Skip to content
Kyku

KmsKey

A KmsKey represents a customer-managed encryption key used for encrypting data at rest — EBS volumes, S3 buckets, RDS instances, and other resources. On AWS this is a KMS Key, on GCP a Cloud KMS CryptoKey. Hetzner and DigitalOcean do not have equivalent standalone key management services.

Config

Section titled “Config”
Property Type Required Description
name string yes Unique resource name
id string no Explicit ID (auto-generated UUID if omitted)
provider string no Provider label for multi-provider configs
tags Record<string, string> no Arbitrary key-value metadata
rotationPeriod string no Auto-rotation period (e.g. '90d', '1y')

Example

Section titled “Example”
import { KmsKey } from '@kykucloud/types'


const myKey = new KmsKey({
  name: 'data-key',
  rotationPeriod: '90d',
})

Provider Support

Section titled “Provider Support”
Provider Supported Backend
AWS ✅ KMS (Key Management Service)
GCP ✅ Cloud KMS (CryptoKey)
Hetzner ❌ Not available
DigitalOcean ❌ Not available

Notes

Section titled “Notes”
  • AWS KMS keys can be symmetric or asymmetric (default: symmetric). Rotation period sets automatic yearly rotation (when rotationPeriod is specified). Costs $1/month per key plus usage fees.
  • GCP Cloud KMS keys live in a key ring. The provider manages key ring creation automatically. Rotation period uses duration strings like 90d or 1y.
  • KMS keys are referenced by other resources (e.g. Bucket, Database) through provider-specific configuration. Future Kyku versions will add a direct reference field on resource configs.