Skip to content

CreateKeySigningKeyRequest

Source code in docs_src/capo_route_53/types/create_key_signing_key_request.py 
18
19
20
21
22
23
24
25
26
27
28
29
30
class CreateKeySigningKeyRequest(TypedDict, closed=True):
    caller_reference: "capo_route_53.types.nonce.Nonce"
    """<p>A unique string that identifies the request.</p>"""
    hosted_zone_id: "capo_route_53.types.resource_id.ResourceId"
    """<p>The unique string (ID) used to identify a hosted zone.</p>"""
    key_management_service_arn: (
        "capo_route_53.types.signing_key_string.SigningKeyString"
    )
    """<p>The Amazon resource name (ARN) for a customer managed key in Key Management Service (KMS). The <code>KeyManagementServiceArn</code> must be unique for each key-signing key (KSK) in a single hosted zone. To see an example of <code>KeyManagementServiceArn</code> that grants the correct permissions for DNSSEC, scroll down to <b>Example</b>. </p> <p>You must configure the customer managed customer managed key as follows:</p> <dl> <dt>Status</dt> <dd> <p>Enabled</p> </dd> <dt>Key spec</dt> <dd> <p>ECC_NIST_P256</p> </dd> <dt>Key usage</dt> <dd> <p>Sign and verify</p> </dd> <dt>Key policy</dt> <dd> <p>The key policy must give permission for the following actions:</p> <ul> <li> <p>DescribeKey</p> </li> <li> <p>GetPublicKey</p> </li> <li> <p>Sign</p> </li> </ul> <p>The key policy must also include the Amazon Route 53 service in the principal for your account. Specify the following:</p> <ul> <li> <p> <code>"Service": "dnssec-route53.amazonaws.com"</code> </p> </li> </ul> </dd> </dl> <p>For more information about working with a customer managed key in KMS, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html">Key Management Service concepts</a>.</p>"""
    name: "capo_route_53.types.signing_key_name.SigningKeyName"
    """<p>A string used to identify a key-signing key (KSK). <code>Name</code> can include numbers, letters, and underscores (_). <code>Name</code> must be unique for each key-signing key in the same hosted zone.</p>"""
    status: "capo_route_53.types.signing_key_status.SigningKeyStatus"
    """<p>A string specifying the initial status of the key-signing key (KSK). You can set the value to <code>ACTIVE</code> or <code>INACTIVE</code>.</p>"""

caller_reference instance-attribute 

caller_reference: Nonce

A unique string that identifies the request.

hosted_zone_id instance-attribute 

hosted_zone_id: ResourceId

The unique string (ID) used to identify a hosted zone.

key_management_service_arn instance-attribute 

key_management_service_arn: SigningKeyString

The Amazon resource name (ARN) for a customer managed key in Key Management Service (KMS). The KeyManagementServiceArn must be unique for each key-signing key (KSK) in a single hosted zone. To see an example of KeyManagementServiceArn that grants the correct permissions for DNSSEC, scroll down to Example.

You must configure the customer managed customer managed key as follows:

Status

Enabled

Key spec

ECC_NIST_P256

Key usage

Sign and verify

Key policy

The key policy must give permission for the following actions:

  • DescribeKey

  • GetPublicKey

  • Sign

The key policy must also include the Amazon Route 53 service in the principal for your account. Specify the following:

  • "Service": "dnssec-route53.amazonaws.com"

For more information about working with a customer managed key in KMS, see Key Management Service concepts.

name instance-attribute 

name: SigningKeyName

A string used to identify a key-signing key (KSK). Name can include numbers, letters, and underscores (_). Name must be unique for each key-signing key in the same hosted zone.

status instance-attribute 

status: SigningKeyStatus

A string specifying the initial status of the key-signing key (KSK). You can set the value to ACTIVE or INACTIVE.