{
  "name": "kms-key",
  "version": "1.0.0",
  "kind": "l1",
  "type": "aws:kms:key",
  "description": "A customer-managed KMS key for per-stack encryption. Created with key rotation enabled. One key per L2 deployment (no shared keys).",
  "inputs": {
    "description": {
      "type": "string",
      "description": "Description of the KMS key.",
      "required": true
    },
    "region": {
      "type": "string",
      "description": "AWS region the KMS key is created in.",
      "required": true
    },
    "deletion_window_days": {
      "type": "number",
      "description": "Number of days before the key is deleted after deletion is requested (default 30).",
      "required": false,
      "default": 30
    }
  },
  "outputs": {
    "kms_key_arn": {
      "type": "arn",
      "description": "The ARN of the KMS key."
    },
    "kms_key_id": {
      "type": "string",
      "description": "The ID of the KMS key."
    }
  },
  "nfrs": {
    "enable_rotation": {
      "type": "boolean",
      "description": "Enable automatic key rotation.",
      "default": true
    },
    "deletion_protection": {
      "type": "boolean",
      "description": "Prevent key destruction.",
      "default": true
    },
    "encryption_enabled": {
      "type": "boolean",
      "description": "Encryption is always enabled for a KMS key.",
      "default": true
    }
  }
}