awskms

type Config struct {
	AccessKeyID        string            `hcl:"access_key_id" json:"access_key_id"`
	SecretAccessKey    string            `hcl:"secret_access_key" json:"secret_access_key"`
	Region             string            `hcl:"region" json:"region"`
	KeyIdentifierFile  string            `hcl:"key_identifier_file" json:"key_identifier_file"`
	KeyIdentifierValue string            `hcl:"key_identifier_value" json:"key_identifier_value"`
	KeyPolicyFile      string            `hcl:"key_policy_file" json:"key_policy_file"`
	KeyTags            map[string]string `hcl:"key_tags" json:"key_tags"`

	// EnableTagBasedKeyDiscovery enables the use of AWS Resource Groups Tagging API
	// for efficient key discovery instead of the legacy alias-based approach.
	// When enabled, keys are discovered using SPIRE-specific tags (spire-server-td,
	// spire-server-id, spire-active).
	// This eliminates the need for broad ListKeys + DescribeKey permissions and reduces API costs.
	//
	// Default: false (uses legacy alias-based discovery)
	// In a future SPIRE version, this will default to true. The alias-based
	// approach will be deprecated in a future version and removed in a later one.
	//
	// Note: When enabled, the plugin requires the tag:GetResources IAM
	// permission (from the AWS Resource Groups Tagging API).
	EnableTagBasedKeyDiscovery bool `hcl:"enable_tag_based_key_discovery" json:"enable_tag_based_key_discovery"`
}

type Plugin struct {
	keymanagerv1.UnsafeKeyManagerServer
	configv1.UnsafeConfigServer
	// contains filtered or unexported fields
}