aws-kms Vault

A Zilla runtime aws-kms vault that wraps and unwraps secret key material — such as a per-message data encryption key generated for field-level encryption — under a configured AWS KMS key, without the raw key material ever leaving KMS.

This is typically referenced by a Kafka topic model's field-level encryption transform (encryption.vault.<vault-name>), naming configured keys by alias wherever key material needs to be wrapped or unwrapped via AWS KMS.

Available in Zilla Plus

server:
  type: aws-kms
  options:
    keys:
      ssn-key: arn:aws:kms:us-east-1:123456789012:key/abc-def

Configuration (* required)

options

object

The aws-kms specific options.

options.keys

array of string, object

Amazon Resource Names (ARNs) of AWS KMS keys to wrap and unwrap secret key material under. Accepts either a list of ARNs or a map of alias name to ARN, so an alias can be referenced by name wherever an ARN would otherwise be required.

options:
  keys:
    ssn-key: arn:aws:kms:us-east-1:123456789012:key/abc-def

Referenced key names must be given explicitly wherever this vault is consumed — for example, in a Kafka topic model's field-level encryption transform.