (when running on ECS)
		production, err := keymgmt.NewAwsKms(ctx, "production", &keymgmt.AwsKmsArgs{
			Mount:         pulumi.Any(keymgmt.Path),
			Name:          pulumi.String("aws-production"),
			KeyCollection: pulumi.String("us-east-1"),
		})
		if err != nil {
			return err
		}
		// Distribute a key to AWS KMS
		encryptionKey, err := keymgmt.NewKey(ctx, "encryption_key", &keymgmt.KeyArgs{
			Mount: pulumi.Any(keymgmt.Path),
			Name:  pulumi.String("aws-encryption-key"),
			Type:  pulumi.String("aes256-gcm96"),
		})
		if err != nil {
			return err
		}
		_, err = keymgmt.NewDistributeKey(ctx, "aws_dist", &keymgmt.DistributeKeyArgs{
			Path:    keymgmt.Path,
			KmsName: production.Name,
			KeyName: encryptionKey.Name,
			Purposes: pulumi.StringArray{
				pulumi.String("encrypt"),
				pulumi.String("decrypt"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    // When credentials are not provided, Vault will use AWS SDK's credential chain:
    // 1. Environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN)
    // 2. Shared credentials file (~/.aws/credentials)
    // 3. IAM instance profile (when running on EC2)
    // 4. ECS task credentials (when running on ECS)
    var production = new Vault.KeyMgmt.AwsKms("production", new()
    {
        Mount = keymgmt.Path,
        Name = "aws-production",
        KeyCollection = "us-east-1",
    });

    // Distribute a key to AWS KMS
    var encryptionKey = new Vault.KeyMgmt.Key("encryption_key", new()
    {
        Mount = keymgmt.Path,
        Name = "aws-encryption-key",
        Type = "aes256-gcm96",
    });

    var awsDist = new Vault.KeyMgmt.DistributeKey("aws_dist", new()
    {
        Path = keymgmt.Path,
        KmsName = production.Name,
        KeyName = encryptionKey.Name,
        Purposes = new[]
        {
            "encrypt",
            "decrypt",
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.keymgmt.AwsKms;
import com.pulumi.vault.keymgmt.AwsKmsArgs;
import com.pulumi.vault.keymgmt.Key;
import com.pulumi.vault.keymgmt.KeyArgs;
import com.pulumi.vault.keymgmt.DistributeKey;
import com.pulumi.vault.keymgmt.DistributeKeyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        // When credentials are not provided, Vault will use AWS SDK's credential chain:
        // 1. Environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN)
        // 2. Shared credentials file (~/.aws/credentials)
        // 3. IAM instance profile (when running on EC2)
        // 4. ECS task credentials (when running on ECS)
        var production = new AwsKms("production", AwsKmsArgs.builder()
            .mount(keymgmt.path())
            .name("aws-production")
            .keyCollection("us-east-1")
            .build());

        // Distribute a key to AWS KMS
        var encryptionKey = new Key("encryptionKey", KeyArgs.builder()
            .mount(keymgmt.path())
            .name("aws-encryption-key")
            .type("aes256-gcm96")
            .build());

        var awsDist = new DistributeKey("awsDist", DistributeKeyArgs.builder()
            .path(keymgmt.path())
            .kmsName(production.name())
            .keyName(encryptionKey.name())
            .purposes(            
                "encrypt",
                "decrypt")
            .build());

    }
}

    resources:
  # When credentials are not provided, Vault will use AWS SDK's credential chain:
  # 1. Environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN)
  # 2. Shared credentials file (~/.aws/credentials)
  # 3. IAM instance profile (when running on EC2)
  # 4. ECS task credentials (when running on ECS)
  production:
    type: vault:keymgmt:AwsKms
    properties:
      mount: ${keymgmt.path}
      name: aws-production
      keyCollection: us-east-1
  # Distribute a key to AWS KMS
  encryptionKey:
    type: vault:keymgmt:Key
    name: encryption_key
    properties:
      mount: ${keymgmt.path}
      name: aws-encryption-key
      type: aes256-gcm96
  awsDist:
    type: vault:keymgmt:DistributeKey
    name: aws_dist
    properties:
      path: ${keymgmt.path}
      kmsName: ${production.name}
      keyName: ${encryptionKey.name}
      purposes:
        - encrypt
        - decrypt

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

# When credentials are not provided, Vault will use AWS SDK's credential chain:
# 1. Environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN)
# 2. Shared credentials file (~/.aws/credentials)
# 3. IAM instance profile (when running on EC2)
# 4. ECS task credentials (when running on ECS)
resource "vault_keymgmt_awskms" "production" {
  mount          = keymgmt.path
  name           = "aws-production"
  key_collection = "us-east-1"
}
# Distribute a key to AWS KMS
resource "vault_keymgmt_key" "encryption_key" {
  mount = keymgmt.path
  name  = "aws-encryption-key"
  type  = "aes256-gcm96"
}
resource "vault_keymgmt_distributekey" "aws_dist" {
  path     = keymgmt.path
  kms_name = vault_keymgmt_awskms.production.name
  key_name = vault_keymgmt_key.encryption_key.name
  purposes = ["encrypt", "decrypt"]
}

    Create AwsKms Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new AwsKms(name: string, args: AwsKmsArgs, opts?: CustomResourceOptions);
    @overload
def AwsKms(resource_name: str,
           args: AwsKmsArgs,
           opts: Optional[ResourceOptions] = None)

@overload
def AwsKms(resource_name: str,
           opts: Optional[ResourceOptions] = None,
           key_collection: Optional[str] = None,
           mount: Optional[str] = None,
           credentials_wo: Optional[Mapping[str, str]] = None,
           credentials_wo_version: Optional[int] = None,
           name: Optional[str] = None,
           namespace: Optional[str] = None)
    func NewAwsKms(ctx *Context, name string, args AwsKmsArgs, opts ...ResourceOption) (*AwsKms, error)
    public AwsKms(string name, AwsKmsArgs args, CustomResourceOptions? opts = null)
    public AwsKms(String name, AwsKmsArgs args)
public AwsKms(String name, AwsKmsArgs args, CustomResourceOptions options)

    type: vault:keymgmt:AwsKms
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vault_keymgmt_aws_kms" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args AwsKmsArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args AwsKmsArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args AwsKmsArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args AwsKmsArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args AwsKmsArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var awsKmsResource = new Vault.KeyMgmt.AwsKms("awsKmsResource", new()
{
    KeyCollection = "string",
    Mount = "string",
    CredentialsWo = 
    {
        { "string", "string" },
    },
    CredentialsWoVersion = 0,
    Name = "string",
    Namespace = "string",
});

    example, err := keymgmt.NewAwsKms(ctx, "awsKmsResource", &keymgmt.AwsKmsArgs{
	KeyCollection: pulumi.String("string"),
	Mount:         pulumi.String("string"),
	CredentialsWo: pulumi.StringMap{
		"string": pulumi.String("string"),
	},
	CredentialsWoVersion: pulumi.Int(0),
	Name:                 pulumi.String("string"),
	Namespace:            pulumi.String("string"),
})

    resource "vault_keymgmt_aws_kms" "awsKmsResource" {
  lifecycle {
    create_before_destroy = true
  }
  key_collection = "string"
  mount          = "string"
  credentials_wo = {
    "string" = "string"
  }
  credentials_wo_version = 0
  name                   = "string"
  namespace              = "string"
}

    var awsKmsResource = new AwsKms("awsKmsResource", AwsKmsArgs.builder()
    .keyCollection("string")
    .mount("string")
    .credentialsWo(Map.of("string", "string"))
    .credentialsWoVersion(0)
    .name("string")
    .namespace("string")
    .build());

    aws_kms_resource = vault.keymgmt.AwsKms("awsKmsResource",
    key_collection="string",
    mount="string",
    credentials_wo={
        "string": "string",
    },
    credentials_wo_version=0,
    name="string",
    namespace="string")

    const awsKmsResource = new vault.keymgmt.AwsKms("awsKmsResource", {
    keyCollection: "string",
    mount: "string",
    credentialsWo: {
        string: "string",
    },
    credentialsWoVersion: 0,
    name: "string",
    namespace: "string",
});

    type: vault:keymgmt:AwsKms
properties:
    credentialsWo:
        string: string
    credentialsWoVersion: 0
    keyCollection: string
    mount: string
    name: string
    namespace: string

    AwsKms Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The AwsKms resource accepts the following input properties:

    KeyCollection string
    Refers to the name of an AWS region. Cannot be changed after creation.
    Mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    CredentialsWo Dictionary<string, string>
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with AWS KMS. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Credentials provided to this parameter will take precedence over credentials provided via environment variables. This value is write-only and will not be stored in Terraform state. The following values are supported:
    CredentialsWoVersion int
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    Name string
    Specifies the name of the AWS KMS provider. Cannot be changed after creation.
    Namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    KeyCollection string
    Refers to the name of an AWS region. Cannot be changed after creation.
    Mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    CredentialsWo map[string]string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with AWS KMS. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Credentials provided to this parameter will take precedence over credentials provided via environment variables. This value is write-only and will not be stored in Terraform state. The following values are supported:
    CredentialsWoVersion int
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    Name string
    Specifies the name of the AWS KMS provider. Cannot be changed after creation.
    Namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    key_collection string
    Refers to the name of an AWS region. Cannot be changed after creation.
    mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    credentials_wo map(string)
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with AWS KMS. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Credentials provided to this parameter will take precedence over credentials provided via environment variables. This value is write-only and will not be stored in Terraform state. The following values are supported:
    credentials_wo_version number
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    name string
    Specifies the name of the AWS KMS provider. Cannot be changed after creation.
    namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    keyCollection String
    Refers to the name of an AWS region. Cannot be changed after creation.
    mount String
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    credentialsWo Map<String,String>
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with AWS KMS. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Credentials provided to this parameter will take precedence over credentials provided via environment variables. This value is write-only and will not be stored in Terraform state. The following values are supported:
    credentialsWoVersion Integer
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    name String
    Specifies the name of the AWS KMS provider. Cannot be changed after creation.
    namespace String
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    keyCollection string
    Refers to the name of an AWS region. Cannot be changed after creation.
    mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    credentialsWo {[key: string]: string}
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with AWS KMS. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Credentials provided to this parameter will take precedence over credentials provided via environment variables. This value is write-only and will not be stored in Terraform state. The following values are supported:
    credentialsWoVersion number
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    name string
    Specifies the name of the AWS KMS provider. Cannot be changed after creation.
    namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    key_collection str
    Refers to the name of an AWS region. Cannot be changed after creation.
    mount str
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    credentials_wo Mapping[str, str]
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with AWS KMS. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Credentials provided to this parameter will take precedence over credentials provided via environment variables. This value is write-only and will not be stored in Terraform state. The following values are supported:
    credentials_wo_version int
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    name str
    Specifies the name of the AWS KMS provider. Cannot be changed after creation.
    namespace str
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    keyCollection String
    Refers to the name of an AWS region. Cannot be changed after creation.
    mount String
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    credentialsWo Map<String>
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with AWS KMS. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Credentials provided to this parameter will take precedence over credentials provided via environment variables. This value is write-only and will not be stored in Terraform state. The following values are supported:
    credentialsWoVersion Number
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    name String
    Specifies the name of the AWS KMS provider. Cannot be changed after creation.
    namespace String
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the AwsKms resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing AwsKms Resource

    Get an existing AwsKms resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: AwsKmsState, opts?: CustomResourceOptions): AwsKms
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        credentials_wo: Optional[Mapping[str, str]] = None,
        credentials_wo_version: Optional[int] = None,
        key_collection: Optional[str] = None,
        mount: Optional[str] = None,
        name: Optional[str] = None,
        namespace: Optional[str] = None) -> AwsKms
    func GetAwsKms(ctx *Context, name string, id IDInput, state *AwsKmsState, opts ...ResourceOption) (*AwsKms, error)
    public static AwsKms Get(string name, Input<string> id, AwsKmsState? state, CustomResourceOptions? opts = null)
    public static AwsKms get(String name, Output<String> id, AwsKmsState state, CustomResourceOptions options)
    resources:  _:    type: vault:keymgmt:AwsKms    get:      id: ${id}
    import {
  to = vault_keymgmt_aws_kms.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    CredentialsWo Dictionary<string, string>
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with AWS KMS. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Credentials provided to this parameter will take precedence over credentials provided via environment variables. This value is write-only and will not be stored in Terraform state. The following values are supported:
    CredentialsWoVersion int
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    KeyCollection string
    Refers to the name of an AWS region. Cannot be changed after creation.
    Mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    Name string
    Specifies the name of the AWS KMS provider. Cannot be changed after creation.
    Namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    CredentialsWo map[string]string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with AWS KMS. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Credentials provided to this parameter will take precedence over credentials provided via environment variables. This value is write-only and will not be stored in Terraform state. The following values are supported:
    CredentialsWoVersion int
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    KeyCollection string
    Refers to the name of an AWS region. Cannot be changed after creation.
    Mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    Name string
    Specifies the name of the AWS KMS provider. Cannot be changed after creation.
    Namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    credentials_wo map(string)
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with AWS KMS. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Credentials provided to this parameter will take precedence over credentials provided via environment variables. This value is write-only and will not be stored in Terraform state. The following values are supported:
    credentials_wo_version number
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    key_collection string
    Refers to the name of an AWS region. Cannot be changed after creation.
    mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    name string
    Specifies the name of the AWS KMS provider. Cannot be changed after creation.
    namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    credentialsWo Map<String,String>
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with AWS KMS. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Credentials provided to this parameter will take precedence over credentials provided via environment variables. This value is write-only and will not be stored in Terraform state. The following values are supported:
    credentialsWoVersion Integer
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    keyCollection String
    Refers to the name of an AWS region. Cannot be changed after creation.
    mount String
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    name String
    Specifies the name of the AWS KMS provider. Cannot be changed after creation.
    namespace String
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    credentialsWo {[key: string]: string}
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with AWS KMS. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Credentials provided to this parameter will take precedence over credentials provided via environment variables. This value is write-only and will not be stored in Terraform state. The following values are supported:
    credentialsWoVersion number
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    keyCollection string
    Refers to the name of an AWS region. Cannot be changed after creation.
    mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    name string
    Specifies the name of the AWS KMS provider. Cannot be changed after creation.
    namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    credentials_wo Mapping[str, str]
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with AWS KMS. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Credentials provided to this parameter will take precedence over credentials provided via environment variables. This value is write-only and will not be stored in Terraform state. The following values are supported:
    credentials_wo_version int
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    key_collection str
    Refers to the name of an AWS region. Cannot be changed after creation.
    mount str
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    name str
    Specifies the name of the AWS KMS provider. Cannot be changed after creation.
    namespace str
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    credentialsWo Map<String>
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with AWS KMS. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Credentials provided to this parameter will take precedence over credentials provided via environment variables. This value is write-only and will not be stored in Terraform state. The following values are supported:
    credentialsWoVersion Number
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    keyCollection String
    Refers to the name of an AWS region. Cannot be changed after creation.
    mount String
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    name String
    Specifies the name of the AWS KMS provider. Cannot be changed after creation.
    namespace String
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

    Import

    AWS KMS providers can be imported using the format {path}/kms/{name}, e.g.

    $ pulumi import vault:keymgmt/awsKms:AwsKms us_west keymgmt/kms/aws-us-west-2

    Note: Import sets the mount attribute from the import ID. The credentialsWo and credentialsWoVersion fields will not be populated as they are not returned by the Vault API. You must supply these values in your configuration after import. The corresponding vault.Mount resource must also be present in your configuration (or separately imported).

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo vault logo
    Viewing docs for HashiCorp Vault v7.11.0
    published on Wednesday, Jul 22, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-vault

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial