Cloudformation-coverage-roadmap: AWS::KMS::Key asymmetric signing key support

[abiro]

AWS::KMS::Key asymmetric signing key support

2. Scope of request

The AWS::KMS::Key resource doesn't support creating an asymmetric signing key today, although it is possible to create such a key through the KMS API.

This needs two things:

1. Support for AWS::KMS::Key-CustomerMasterKeySpec attribute
2. Support for SIGN_VERIFY value in AWS::KMS::Key-KeyUsage attribute (docs say this is supported, but it gives an error.)

5. Helpful Links to speed up research and evaluation

AWS::KMS::Key resource doc
KMS CreateKey API doc
StackoverFlow Question

6. Category (required)

1. Security (IAM, KMS...)

[benkehoe]

I think I would prefer this be a separate resource type, perhaps even going so far as to separate out SIGN_VERIFY and ENCRYPT_DECRYPT asymmetric keys into separate types, so that it will be easier for type-checking tools to determine if they are being used correctly (with the new resource provider framework, resource schemas could make it clear which usage type of asymmetric key they need), audit tools to understand the contents of a template more simply, etc.

[okgolove]

Any chances this will be implemented? 🚀

[PatMyron]

AWS::KMS::Key is now open source and changes can be tracked here: https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-kms/tree/master/key

[ammokhov]

Any chances this will be implemented? 🚀

this is currently WIP; should be merged soon - https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-kms/pull/24

[mkamioner]

Any update on this?

[jtcul]

Any update on this?

Hey! This change is merged and should be available for use now. For more information, see the AWS::KMS::Key documentation.