AWS Virtual Keys

AWS services already integrate with KMS. A Virtual Key lets them keep using that interface while Alien serves the external key material through AWS KMS External Key Store (XKS).

Create the key with the module shown in the dashboard:

module "encryption_key" {
  source  = "pkg.alien.dev/alien/virtual-key/aws"
  version = "0.1.0"

  deployment_id = "dep_example"
  alias         = "customer-data"
}

output "kms_key_arn" {
  value = module.encryption_key.kms_key_arn
}

Then pass the resulting KMS key ARN to an AWS resource exactly as you would any other customer-managed key:

resource "aws_s3_bucket_server_side_encryption_configuration" "documents" {
  bucket = aws_s3_bucket.documents.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm     = "aws:kms"
      kms_master_key_id = module.encryption_key.kms_key_arn
    }
  }
}

The same key ARN can be used by Aurora, EBS, or a direct aws kms encrypt call. AWS KMS calls Alien on the encryption path; your application does not call /v1/encrypt for these resources.