community / community.aws / 4.3.0 / module / aws_kms_info Gather information about AWS KMS keys | "added in version" 1.0.0 of community.aws" Authors: Will Thames (@willthames)community.aws.aws_kms_info (4.3.0) — module
Install with ansible-galaxy collection install community.aws:==4.3.0
collections: - name: community.aws version: 4.3.0
Gather information about AWS KMS keys including tags and grants.
# Note: These examples do not set authentication details, see the AWS Guide for details. # Gather information about all KMS keys - community.aws.aws_kms_info:
# Gather information about all keys with a Name tag - community.aws.aws_kms_info: filters: tag-key: Name
# Gather information about all keys with a specific name - community.aws.aws_kms_info: filters: "tag:Name": Example
alias: aliases: - key_alias description: - Alias for key. - Mutually exclusive with I(key_id) and I(filters). required: false type: str version_added: 1.4.0 version_added_collection: community.aws key_id: aliases: - key_arn description: - Key ID or ARN of the key. - Mutually exclusive with I(alias) and I(filters). required: false type: str version_added: 1.4.0 version_added_collection: community.aws region: aliases: - aws_region - ec2_region description: - The AWS region to use. If not specified then the value of the AWS_REGION or EC2_REGION environment variable, if any, is used. See U(http://docs.aws.amazon.com/general/latest/gr/rande.html#ec2_region) type: str ec2_url: aliases: - aws_endpoint_url - endpoint_url description: - Url to use to connect to EC2 or your Eucalyptus cloud (by default the module will use EC2 endpoints). Ignored for modules where region is required. Must be specified for all other modules if region is not used. If not set then the value of the EC2_URL environment variable, if any, is used. type: str filters: description: - A dict of filters to apply. Each dict item consists of a filter key and a filter value. The filters aren't natively supported by boto3, but are supported to provide similar functionality to other modules. Standard tag filters (C(tag-key), C(tag-value) and C(tag:tagName)) are available, as are C(key-id) and C(alias) - Mutually exclusive with I(alias) and I(key_id). type: dict profile: aliases: - aws_profile description: - Uses a boto profile. Only works with boto >= 2.24.0. - Using I(profile) will override I(aws_access_key), I(aws_secret_key) and I(security_token) and support for passing them at the same time as I(profile) has been deprecated. - I(aws_access_key), I(aws_secret_key) and I(security_token) will be made mutually exclusive with I(profile) after 2022-06-01. type: str aws_config: description: - A dictionary to modify the botocore configuration. - Parameters can be found at U(https://botocore.amazonaws.com/v1/documentation/api/latest/reference/config.html#botocore.config.Config). - Only the 'user_agent' key is used for boto modules. See U(http://boto.cloudhackers.com/en/latest/boto_config_tut.html#boto) for more boto configuration. type: dict aws_ca_bundle: description: - The location of a CA Bundle to use when validating SSL certificates. - Only used for boto3 based modules. - 'Note: The CA Bundle is read ''module'' side and may need to be explicitly copied from the controller if not run locally.' type: path aws_access_key: aliases: - ec2_access_key - access_key description: - AWS access key. If not set then the value of the AWS_ACCESS_KEY_ID, AWS_ACCESS_KEY or EC2_ACCESS_KEY environment variable is used. - If I(profile) is set this parameter is ignored. - Passing the I(aws_access_key) and I(profile) options at the same time has been deprecated and the options will be made mutually exclusive after 2022-06-01. type: str aws_secret_key: aliases: - ec2_secret_key - secret_key description: - AWS secret key. If not set then the value of the AWS_SECRET_ACCESS_KEY, AWS_SECRET_KEY, or EC2_SECRET_KEY environment variable is used. - If I(profile) is set this parameter is ignored. - Passing the I(aws_secret_key) and I(profile) options at the same time has been deprecated and the options will be made mutually exclusive after 2022-06-01. type: str security_token: aliases: - aws_security_token - access_token description: - AWS STS security token. If not set then the value of the AWS_SECURITY_TOKEN or EC2_SECURITY_TOKEN environment variable is used. - If I(profile) is set this parameter is ignored. - Passing the I(security_token) and I(profile) options at the same time has been deprecated and the options will be made mutually exclusive after 2022-06-01. type: str validate_certs: default: true description: - When set to "no", SSL certificates will not be validated for boto versions >= 2.6.0. type: bool pending_deletion: default: false description: Whether to get full details (tags, grants etc.) of keys pending deletion. type: bool debug_botocore_endpoint_logs: default: 'no' description: - Use a botocore.endpoint logger to parse the unique (rather than total) "resource:action" API calls made during a task, outputing the set to the resource_actions key in the task results. Use the aws_resource_action callback to output to total list made during a playbook. The ANSIBLE_DEBUG_BOTOCORE_LOGS environment variable may also be used. type: bool
kms_keys: contains: aliases: description: list of aliases associated with the key. returned: always sample: - aws/acm - aws/ebs type: list aws_account_id: description: The AWS Account ID that the key belongs to. returned: always sample: 1234567890123 type: str creation_date: description: Date and time of creation of the key. returned: always sample: '2017-04-18T15:12:08.551000+10:00' type: str deletion_date: description: Date and time after which KMS deletes this KMS key. returned: when key_state is PendingDeletion sample: '2017-04-18T15:12:08.551000+10:00' type: str version_added: 3.3.0 version_added_collection: community.aws description: description: Description of the key. returned: always sample: My Key for Protecting important stuff type: str enable_key_rotation: description: Whether the automatic annual key rotation is enabled. Returns None if key rotation status can't be determined. returned: always sample: false type: bool enabled: description: Whether the key is enabled. True if I(key_state) is C(Enabled). returned: always sample: false type: bool grants: contains: constraints: description: Constraints on the encryption context that the grant allows. See U(https://docs.aws.amazon.com/kms/latest/APIReference/API_GrantConstraints.html) for further details returned: always sample: encryption_context_equals: aws:lambda:_function_arn: arn:aws:lambda:ap-southeast-2:012345678912:function:xyz type: dict creation_date: description: Date of creation of the grant. returned: always sample: '2017-04-18T15:12:08+10:00' type: str grant_id: description: The unique ID for the grant. returned: always sample: abcd1234abcd1234abcd1234abcd1234abcd1234abcd1234abcd1234abcd1234 type: str grantee_principal: description: The principal that receives the grant's permissions. returned: always sample: arn:aws:sts::0123456789012:assumed-role/lambda_xyz/xyz type: str issuing_account: description: The AWS account under which the grant was issued. returned: always sample: arn:aws:iam::01234567890:root type: str key_id: description: The key ARN to which the grant applies. returned: always sample: arn:aws:kms:ap-southeast-2:123456789012:key/abcd1234-abcd-1234-5678-ef1234567890 type: str name: description: The friendly name that identifies the grant. returned: always sample: xyz type: str operations: description: The list of operations permitted by the grant. returned: always sample: - Decrypt - RetireGrant type: list retiring_principal: description: The principal that can retire the grant. returned: always sample: arn:aws:sts::0123456789012:assumed-role/lambda_xyz/xyz type: str description: List of grants associated with a key. elements: dict returned: always type: list key_arn: description: ARN of key. returned: always sample: arn:aws:kms:ap-southeast-2:123456789012:key/abcd1234-abcd-1234-5678-ef1234567890 type: str key_id: description: ID of key. returned: always sample: abcd1234-abcd-1234-5678-ef1234567890 type: str key_policies: description: List of policy documents for the key. Empty when access is denied even if there are policies. elements: dict returned: always sample: Id: auto-ebs-2 Statement: - Action: - kms:Encrypt - kms:Decrypt - kms:ReEncrypt* - kms:GenerateDataKey* - kms:CreateGrant - kms:DescribeKey Condition: StringEquals: kms:CallerAccount: '111111111111' kms:ViaService: ec2.ap-southeast-2.amazonaws.com Effect: Allow Principal: AWS: '*' Resource: '*' Sid: Allow access through EBS for all principals in the account that are authorized to use EBS - Action: - kms:Describe* - kms:Get* - kms:List* - kms:RevokeGrant Effect: Allow Principal: AWS: arn:aws:iam::111111111111:root Resource: '*' Sid: Allow direct access to key metadata to the account Version: '2012-10-17' type: list version_added: 3.3.0 version_added_collection: community.aws key_state: description: - The state of the key. - Will be one of C('Creating'), C('Enabled'), C('Disabled'), C('PendingDeletion'), C('PendingImport'), C('PendingReplicaDeletion'), C('Unavailable'), or C('Updating'). returned: always sample: PendingDeletion type: str key_usage: description: The cryptographic operations for which you can use the key. returned: always sample: ENCRYPT_DECRYPT type: str origin: description: The source of the key's key material. When this value is C(AWS_KMS), AWS KMS created the key material. When this value is C(EXTERNAL), the key material was imported or the CMK lacks key material. returned: always sample: AWS_KMS type: str policies: description: List of policy documents for the key. Empty when access is denied even if there are policies. elements: str returned: always sample: Id: auto-ebs-2 Statement: - Action: - kms:Encrypt - kms:Decrypt - kms:ReEncrypt* - kms:GenerateDataKey* - kms:CreateGrant - kms:DescribeKey Condition: StringEquals: kms:CallerAccount: '111111111111' kms:ViaService: ec2.ap-southeast-2.amazonaws.com Effect: Allow Principal: AWS: '*' Resource: '*' Sid: Allow access through EBS for all principals in the account that are authorized to use EBS - Action: - kms:Describe* - kms:Get* - kms:List* - kms:RevokeGrant Effect: Allow Principal: AWS: arn:aws:iam::111111111111:root Resource: '*' Sid: Allow direct access to key metadata to the account Version: '2012-10-17' type: list tags: description: Dictionary of tags applied to the key. Empty when access is denied even if there are tags. returned: always sample: Name: myKey Purpose: protecting_stuff type: dict description: List of keys. returned: always type: complex