AWS Amazon EC2 Default Kms Key

aws_ebs_default_kms_key (Terraform)

The Default Kms Key in Amazon EC2 can be configured in Terraform with the resource name aws_ebs_default_kms_key. The following sections describe 5 examples of how to use the resource and its parameters.

Example Usage from GitHub

run-x/opta

resource "aws_ebs_default_kms_key" "default" {
  key_arn = aws_kms_key.key.arn
}

resource "aws_ebs_encryption_by_default" "default" {
  enabled = true

saucynosoy/opta

resource "aws_ebs_default_kms_key" "default" {
  key_arn = aws_kms_key.key.arn
}

resource "aws_ebs_encryption_by_default" "default" {
  enabled = true

mikamakusa/terraform

resource "aws_ebs_default_kms_key" "ebs_default_kms_key" {
  count = length(var.ebs_default_kms_key)
  key_arn = element(var.kms_key_id, lookup(var.ebs_default_kms_key[count.index], "kms_key_id"))

niveklabs/aws

resource "aws_ebs_default_kms_key" "this" {
  key_arn = var.key_arn
}

qed-technologies/terraform-aws-organizations-account

resource "aws_ebs_default_kms_key" "this" {
  count    = var.ebs_default_kms_key_arn == "" ? 0 : 1
  provider = aws.member

  key_arn = var.ebs_default_kms_key_arn

Parameters

• id optional computed - string
• key_arn required - string

Explanation in Terraform Registry

Provides a resource to manage the default customer master key (CMK) that your AWS account uses to encrypt EBS volumes. Your AWS account has an AWS-managed default CMK that is used for encrypting an EBS volume when no CMK is specified in the API call that creates the volume. By using the aws_ebs_default_kms_key resource, you can specify a customer-managed CMK to use in place of the AWS-managed default CMK.

NOTE: Creating an aws_ebs_default_kms_key resource does not enable default EBS encryption. Use the aws_ebs_encryption_by_default to enable default EBS encryption. NOTE: Destroying this resource will reset the default CMK to the account's AWS-managed default CMK for EBS.

Tips: Best Practices for The Other AWS Amazon EC2 Resources

In addition to the aws_default_vpc, AWS Amazon EC2 has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.

aws_default_vpc

Ensure to avoid using default VPC

It is better to define the own VPC and use it.

aws_network_acl_rule

Ensure your network ACL rule blocks unwanted inbound traffic

It is better to block unwanted inbound traffic.

aws_ebs_volume

Ensure to use a customer-managed key for EBS volume encryption

It is better to use a customer-managed key for EBS volume encryption. It can be gain more control over the encryption by using customer-managed keys (CMK).

aws_instance

Ensure to avoid storing AWS access keys in user data

It is better to avoid storing AWS access keys in user data. `aws_iam_instance_profile` could be used instead.

aws_security_group

Ensure your security group blocks unwanted inbound traffic

It is better to block unwanted inbound traffic.