AWS KMS ARN a secret?

Question

I am enabling the SSE KMS encryption on my S3 buckets. I am doing this by adding the BucketEncryption property of S3 bucket in my Cloudformation template.

What is the best practice?

This property asks KMS ARN as a value. I am using AWS manages KMS key. Is it safe to hardcode that ARN in the Cloudformation template?

Answer 1

Generally its fine to hard-code the value if it is constant. But if you want to redeploy your template in different regions or accounts, it would be better to parametrize the ARN to make your template more portable.