This is the new *CloudFormation Template Reference Guide*. Please update your bookmarks and links. For help getting started with CloudFormation, see the [AWS CloudFormation User Guide](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/Welcome.html).

# AWS::EC2::VerifiedAccessTrustProvider
<a name="aws-resource-ec2-verifiedaccesstrustprovider"></a>

A trust provider is a third-party entity that creates, maintains, and manages identity information for users and devices. When an application request is made, the identity information sent by the trust provider is evaluated by Verified Access before allowing or denying the application request.

## Syntax
<a name="aws-resource-ec2-verifiedaccesstrustprovider-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-resource-ec2-verifiedaccesstrustprovider-syntax.json"></a>

```
{
  "Type" : "AWS::EC2::VerifiedAccessTrustProvider",
  "Properties" : {
      "[Description](#cfn-ec2-verifiedaccesstrustprovider-description)" : String,
      "[DeviceOptions](#cfn-ec2-verifiedaccesstrustprovider-deviceoptions)" : DeviceOptions,
      "[DeviceTrustProviderType](#cfn-ec2-verifiedaccesstrustprovider-devicetrustprovidertype)" : String,
      "[NativeApplicationOidcOptions](#cfn-ec2-verifiedaccesstrustprovider-nativeapplicationoidcoptions)" : NativeApplicationOidcOptions,
      "[OidcOptions](#cfn-ec2-verifiedaccesstrustprovider-oidcoptions)" : OidcOptions,
      "[PolicyReferenceName](#cfn-ec2-verifiedaccesstrustprovider-policyreferencename)" : String,
      "[SseSpecification](#cfn-ec2-verifiedaccesstrustprovider-ssespecification)" : SseSpecification,
      "[Tags](#cfn-ec2-verifiedaccesstrustprovider-tags)" : [ Tag, ... ],
      "[TrustProviderType](#cfn-ec2-verifiedaccesstrustprovider-trustprovidertype)" : String,
      "[UserTrustProviderType](#cfn-ec2-verifiedaccesstrustprovider-usertrustprovidertype)" : String
    }
}
```

### YAML
<a name="aws-resource-ec2-verifiedaccesstrustprovider-syntax.yaml"></a>

```
Type: AWS::EC2::VerifiedAccessTrustProvider
Properties:
  [Description](#cfn-ec2-verifiedaccesstrustprovider-description): String
  [DeviceOptions](#cfn-ec2-verifiedaccesstrustprovider-deviceoptions): 
    DeviceOptions
  [DeviceTrustProviderType](#cfn-ec2-verifiedaccesstrustprovider-devicetrustprovidertype): String
  [NativeApplicationOidcOptions](#cfn-ec2-verifiedaccesstrustprovider-nativeapplicationoidcoptions): 
    NativeApplicationOidcOptions
  [OidcOptions](#cfn-ec2-verifiedaccesstrustprovider-oidcoptions): 
    OidcOptions
  [PolicyReferenceName](#cfn-ec2-verifiedaccesstrustprovider-policyreferencename): String
  [SseSpecification](#cfn-ec2-verifiedaccesstrustprovider-ssespecification): 
    SseSpecification
  [Tags](#cfn-ec2-verifiedaccesstrustprovider-tags): 
    - Tag
  [TrustProviderType](#cfn-ec2-verifiedaccesstrustprovider-trustprovidertype): String
  [UserTrustProviderType](#cfn-ec2-verifiedaccesstrustprovider-usertrustprovidertype): String
```

## Properties
<a name="aws-resource-ec2-verifiedaccesstrustprovider-properties"></a>

`Description`  <a name="cfn-ec2-verifiedaccesstrustprovider-description"></a>
A description for the AWS Verified Access trust provider.  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`DeviceOptions`  <a name="cfn-ec2-verifiedaccesstrustprovider-deviceoptions"></a>
The options for device-identity trust provider.  
*Required*: No  
*Type*: [DeviceOptions](aws-properties-ec2-verifiedaccesstrustprovider-deviceoptions.md)  
*Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

`DeviceTrustProviderType`  <a name="cfn-ec2-verifiedaccesstrustprovider-devicetrustprovidertype"></a>
The type of device-based trust provider.  
*Required*: No  
*Type*: String  
*Allowed values*: `jamf | crowdstrike | jumpcloud`  
*Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

`NativeApplicationOidcOptions`  <a name="cfn-ec2-verifiedaccesstrustprovider-nativeapplicationoidcoptions"></a>
The OpenID Connect (OIDC) options.  
*Required*: No  
*Type*: [NativeApplicationOidcOptions](aws-properties-ec2-verifiedaccesstrustprovider-nativeapplicationoidcoptions.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`OidcOptions`  <a name="cfn-ec2-verifiedaccesstrustprovider-oidcoptions"></a>
The options for an OpenID Connect-compatible user-identity trust provider.  
*Required*: No  
*Type*: [OidcOptions](aws-properties-ec2-verifiedaccesstrustprovider-oidcoptions.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`PolicyReferenceName`  <a name="cfn-ec2-verifiedaccesstrustprovider-policyreferencename"></a>
The identifier to be used when working with policy rules.  
*Required*: Yes  
*Type*: String  
*Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

`SseSpecification`  <a name="cfn-ec2-verifiedaccesstrustprovider-ssespecification"></a>
 The options for additional server side encryption.   
*Required*: No  
*Type*: [SseSpecification](aws-properties-ec2-verifiedaccesstrustprovider-ssespecification.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Tags`  <a name="cfn-ec2-verifiedaccesstrustprovider-tags"></a>
The tags.  
*Required*: No  
*Type*: Array of [Tag](aws-properties-ec2-verifiedaccesstrustprovider-tag.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`TrustProviderType`  <a name="cfn-ec2-verifiedaccesstrustprovider-trustprovidertype"></a>
The type of Verified Access trust provider.  
*Required*: Yes  
*Type*: String  
*Allowed values*: `user | device`  
*Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

`UserTrustProviderType`  <a name="cfn-ec2-verifiedaccesstrustprovider-usertrustprovidertype"></a>
The type of user-based trust provider.  
*Required*: No  
*Type*: String  
*Allowed values*: `iam-identity-center | oidc`  
*Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

## Return values
<a name="aws-resource-ec2-verifiedaccesstrustprovider-return-values"></a>

### Ref
<a name="aws-resource-ec2-verifiedaccesstrustprovider-return-values-ref"></a>

When you pass the logical ID of this resource to the intrinsic `Ref` function, `Ref` returns the ID of the Verified Access trust provider.

For more information about using the `Ref` function, see [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-ref.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-ref.html).

### Fn::GetAtt
<a name="aws-resource-ec2-verifiedaccesstrustprovider-return-values-fn--getatt"></a>

The `Fn::GetAtt` intrinsic function returns a value for a specified attribute of this type. The following are the available attributes and sample return values.

For more information about using the `Fn::GetAtt` intrinsic function, see [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-getatt.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-getatt.html).

#### 
<a name="aws-resource-ec2-verifiedaccesstrustprovider-return-values-fn--getatt-fn--getatt"></a>

`CreationTime`  <a name="CreationTime-fn::getatt"></a>
The creation time.

`LastUpdatedTime`  <a name="LastUpdatedTime-fn::getatt"></a>
The last updated time.

`VerifiedAccessTrustProviderId`  <a name="VerifiedAccessTrustProviderId-fn::getatt"></a>
The ID of the Verified Access trust provider.

# AWS::EC2::VerifiedAccessTrustProvider DeviceOptions
<a name="aws-properties-ec2-verifiedaccesstrustprovider-deviceoptions"></a>

Describes the options for an AWS Verified Access device-identity based trust provider.

## Syntax
<a name="aws-properties-ec2-verifiedaccesstrustprovider-deviceoptions-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-ec2-verifiedaccesstrustprovider-deviceoptions-syntax.json"></a>

```
{
  "[PublicSigningKeyUrl](#cfn-ec2-verifiedaccesstrustprovider-deviceoptions-publicsigningkeyurl)" : String,
  "[TenantId](#cfn-ec2-verifiedaccesstrustprovider-deviceoptions-tenantid)" : String
}
```

### YAML
<a name="aws-properties-ec2-verifiedaccesstrustprovider-deviceoptions-syntax.yaml"></a>

```
  [PublicSigningKeyUrl](#cfn-ec2-verifiedaccesstrustprovider-deviceoptions-publicsigningkeyurl): String
  [TenantId](#cfn-ec2-verifiedaccesstrustprovider-deviceoptions-tenantid): String
```

## Properties
<a name="aws-properties-ec2-verifiedaccesstrustprovider-deviceoptions-properties"></a>

`PublicSigningKeyUrl`  <a name="cfn-ec2-verifiedaccesstrustprovider-deviceoptions-publicsigningkeyurl"></a>
 The URL AWS Verified Access will use to verify the authenticity of the device tokens.   
*Required*: No  
*Type*: String  
*Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

`TenantId`  <a name="cfn-ec2-verifiedaccesstrustprovider-deviceoptions-tenantid"></a>
The ID of the tenant application with the device-identity provider.  
*Required*: No  
*Type*: String  
*Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

# AWS::EC2::VerifiedAccessTrustProvider NativeApplicationOidcOptions
<a name="aws-properties-ec2-verifiedaccesstrustprovider-nativeapplicationoidcoptions"></a>

Describes the OpenID Connect (OIDC) options.

## Syntax
<a name="aws-properties-ec2-verifiedaccesstrustprovider-nativeapplicationoidcoptions-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-ec2-verifiedaccesstrustprovider-nativeapplicationoidcoptions-syntax.json"></a>

```
{
  "[AuthorizationEndpoint](#cfn-ec2-verifiedaccesstrustprovider-nativeapplicationoidcoptions-authorizationendpoint)" : String,
  "[ClientId](#cfn-ec2-verifiedaccesstrustprovider-nativeapplicationoidcoptions-clientid)" : String,
  "[ClientSecret](#cfn-ec2-verifiedaccesstrustprovider-nativeapplicationoidcoptions-clientsecret)" : String,
  "[Issuer](#cfn-ec2-verifiedaccesstrustprovider-nativeapplicationoidcoptions-issuer)" : String,
  "[PublicSigningKeyEndpoint](#cfn-ec2-verifiedaccesstrustprovider-nativeapplicationoidcoptions-publicsigningkeyendpoint)" : String,
  "[Scope](#cfn-ec2-verifiedaccesstrustprovider-nativeapplicationoidcoptions-scope)" : String,
  "[TokenEndpoint](#cfn-ec2-verifiedaccesstrustprovider-nativeapplicationoidcoptions-tokenendpoint)" : String,
  "[UserInfoEndpoint](#cfn-ec2-verifiedaccesstrustprovider-nativeapplicationoidcoptions-userinfoendpoint)" : String
}
```

### YAML
<a name="aws-properties-ec2-verifiedaccesstrustprovider-nativeapplicationoidcoptions-syntax.yaml"></a>

```
  [AuthorizationEndpoint](#cfn-ec2-verifiedaccesstrustprovider-nativeapplicationoidcoptions-authorizationendpoint): String
  [ClientId](#cfn-ec2-verifiedaccesstrustprovider-nativeapplicationoidcoptions-clientid): String
  [ClientSecret](#cfn-ec2-verifiedaccesstrustprovider-nativeapplicationoidcoptions-clientsecret): String
  [Issuer](#cfn-ec2-verifiedaccesstrustprovider-nativeapplicationoidcoptions-issuer): String
  [PublicSigningKeyEndpoint](#cfn-ec2-verifiedaccesstrustprovider-nativeapplicationoidcoptions-publicsigningkeyendpoint): String
  [Scope](#cfn-ec2-verifiedaccesstrustprovider-nativeapplicationoidcoptions-scope): String
  [TokenEndpoint](#cfn-ec2-verifiedaccesstrustprovider-nativeapplicationoidcoptions-tokenendpoint): String
  [UserInfoEndpoint](#cfn-ec2-verifiedaccesstrustprovider-nativeapplicationoidcoptions-userinfoendpoint): String
```

## Properties
<a name="aws-properties-ec2-verifiedaccesstrustprovider-nativeapplicationoidcoptions-properties"></a>

`AuthorizationEndpoint`  <a name="cfn-ec2-verifiedaccesstrustprovider-nativeapplicationoidcoptions-authorizationendpoint"></a>
The authorization endpoint of the IdP.  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`ClientId`  <a name="cfn-ec2-verifiedaccesstrustprovider-nativeapplicationoidcoptions-clientid"></a>
The OAuth 2.0 client identifier.  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`ClientSecret`  <a name="cfn-ec2-verifiedaccesstrustprovider-nativeapplicationoidcoptions-clientsecret"></a>
The OAuth 2.0 client secret.  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Issuer`  <a name="cfn-ec2-verifiedaccesstrustprovider-nativeapplicationoidcoptions-issuer"></a>
The OIDC issuer identifier of the IdP.  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`PublicSigningKeyEndpoint`  <a name="cfn-ec2-verifiedaccesstrustprovider-nativeapplicationoidcoptions-publicsigningkeyendpoint"></a>
The public signing key endpoint.  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Scope`  <a name="cfn-ec2-verifiedaccesstrustprovider-nativeapplicationoidcoptions-scope"></a>
The set of user claims to be requested from the IdP.  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`TokenEndpoint`  <a name="cfn-ec2-verifiedaccesstrustprovider-nativeapplicationoidcoptions-tokenendpoint"></a>
The token endpoint of the IdP.  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`UserInfoEndpoint`  <a name="cfn-ec2-verifiedaccesstrustprovider-nativeapplicationoidcoptions-userinfoendpoint"></a>
The user info endpoint of the IdP.  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::EC2::VerifiedAccessTrustProvider OidcOptions
<a name="aws-properties-ec2-verifiedaccesstrustprovider-oidcoptions"></a>

Describes the options for an OpenID Connect-compatible user-identity trust provider.

## Syntax
<a name="aws-properties-ec2-verifiedaccesstrustprovider-oidcoptions-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-ec2-verifiedaccesstrustprovider-oidcoptions-syntax.json"></a>

```
{
  "[AuthorizationEndpoint](#cfn-ec2-verifiedaccesstrustprovider-oidcoptions-authorizationendpoint)" : String,
  "[ClientId](#cfn-ec2-verifiedaccesstrustprovider-oidcoptions-clientid)" : String,
  "[ClientSecret](#cfn-ec2-verifiedaccesstrustprovider-oidcoptions-clientsecret)" : String,
  "[Issuer](#cfn-ec2-verifiedaccesstrustprovider-oidcoptions-issuer)" : String,
  "[Scope](#cfn-ec2-verifiedaccesstrustprovider-oidcoptions-scope)" : String,
  "[TokenEndpoint](#cfn-ec2-verifiedaccesstrustprovider-oidcoptions-tokenendpoint)" : String,
  "[UserInfoEndpoint](#cfn-ec2-verifiedaccesstrustprovider-oidcoptions-userinfoendpoint)" : String
}
```

### YAML
<a name="aws-properties-ec2-verifiedaccesstrustprovider-oidcoptions-syntax.yaml"></a>

```
  [AuthorizationEndpoint](#cfn-ec2-verifiedaccesstrustprovider-oidcoptions-authorizationendpoint): String
  [ClientId](#cfn-ec2-verifiedaccesstrustprovider-oidcoptions-clientid): String
  [ClientSecret](#cfn-ec2-verifiedaccesstrustprovider-oidcoptions-clientsecret): String
  [Issuer](#cfn-ec2-verifiedaccesstrustprovider-oidcoptions-issuer): String
  [Scope](#cfn-ec2-verifiedaccesstrustprovider-oidcoptions-scope): String
  [TokenEndpoint](#cfn-ec2-verifiedaccesstrustprovider-oidcoptions-tokenendpoint): String
  [UserInfoEndpoint](#cfn-ec2-verifiedaccesstrustprovider-oidcoptions-userinfoendpoint): String
```

## Properties
<a name="aws-properties-ec2-verifiedaccesstrustprovider-oidcoptions-properties"></a>

`AuthorizationEndpoint`  <a name="cfn-ec2-verifiedaccesstrustprovider-oidcoptions-authorizationendpoint"></a>
The OIDC authorization endpoint.  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`ClientId`  <a name="cfn-ec2-verifiedaccesstrustprovider-oidcoptions-clientid"></a>
The client identifier.  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`ClientSecret`  <a name="cfn-ec2-verifiedaccesstrustprovider-oidcoptions-clientsecret"></a>
The client secret.  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Issuer`  <a name="cfn-ec2-verifiedaccesstrustprovider-oidcoptions-issuer"></a>
The OIDC issuer.  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Scope`  <a name="cfn-ec2-verifiedaccesstrustprovider-oidcoptions-scope"></a>
The OpenID Connect (OIDC) scope specified.  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`TokenEndpoint`  <a name="cfn-ec2-verifiedaccesstrustprovider-oidcoptions-tokenendpoint"></a>
The OIDC token endpoint.  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`UserInfoEndpoint`  <a name="cfn-ec2-verifiedaccesstrustprovider-oidcoptions-userinfoendpoint"></a>
The OIDC user info endpoint.  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::EC2::VerifiedAccessTrustProvider SseSpecification
<a name="aws-properties-ec2-verifiedaccesstrustprovider-ssespecification"></a>

AWS Verified Access provides server side encryption by default to data at rest using AWS-owned KMS keys. You also have the option of using customer managed KMS keys, which can be specified using the options below. 

## Syntax
<a name="aws-properties-ec2-verifiedaccesstrustprovider-ssespecification-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-ec2-verifiedaccesstrustprovider-ssespecification-syntax.json"></a>

```
{
  "[CustomerManagedKeyEnabled](#cfn-ec2-verifiedaccesstrustprovider-ssespecification-customermanagedkeyenabled)" : Boolean,
  "[KmsKeyArn](#cfn-ec2-verifiedaccesstrustprovider-ssespecification-kmskeyarn)" : String
}
```

### YAML
<a name="aws-properties-ec2-verifiedaccesstrustprovider-ssespecification-syntax.yaml"></a>

```
  [CustomerManagedKeyEnabled](#cfn-ec2-verifiedaccesstrustprovider-ssespecification-customermanagedkeyenabled): Boolean
  [KmsKeyArn](#cfn-ec2-verifiedaccesstrustprovider-ssespecification-kmskeyarn): String
```

## Properties
<a name="aws-properties-ec2-verifiedaccesstrustprovider-ssespecification-properties"></a>

`CustomerManagedKeyEnabled`  <a name="cfn-ec2-verifiedaccesstrustprovider-ssespecification-customermanagedkeyenabled"></a>
 Enable or disable the use of customer managed KMS keys for server side encryption.   
Valid values: `True` \$1 `False`  
*Required*: No  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`KmsKeyArn`  <a name="cfn-ec2-verifiedaccesstrustprovider-ssespecification-kmskeyarn"></a>
 The ARN of the KMS key.   
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::EC2::VerifiedAccessTrustProvider Tag
<a name="aws-properties-ec2-verifiedaccesstrustprovider-tag"></a>

Specifies a tag. For more information, see [Resource tags](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html).

## Syntax
<a name="aws-properties-ec2-verifiedaccesstrustprovider-tag-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-ec2-verifiedaccesstrustprovider-tag-syntax.json"></a>

```
{
  "[Key](#cfn-ec2-verifiedaccesstrustprovider-tag-key)" : String,
  "[Value](#cfn-ec2-verifiedaccesstrustprovider-tag-value)" : String
}
```

### YAML
<a name="aws-properties-ec2-verifiedaccesstrustprovider-tag-syntax.yaml"></a>

```
  [Key](#cfn-ec2-verifiedaccesstrustprovider-tag-key): String
  [Value](#cfn-ec2-verifiedaccesstrustprovider-tag-value): String
```

## Properties
<a name="aws-properties-ec2-verifiedaccesstrustprovider-tag-properties"></a>

`Key`  <a name="cfn-ec2-verifiedaccesstrustprovider-tag-key"></a>
The tag key.  
*Required*: Yes  
*Type*: String  
*Minimum*: `1`  
*Maximum*: `128`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Value`  <a name="cfn-ec2-verifiedaccesstrustprovider-tag-value"></a>
The tag value.  
*Required*: Yes  
*Type*: String  
*Minimum*: `0`  
*Maximum*: `256`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

## Examples
<a name="aws-properties-ec2-verifiedaccesstrustprovider-tag--examples"></a>

### 
<a name="aws-properties-ec2-verifiedaccesstrustprovider-tag--examples--"></a>

This example specifies two tags for the Verified Access trust provider.

#### JSON
<a name="aws-properties-ec2-verifiedaccesstrustprovider-tag--examples----json"></a>

```
"Tags" : [
   {
      "Key" : "key1",
      "Value" : "value1"
   },
   {
      "Key" : "key2",
      "Value" : "value2"
   }
]
```

#### YAML
<a name="aws-properties-ec2-verifiedaccesstrustprovider-tag--examples----yaml"></a>

```
Tags: 
  - Key: "key1"
    Value: "value1"
  - Key: "key2"
    Value: "value2"
```