AWS::IoT::EncryptionConfiguration - AWS CloudFormation
SyntaxPropertiesReturn valuesExamples

This is the new AWS CloudFormation Template Reference Guide. Please update your bookmarks and links. For help getting started with CloudFormation, see the AWS CloudFormation User Guide.

AWS::IoT::EncryptionConfiguration

Retrieves the encryption configuration for resources and data of your AWS account in AWS IoT Core. For more information, see Data encryption at rest in the AWS IoT Core Developer Guide.

Syntax

To declare this entity in your AWS CloudFormation template, use the following syntax:

JSON

{
  "Type" : "AWS::IoT::EncryptionConfiguration",
  "Properties" : {
      "EncryptionType" : String,
      "KmsAccessRoleArn" : String,
      "KmsKeyArn" : String
    }
}

YAML

Type: AWS::IoT::EncryptionConfiguration
Properties:
  EncryptionType: String
  KmsAccessRoleArn: String
  KmsKeyArn: String

Properties

EncryptionType

The type of the KMS key.

Required: Yes

Type: String

Allowed values: CUSTOMER_MANAGED_KMS_KEY | AWS_OWNED_KMS_KEY

Update requires: No interruption

KmsAccessRoleArn

The Amazon Resource Name (ARN) of the IAM role assumed by AWS IoT Core to call AWS KMS on behalf of the customer.

Required: No

Type: String

Minimum: 20

Maximum: 2048

Update requires: No interruption

KmsKeyArn

The ARN of the customer managed KMS key.

Required: No

Type: String

Minimum: 20

Maximum: 2048

Update requires: No interruption

Return values

Ref

When you pass the logical ID of this resource to the intrinsic Ref function, Ref returns the AWS account ID. For example:

{ "Ref": "MyEncryptionConfiguration" }

For more information about using the Ref function, see Ref.

Fn::GetAtt

The Fn::GetAtt intrinsic function returns a value for a specified attribute of this type. The following are the available attributes and sample return values.

For more information about using the Fn::GetAtt intrinsic function, see Fn::GetAtt.

AccountId

The unique identifier (ID) of an AWS account.

LastModifiedDate

The date when encryption configuration is last updated.

Examples

The following example creates an encryption configuration using a customer managed AWS KMS key.

JSON

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Resources": {
    "MyEncryptionConfiguration": {
      "Type": "AWS::IoT::EncryptionConfiguration",
      "Properties": {
        "EncryptionType": "CUSTOMER_MANAGED_KMS_KEY",
        "KmsKeyArn": "arn:aws:kms:us-east-1:123456789012:key/abcd1234-ab12-cd34-ef56-abcdef123456",
        "KmsAccessRoleArn": "arn:aws:iam::123456789012:role/IoTKmsAccessRole"
      }
    }
  }
}

YAML

AWSTemplateFormatVersion: '2010-09-09'
Resources:
  MyEncryptionConfiguration:
    Type: AWS::IoT::EncryptionConfiguration
    Properties:
      EncryptionType: CUSTOMER_MANAGED_KMS_KEY
      KmsKeyArn: arn:aws:kms:us-east-1:123456789012:key/abcd1234-ab12-cd34-ef56-abcdef123456
      KmsAccessRoleArn: arn:aws:iam::123456789012:role/IoTKmsAccessRole