AWS::IoT::EncryptionConfiguration - Amazon CloudFormation
SyntaxPropertiesReturn valuesExamples
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

This is the new Amazon CloudFormation Template Reference Guide. Please update your bookmarks and links. For help getting started with CloudFormation, see the Amazon CloudFormation User Guide.

AWS::IoT::EncryptionConfiguration

Retrieves the encryption configuration for resources and data of your Amazon Web Services account in Amazon IoT Core. For more information, see Data encryption at rest in the Amazon IoT Core Developer Guide.

Syntax

To declare this entity in your Amazon CloudFormation template, use the following syntax:

JSON

{
  "Type" : "AWS::IoT::EncryptionConfiguration",
  "Properties" : {
      "EncryptionType" : String,
      "KmsAccessRoleArn" : String,
      "KmsKeyArn" : String
    }
}

YAML

Type: AWS::IoT::EncryptionConfiguration
Properties:
  EncryptionType: String
  KmsAccessRoleArn: String
  KmsKeyArn: String

Properties

EncryptionType

The type of the KMS key.

Required: Yes

Type: String

Allowed values: CUSTOMER_MANAGED_KMS_KEY | AWS_OWNED_KMS_KEY

Update requires: No interruption

KmsAccessRoleArn

The Amazon Resource Name (ARN) of the IAM role assumed by Amazon IoT Core to call Amazon KMS on behalf of the customer.

Required: No

Type: String

Minimum: 20

Maximum: 2048

Update requires: No interruption

KmsKeyArn

The ARN of the customer managed KMS key.

Required: No

Type: String

Minimum: 20

Maximum: 2048

Update requires: No interruption

Return values

Ref

When you pass the logical ID of this resource to the intrinsic Ref function, Ref returns the Amazon account ID. For example:

{ "Ref": "MyEncryptionConfiguration" }

For more information about using the Ref function, see Ref.

Fn::GetAtt

The Fn::GetAtt intrinsic function returns a value for a specified attribute of this type. The following are the available attributes and sample return values.

For more information about using the Fn::GetAtt intrinsic function, see Fn::GetAtt.

AccountId

The unique identifier (ID) of an Amazon account.

LastModifiedDate

The date when encryption configuration is last updated.

Examples

The following example creates an encryption configuration using a customer managed Amazon KMS key.

JSON

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Resources": {
    "MyEncryptionConfiguration": {
      "Type": "AWS::IoT::EncryptionConfiguration",
      "Properties": {
        "EncryptionType": "CUSTOMER_MANAGED_KMS_KEY",
        "KmsKeyArn": "arn:aws:kms:us-east-1:123456789012:key/abcd1234-ab12-cd34-ef56-abcdef123456",
        "KmsAccessRoleArn": "arn:aws:iam::123456789012:role/IoTKmsAccessRole"
      }
    }
  }
}

YAML

AWSTemplateFormatVersion: '2010-09-09'
Resources:
  MyEncryptionConfiguration:
    Type: AWS::IoT::EncryptionConfiguration
    Properties:
      EncryptionType: CUSTOMER_MANAGED_KMS_KEY
      KmsKeyArn: arn:aws:kms:us-east-1:123456789012:key/abcd1234-ab12-cd34-ef56-abcdef123456
      KmsAccessRoleArn: arn:aws:iam::123456789012:role/IoTKmsAccessRole