KMS CDK Construct Library

City of Philadelphia Key Management Service for encryption

Overview

This CDK construct library provides a reusable AWS KMS key for encryption. It creates a KMS key with automatic key rotation enabled, proper alias management, and NIST 800-53 Rev 5 compliance configurations.

Installation

npm install @phila/cdk-kms

Usage

import { Stack } from "aws-cdk-lib";

import { KmsConstruct } from "@phila/cdk-kms";

import { Compliance, Confidentiality } from "../../_shared/GlobalProps.js";

const stack = new Stack(app, "MyStack");

const kmsConstruct = new KmsConstruct(stack, "MyKmsKey", {
  project: "my-project",
  environment: "production",
  department: "4-oit",
  team: "Platform Engineering",
  contact: "[email protected]",
  compliance: Compliance.STANDARD,
  confidentiality: Confidentiality.MEDIUM,
  tags: {
    Example: "Example tag",
  },
});

// Access the created KMS key
console.log(kmsConstruct.kmsKey.keyArn);
console.log(kmsConstruct.output.kmsKeyAlias);

Features

• KMS Key: Creates a KMS key with automatic key rotation enabled
• Key Alias: Automatically creates an alias in the format alias/{project}-{environment}-kms-key
• Environment-based Removal Policy: RETAIN in production, DESTROY in non-production environments
• CDK Outputs: Exposes KMS key ARN and alias as CloudFormation outputs
• Compliance: NIST 800-53 Rev 5 compliant configurations

Props

The construct requires GlobalProps. For complete documentation on GlobalProps, including all properties, enums, and usage examples, see the Shared CDK Construct Library documentation.

Outputs

The construct exposes:

• kmsKey: Key - The AWS KMS key instance
• output.kmsKeyArn: string - The ARN of the KMS key
• output.kmsKeyAlias: string - The alias of the KMS key (format: alias/{project}-{environment}-kms-key)

Development

Prerequisites

• Node.js 22+
• pnpm
• AWS CDK CLI

Commands

• pnpm run build - Build the library
• pnpm run watch - Build in watch mode
• pnpm run test - Run tests
• pnpm run lint - Lint code
• pnpm run format - Format code