# ZoneSigningOptions

Options for enabling key signing from a hosted zone.

- Source: [`aws-route53/lib/hosted-zone.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-route53/lib/hosted-zone.ts#L81)
- Type last changed: v2.138.0 · 18 Apr 2024

## Example

```ts
const kmsKey = new kms.Key(this, 'KmsCMK', {
  keySpec: kms.KeySpec.ECC_NIST_P256,
  keyUsage: kms.KeyUsage.SIGN_VERIFY,
});
const hostedZone = new route53.HostedZone(this, 'HostedZone', {
  zoneName: 'example.com',
});
// Enable DNSSEC signing for the zone
hostedZone.enableDnssec({ kmsKey });
```

## Properties

- `keySigningKeyName`: string — The name for the key signing key.

  **Default:** an autogenerated name

  This name must be unique within a hosted zone.

- `kmsKey`: [IKey](/cdk/api/v2/docs/aws-cdk-lib.aws_kms.IKey.html) (required) — The customer-managed KMS key that will be used to sign the records.

  The KMS Key must be unique for each KSK within a hosted zone. Additionally, the
  KMS key must be an asymetric customer-managed key using the ECC_NIST_P256 algorithm.