Data Source: oci_kms_keys

This data source provides the list of Keys in Oracle Cloud Infrastructure Kms service.

Lists the master encryption keys in the specified vault and compartment.

As a management operation, this call is subject to a Key Management limit that applies to the total number of requests across all management read operations. Key Management might throttle this call to reject an otherwise valid request when the total rate of management read operations exceeds 10 requests per second for a given tenancy.

Example Usage

data "oci_kms_keys" "test_keys" {
	#Required
	compartment_id = var.compartment_id
	management_endpoint = var.key_management_endpoint

	#Optional
	algorithm = var.key_algorithm
	length = var.key_length
	curve_id = oci_kms_curve.test_curve.id
	protection_mode = var.key_protection_mode
}

Argument Reference

The following arguments are supported:

algorithm - (Optional) The algorithm used by a key’s key versions to encrypt or decrypt data. Currently, support includes AES, RSA, and ECDSA algorithms.
compartment_id - (Required) The OCID of the compartment.
curve_id - (Optional) The curve ID of the keys. (This pertains only to ECDSA keys.)
length - (Optional) The length of the key in bytes, expressed as an integer. Supported values include 16, 24, or 32.
management_endpoint - (Required) The service endpoint to perform management operations against. Management operations include ‘Create,’ ‘Update,’ ‘List,’ ‘Get,’ and ‘Delete’ operations. See Vault Management endpoint.
protection_mode - (Optional) A key’s protection mode indicates how the key persists and where cryptographic operations that use the key are performed. A protection mode of HSM means that the key persists on a hardware security module (HSM) and all cryptographic operations are performed inside the HSM. A protection mode of SOFTWARE means that the key persists on the server, protected by the vault’s RSA wrapping key which persists on the HSM. All cryptographic operations that use a key with a protection mode of SOFTWARE are performed on the server. A protection mode of EXTERNAL mean that the key persists on the customer’s external key manager which is hosted externally outside of oracle. Oracle only hold a reference to that key. All cryptographic operations that use a key with a protection mode of EXTERNAL are performed by external key manager.

Attributes Reference

The following attributes are exported:

keys - The list of keys.

Key Reference

The following attributes are exported:

auto_key_rotation_details - The details of auto rotation schedule for the Key being create updated or imported.
- last_rotation_message - The last execution status message.
- last_rotation_status - The status of last execution of auto key rotation.
- rotation_interval_in_days - The interval of auto key rotation. For auto key rotation the interval should between 30 day and 365 days (1 year)
- time_of_last_rotation - A property indicating Last rotation Date Example: 2023-04-04T00:00:00Z.
- time_of_next_rotation - A property indicating Next estimated scheduled Time, as per the interval, expressed as date YYYY-MM-DD String. Example: 2023-04-04T00:00:00Z .
- time_of_schedule_start - A property indicating scheduled start date expressed as date YYYY-MM-DD String. Example: 2023-04-04T00:00:00Z .
compartment_id - The OCID of the compartment that contains this master encryption key.
current_key_version - The OCID of the key version used in cryptographic operations. During key rotation, the service might be in a transitional state where this or a newer key version are used intermittently. The currentKeyVersion property is updated when the service is guaranteed to use the new key version for all subsequent encryption operations.
defined_tags - Defined tags for this resource. Each key is predefined and scoped to a namespace. For more information, see Resource Tags. Example: {"Operations.CostCenter": "42"}
display_name - A user-friendly name for the key. It does not have to be unique, and it is changeable. Avoid entering confidential information.
external_key_reference_details - Key reference data to be returned to the customer as a response.
- external_key_id - ExternalKeyId refers to the globally unique key Id associated with the key created in external vault in CTM.
- external_key_version_id - Key version ID associated with the external key.
freeform_tags - Free-form tags for this resource. Each tag is a simple key-value pair with no predefined name, type, or namespace. For more information, see Resource Tags. Example: {"Department": "Finance"}
id - The OCID of the key.
is_auto_rotation_enabled - A parameter specifying whether the auto key rotation is enabled or not.
is_primary - A Boolean value that indicates whether the Key belongs to primary Vault or replica vault.
key_shape - The cryptographic properties of a key.
- algorithm - The algorithm used by a key’s key versions to encrypt or decrypt. Only AES algorithm is supported for External keys.
- curve_id - Supported curve IDs for ECDSA keys.
- length - The length of the key in bytes, expressed as an integer. Supported values include the following:
  - AES: 16, 24, or 32
  - RSA: 256, 384, or 512
  - ECDSA: 32, 48, or 66
protection_mode - The key’s protection mode indicates how the key persists and where cryptographic operations that use the key are performed. A protection mode of HSM means that the key persists on a hardware security module (HSM) and all cryptographic operations are performed inside the HSM. A protection mode of SOFTWARE means that the key persists on the server, protected by the vault’s RSA wrapping key which persists on the HSM. All cryptographic operations that use a key with a protection mode of SOFTWARE are performed on the server. By default, a key’s protection mode is set to HSM. You can’t change a key’s protection mode after the key is created or imported. A protection mode of EXTERNAL mean that the key persists on the customer’s external key manager which is hosted externally outside of oracle. Oracle only hold a reference to that key. All cryptographic operations that use a key with a protection mode of EXTERNAL are performed by external key manager.
replica_details - Key replica details
- replication_id - ReplicationId associated with a key operation
state - The key’s current lifecycle state. Example: ENABLED
time_created - The date and time the key was created, expressed in RFC 3339 timestamp format. Example: 2018-04-03T21:10:29.600Z
time_of_deletion - An optional property indicating when to delete the key, expressed in RFC 3339 timestamp format. Example: 2019-04-03T21:10:29.600Z
vault_id - The OCID of the vault that contains this key.