Terraform KMS_key_id invalid root key error

Question

Below is my VPC, security group and KMS setting, I encounter the error:

Terraform script has failed because of: Error: data.aws_kms_key.by_key_arn: : invalid or unknown key: kms_key_id,

I was given one KMS_key_id, so how to define the kms_key_id? should I use "data "aws_kms_key" "by_key_arn"?

is this a valid root key for my aws_vpc? eu-west-1 is my region,22***** is my aws account, 5367*-***** is my key id

 data "aws_vpc" "vpc" {
   tags = {
    Name = "my_vpc"
    }
   }
 resource "aws_security_group" "a" {
    name   = "a"
    vpc_id = "${data.aws_vpc.vpc.id}"
    }
 data "aws_kms_key" "by_key_arn" {
     kms_key_id = "arn:aws:kms:eu-west-1:22******:key/5367*-****-****-****-********"
    }

It looks like the ARN you're giving it doesn't exist. It's valid to use the key ID and not the full ARN - does that work? — Dan Monego

Carlo Mencarelli Carlo Mencarelli · Accepted Answer · 2021-01-30T05:29:59

If you need to use the KMS key to encrypt something like an S3 bucket, you should be able to just do something like this:

resource "aws_s3_bucket" "mybucket" {
  bucket = "mybucket"

  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        kms_master_key_id = arn:aws:kms:eu-west-1:22******:key/5367*-****-****-****-********"
        sse_algorithm     = "aws:kms"
      }
    }
  }
}

However, if you are looking to use a key provided to use in multiple resources included besides using the key arn, you'd import it as such:

data "aws_kms_key" "by_key_arn" {
  key_id = "arn:aws:kms:eu-west-1:22******:key/5367*-****-****-****-********"
}

Note the key_id parameter in the data block. You have kms_key_id which is not a valid parameter for that data block. Valid options for key_id are:

Aliases: alias/my-key
Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
Alias ARN: arn:aws:kms:us-east-1:111122223333:alias/my-key
Key ARN: arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab

Refs: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/kms_key

Terraform KMS_key_id invalid root key error

1 Answers