如何使用 Cloudformation 创建 KMS 非对称签名密钥资源？

Question

I've tried the following resource in my template:

  SigningKey:
    Type: AWS::KMS::Key
    Properties:
      Description: "Auth API signing key"
      Enabled: true
      # Grant all permissions for root account
      KeyPolicy:
        Version: "2012-10-17"
        Id: "key-default-1"
        Statement:
          -
            Sid: "Enable IAM User Permissions"
            Effect: "Allow"
            Principal:
              - AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root"
            Action: "kms:*"
            Resource: "*"
      EnableKeyRotation: true
      KeyUsage: SIGN_VERIFY

But this gives an error:

The operation failed because the KeyUsage value of the CMK is SIGN_VERIFY. To perform this operation, the KeyUsage value must be ENCRYPT_DECRYPT.

It's also unclear where to specify the key type (eg. RSA_2048 ) in the template from the docs .

Answer 1

According to AWS CloudFormation , you specify key type in KeySpec field. You can also see what types are currently supported in the document. Also, AWS KMS does not support automatic key rotation on asymmetric CMKs. For asymmetric CMKs, omit the EnableKeyRotation property or set it to false. Above doc also has example to create asymmetric CMKs that you can refer.