Skip to content

Terraform AWS KMS

KMS keys, aliases, grants, key policies, rotation, multi Region options, and tightly scoped permissions used to encrypt data across AWS services.

1 controls enforced21 frameworks

Controls Enforced

The following compliance controls are enforced by this module at terraform plan time.

Quick Start

module "kms" {
  source  = "acscessentialeight.compliance.tf/terraform-aws-modules/kms/aws"
  version = "<version>"

  # ... your arguments here
}

module "kms" {
  source  = "acscism2023.compliance.tf/terraform-aws-modules/kms/aws"
  version = "<version>"

  # ... your arguments here
}

module "kms" {
  source  = "awscontroltower.compliance.tf/terraform-aws-modules/kms/aws"
  version = "<version>"

  # ... your arguments here
}

module "kms" {
  source  = "awsgenai.compliance.tf/terraform-aws-modules/kms/aws"
  version = "<version>"

  # ... your arguments here
}

module "kms" {
  source  = "awswellarchitected.compliance.tf/terraform-aws-modules/kms/aws"
  version = "<version>"

  # ... your arguments here
}

module "kms" {
  source  = "cccsmedium.compliance.tf/terraform-aws-modules/kms/aws"
  version = "<version>"

  # ... your arguments here
}

module "kms" {
  source  = "cfrpart11.compliance.tf/terraform-aws-modules/kms/aws"
  version = "<version>"

  # ... your arguments here
}

module "kms" {
  source  = "cis.compliance.tf/terraform-aws-modules/kms/aws"
  version = "<version>"

  # ... your arguments here
}

module "kms" {
  source  = "cisv500.compliance.tf/terraform-aws-modules/kms/aws"
  version = "<version>"

  # ... your arguments here
}

module "kms" {
  source  = "cisv600.compliance.tf/terraform-aws-modules/kms/aws"
  version = "<version>"

  # ... your arguments here
}

module "kms" {
  source  = "cisv80ig1.compliance.tf/terraform-aws-modules/kms/aws"
  version = "<version>"

  # ... your arguments here
}

module "kms" {
  source  = "cisacyberessentials.compliance.tf/terraform-aws-modules/kms/aws"
  version = "<version>"

  # ... your arguments here
}

module "kms" {
  source  = "eugmpannex11.compliance.tf/terraform-aws-modules/kms/aws"
  version = "<version>"

  # ... your arguments here
}

module "kms" {
  source  = "fedramplow.compliance.tf/terraform-aws-modules/kms/aws"
  version = "<version>"

  # ... your arguments here
}

module "kms" {
  source  = "fedrampmoderate.compliance.tf/terraform-aws-modules/kms/aws"
  version = "<version>"

  # ... your arguments here
}

module "kms" {
  source  = "ffiec.compliance.tf/terraform-aws-modules/kms/aws"
  version = "<version>"

  # ... your arguments here
}

module "kms" {
  source  = "gdpr.compliance.tf/terraform-aws-modules/kms/aws"
  version = "<version>"

  # ... your arguments here
}

module "kms" {
  source  = "hipaa.compliance.tf/terraform-aws-modules/kms/aws"
  version = "<version>"

  # ... your arguments here
}

module "kms" {
  source  = "iso27001.compliance.tf/terraform-aws-modules/kms/aws"
  version = "<version>"

  # ... your arguments here
}

module "kms" {
  source  = "nis2.compliance.tf/terraform-aws-modules/kms/aws"
  version = "<version>"

  # ... your arguments here
}

module "kms" {
  source  = "nist800171.compliance.tf/terraform-aws-modules/kms/aws"
  version = "<version>"

  # ... your arguments here
}

module "kms" {
  source  = "nist80053.compliance.tf/terraform-aws-modules/kms/aws"
  version = "<version>"

  # ... your arguments here
}

module "kms" {
  source  = "nistcsf.compliance.tf/terraform-aws-modules/kms/aws"
  version = "<version>"

  # ... your arguments here
}

module "kms" {
  source  = "nydfs23.compliance.tf/terraform-aws-modules/kms/aws"
  version = "<version>"

  # ... your arguments here
}

module "kms" {
  source  = "pcidss.compliance.tf/terraform-aws-modules/kms/aws"
  version = "<version>"

  # ... your arguments here
}

module "kms" {
  source  = "rbicybersecurity.compliance.tf/terraform-aws-modules/kms/aws"
  version = "<version>"

  # ... your arguments here
}

module "kms" {
  source  = "rbiitfnbfc.compliance.tf/terraform-aws-modules/kms/aws"
  version = "<version>"

  # ... your arguments here
}

module "kms" {
  source  = "soc2.compliance.tf/terraform-aws-modules/kms/aws"
  version = "<version>"

  # ... your arguments here
}

See the Get Started guide to get started and read the Features section for more details on how to customize the module for your requirements.

Migration from Upstream

Already using terraform-aws-modules? Change only the source URL:

module "kms" {
  source  = "terraform-aws-modules/kms/aws"
  version = "1.0"
}

module "kms" {
  source  = "soc2.compliance.tf/terraform-aws-modules/kms/aws"
  version = "1.0"
}

Same arguments. Same outputs. Compliance controls are enforced automatically at terraform plan. If a required value is missing, you get a clear validation error telling you what to set.

See the Migration Guide for step-by-step instructions.

Reversibility

No lock-in. Switch back by reverting the source URL to the upstream path:

module "kms" {
  source  = "terraform-aws-modules/kms/aws"
}

Run terraform init -upgrade. Terraform state is unchanged — same resource addresses, same provider, no compliance.tf-specific resources. Controls you already applied remain in AWS.

Mapped compliance frameworks

Identity and access management

CM-3(6): Cryptography Management

11.30 Controls for open systems

3 Logging

3 Logging

4 Logging

4.6 Securely Manage Enterprise Assets and Software

Your Systems-3

Cryptographic Key Establishment And Management (SC-12)

Cryptographic Key Establishment And Management (SC-12)

Article 25 Data protection by design and by default

Article 30 Records of processing activities

164.312(a)(2)(iv) Encryption and decryption

A.8.5 Secure authentication

A.8.11 Data masking

A.8.24 Use of cryptography

11 Access control

CM-6(a)

CM-9(b)

Cryptographic Key Establishment And Management (SC-12)

SA-9(6) Organization-Controlled Cryptographic Keys

SC-12(2) Symmetric Keys

SC-12(6) Physical Control Of Keys

PR.DS-01

3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.

3.7.5: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.

Annex I (1.3)

6.3 Backup and Recovery

PI1.5 Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's processing integrity commitments and system requirements

Framework Coverage

Which controls from this module are active under each framework endpoint. ● enforced by default · ○ not activated by this endpoint

ControlAWS Well-Architected Framework v10CCCS Medium Cloud Control ProfileTitle 21 CFR Part 11CIS AWS Benchmark v1.4.0CIS AWS Benchmark v5.0.0CIS AWS Benchmark v6.0.0CIS Controls v8.0 IG1CISA Cyber Essentials
KMS CMK rotation should be enabled●●●●●●●●

Showing top 8 frameworks by coverage. All framework endpoints →