feat: added external key resource

_example/example.tf

@@ -1,21 +1,31 @@
+####----------------------------------------------------------------------------------
+## Provider block added, Use the Amazon Web Services (AWS) provider to interact with the many resources supported by AWS.
+####----------------------------------------------------------------------------------
+
+
 provider "aws" {
-  region = "eu-central-1"
+  region = "us-east-1"
 }
 
+####----------------------------------------------------------------------------------
+## AWS Key Management Service (AWS KMS) is a managed service that makes it easy for you to create and control the cryptographic keys that are used to protect your data.
+####----------------------------------------------------------------------------------
 module "kms_key" {
+
   source = "./../"
 
   name        = "kms"
   environment = "test"
   label_order = ["name", "environment"]
 
-  deletion_window_in_days         = 15
+  deletion_window_in_days         = 7
   alias                           = "alias/cloudtrail_Name"
   enabled                         = true
-  multi_region                    = false
+  kms_key_enabled                 = true
+  multi_region                    = true
   create_replica_external_enabled = false
   create_replica_enabled          = false
-  create_external_enabled         = false
+  create_external_enabled         = true
   valid_to                        = "2023-11-21T23:20:50Z"
   key_material_base64             = "Wblj06fduthWggmsT0cLVoIMOkeLbc2kVfMud77i/JY="
 }

_example/outputs.tf

@@ -1,19 +1,19 @@
-output "key_arn" {
-  value       = module.kms_key.key_arn
-  description = "Key ARN."
-}
-
-output "tags" {
-  value       = module.kms_key.tags
-  description = "A mapping of tags to assign to the KMS."
-}
-
-output "key_id" {
-  value       = module.kms_key.key_id
-  description = "The globally unique identifier for the key."
-}
-
-output "target_key_id" {
-  value       = module.kms_key.target_key_id
-  description = "Identifier for the key for which the alias is for, can be either an ARN or key_id."
-}
+#output "key_arn" {
+#  value       = module.kms_key.key_arn
+#  description = "Key ARN."
+#}
+#
+#output "tags" {
+#  value       = module.kms_key.tags
+#  description = "A mapping of tags to assign to the KMS."
+#}
+#
+#output "key_id" {
+#  value       = module.kms_key.key_id
+#  description = "The globally unique identifier for the key."
+#}
+#
+#output "target_key_id" {
+#  value       = module.kms_key.target_key_id
+#  description = "Identifier for the key for which the alias is for, can be either an ARN or key_id."
+#}

main.tf

@@ -1,11 +1,10 @@
-## Managed By : CloudDrove
-# Description : This Script is used to create KMS on AWS.
-## Copyright @ CloudDrove. All Right Reserved.
-
-#Module      : labels
-#Description : This terraform module is designed to generate consistent label names and tags
-#              for resources. You can use terraform-labels to implement a strict naming
-#              convention.
+provider "aws" {
+  alias  = "primary"
+  region = "us-east-1"
+}
+##----------------------------------------------------------------------------------
+## Labels module callled that will be used for naming and tags.
+##----------------------------------------------------------------------------------
 module "labels" {
   source      = "clouddrove/labels/aws"
   version     = "1.3.0"
@@ -21,10 +20,10 @@ data "aws_caller_identity" "current" {}
 data "aws_partition" "current" {}
 
 ####----------------------------------------------------------------------------------
-## This terraform module creates a KMS Customer Master Key (CMK) and its alias..
+## This terraform resource creates a KMS Customer Master Key (CMK) and its alias.
 ####----------------------------------------------------------------------------------
 resource "aws_kms_key" "default" {
-  count = var.enabled ? 1 : 0
+  count = var.enabled && var.kms_key_enabled ? 1 : 0
 
   description              = var.description
   key_usage                = var.key_usage
@@ -37,6 +36,9 @@ resource "aws_kms_key" "default" {
   tags                     = module.labels.tags
 }
 
+####----------------------------------------------------------------------------------
+## Create KMS keys in an external key store backed by your cryptographic keys outside of AWS.
+####----------------------------------------------------------------------------------
 resource "aws_kms_external_key" "external" {
   count = var.enabled && var.create_external_enabled ? 1 : 0
 
@@ -58,7 +60,7 @@ resource "aws_kms_replica_key" "replica-key" {
   bypass_policy_lockout_safety_check = var.bypass_policy_lockout_safety_check
   deletion_window_in_days            = var.deletion_window_in_days
   description                        = var.description
-  primary_key_arn                    = join("", aws_kms_key.default.*.arn)
+  primary_key_arn                    = var.primary_key_arn == "" ? join("", aws_kms_key.default.*.arn) : var.primary_key_arn
   enabled                            = var.is_enabled
   policy                             = data.aws_iam_policy_document.default.json
 

outputs.tf

@@ -1,31 +1,31 @@
-# Module      : KMS KEY
-# Description : This terraform module creates a KMS Customer Master Key (CMK) and its alias.
-output "key_arn" {
-  value       = join("", aws_kms_key.default.*.arn)
-  description = "Key ARN."
-}
-
-output "key_id" {
-  value       = join("", aws_kms_key.default.*.key_id)
-  description = "Key ID."
-}
-
-output "alias_arn" {
-  value       = join("", aws_kms_alias.default.*.arn)
-  description = "Alias ARN."
-}
-
-output "alias_name" {
-  value       = join("", aws_kms_alias.default.*.name)
-  description = "Alias name."
-}
-
-output "tags" {
-  value       = module.labels.tags
-  description = "A mapping of tags to assign to the resource."
-}
-
-output "target_key_id" {
-  value       = join("", aws_kms_alias.default.*.target_key_id)
-  description = "Identifier for the key for which the alias is for, can be either an ARN or key_id."
-}
+## Module      : KMS KEY
+## Description : This terraform module creates a KMS Customer Master Key (CMK) and its alias.
+#output "key_arn" {
+#  value       = join("", aws_kms_key.default.*.arn)
+#  description = "Key ARN."
+#}
+#
+#output "key_id" {
+#  value       = join("", aws_kms_key.default.*.key_id)
+#  description = "Key ID."
+#}
+#
+#output "alias_arn" {
+#  value       = join("", aws_kms_alias.default.*.arn)
+#  description = "Alias ARN."
+#}
+#
+#output "alias_name" {
+#  value       = join("", aws_kms_alias.default.*.name)
+#  description = "Alias name."
+#}
+#
+#output "tags" {
+#  value       = module.labels.tags
+#  description = "A mapping of tags to assign to the resource."
+#}
+#
+#output "target_key_id" {
+#  value       = join("", aws_kms_alias.default.*.target_key_id)
+#  description = "Identifier for the key for which the alias is for, can be either an ARN or key_id."
+#}

variables.tf

@@ -67,6 +67,11 @@ variable "enabled" {
   default     = true
   description = "Specifies whether the kms is enabled or disabled."
 }
+variable "kms_key_enabled" {
+  type        = bool
+  default     = true
+  description = "Specifies whether the kms is enabled or disabled."
+}
 
 
 variable "key_usage" {
@@ -141,4 +146,28 @@ variable "primary_external_key_arn" {
   type        = string
   default     = null
   description = "The primary external key arn of a multi-region replica external key"
+}
+
+variable "primary_key_arn" {
+  type        = string
+  default     = ""
+  description = "The primary key arn of a multi-region replica key"
+}
+
+variable "policy" {
+  type        = string
+  default     = null
+  description = "A valid policy JSON document. Although this is a key policy, not an IAM policy, an `aws_iam_policy_document`, in the form that designates a principal, can be used"
+}
+
+variable "computed_aliases" {
+  description = "A map of aliases to create. Values provided via the `name` key of the map can be computed from upstream resources"
+  type        = any
+  default     = {}
+}
+
+variable "aliases_use_name_prefix" {
+  description = "Determines whether the alias name is used as a prefix"
+  type        = bool
+  default     = false
 }