first steps for kms key-ring resource and datasource

docs/data-sources/kms_key.md

@@ -0,0 +1,36 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "stackit_kms_key Data Source - stackit"
+subcategory: ""
+description: |-
+  KMS Key resource schema. Must have a region specified in the provider configuration.
+---
+
+# stackit_kms_key (Data Source)
+
+KMS Key resource schema. Must have a `region` specified in the provider configuration.
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `algorithm` (String) The encryption algorithm that the key will use to encrypt data
+- `backend` (String) The backend that is used for KMS. Right now, only software is accepted.
+- `display_name` (String) The display name to distinguish multiple keys
+- `import_only` (Boolean) Terraform's internal resource ID. It is structured as "`project_id`,`instance_id`".
+- `key_id` (String)
+- `key_ring_id` (String) The ID of the associated key ring
+- `project_id` (String) STACKIT project ID to which the key ring is associated.
+- `purpose` (String) The purpose for which the key will be used
+
+### Optional
+
+- `description` (String) A user chosen description to distinguish multiple keys
+- `region` (String) The resource region. If not defined, the provider region is used.
+
+### Read-Only
+
+- `id` (String) Terraform's internal resource ID. It is structured as "`project_id`,`instance_id`".

docs/data-sources/kms_key_ring.md

@@ -0,0 +1,31 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "stackit_kms_key_ring Data Source - stackit"
+subcategory: ""
+description: |-
+  KMS Key Ring resource schema.
+---
+
+# stackit_kms_key_ring (Data Source)
+
+KMS Key Ring resource schema.
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `display_name` (String) A user chosen description to distinguish multiple key rings.
+- `key_ring_id` (String) An auto generated unique id which identifies the key ring.
+- `project_id` (String) STACKIT project ID to which the key ring is associated.
+
+### Optional
+
+- `description` (String) A user chosen description to distinguish multiple key rings.
+- `region` (String) The resource region. If not defined, the provider region is used.
+
+### Read-Only
+
+- `id` (String) Terraform's internal resource ID. It is structured as "`project_id`,`instance_id`".

docs/data-sources/kms_wrapping_key.md

@@ -0,0 +1,35 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "stackit_kms_wrapping_key Data Source - stackit"
+subcategory: ""
+description: |-
+  KMS Key resource schema. Must have a region specified in the provider configuration.
+---
+
+# stackit_kms_wrapping_key (Data Source)
+
+KMS Key resource schema. Must have a `region` specified in the provider configuration.
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `algorithm` (String) The encryption algorithm that the key will use to encrypt data
+- `backend` (String) The backend that is used for KMS. Right now, only software is accepted.
+- `display_name` (String) The display name to distinguish multiple keys
+- `key_ring_id` (String) The ID of the associated key ring
+- `project_id` (String) STACKIT project ID to which the key ring is associated.
+- `purpose` (String) The purpose for which the key will be used
+- `wrapping_key_id` (String)
+
+### Optional
+
+- `description` (String) A user chosen description to distinguish multiple keys
+- `region` (String) The resource region. If not defined, the provider region is used.
+
+### Read-Only
+
+- `id` (String) Terraform's internal resource ID. It is structured as "`project_id`,`instance_id`".

docs/index.md

@@ -162,6 +162,7 @@ Note: AWS specific checks must be skipped as they do not work on STACKIT. For de
 - `experiments` (List of String) Enables experiments. These are unstable features without official support. More information can be found in the README. Available Experiments: iam, routing-tables, network
 - `git_custom_endpoint` (String) Custom endpoint for the Git service
 - `iaas_custom_endpoint` (String) Custom endpoint for the IaaS service
+- `kms_custom_endpoint` (List of String) Custom endpoint for the KMS service
 - `loadbalancer_custom_endpoint` (String) Custom endpoint for the Load Balancer service
 - `logme_custom_endpoint` (String) Custom endpoint for the LogMe service
 - `mariadb_custom_endpoint` (String) Custom endpoint for the MariaDB service

docs/resources/kms_key.md

@@ -0,0 +1,49 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "stackit_kms_key Resource - stackit"
+subcategory: ""
+description: |-
+  KMS Key resource schema. Must have a region specified in the provider configuration.
+---
+
+# stackit_kms_key (Resource)
+
+KMS Key resource schema. Must have a `region` specified in the provider configuration.
+
+## Example Usage
+
+```terraform
+resource "stackit_kms_key" "name" {
+  algorithm    = "example algorithm"
+  backend      = "software"
+  description  = "new descr"
+  display_name = "example name"
+  import_only  = false
+  key_ring_id  = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  project_id   = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  purpose      = "example purpose"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `algorithm` (String) The encryption algorithm that the key will use to encrypt data
+- `backend` (String) The backend that is used for KMS. Right now, only software is accepted.
+- `display_name` (String) The display name to distinguish multiple keys
+- `import_only` (Boolean) Terraform's internal resource ID. It is structured as "`project_id`,`instance_id`".
+- `key_ring_id` (String) The ID of the associated key ring
+- `project_id` (String) STACKIT project ID to which the key ring is associated.
+- `purpose` (String) The purpose for which the key will be used
+
+### Optional
+
+- `description` (String) A user chosen description to distinguish multiple keys
+- `region` (String) The resource region. If not defined, the provider region is used.
+
+### Read-Only
+
+- `id` (String) Terraform's internal resource ID. It is structured as "`project_id`,`instance_id`".
+- `key_id` (String) The ID of the key

docs/resources/kms_key_ring.md

@@ -0,0 +1,40 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "stackit_kms_key_ring Resource - stackit"
+subcategory: ""
+description: |-
+  KMS Key Ring resource schema. Must have a region specified in the provider configuration.
+---
+
+# stackit_kms_key_ring (Resource)
+
+KMS Key Ring resource schema. Must have a `region` specified in the provider configuration.
+
+## Example Usage
+
+```terraform
+resource "stackit_kms_key_ring" "example" {
+  description  = "example description"
+  display_name = "example name"
+  project_id   = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  region_id    = "eu01"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `display_name` (String) A user chosen description to distinguish multiple key rings.
+- `project_id` (String) STACKIT project ID to which the key ring is associated.
+
+### Optional
+
+- `description` (String) A user chosen description to distinguish multiple key rings.
+- `region` (String) The resource region. If not defined, the provider region is used.
+
+### Read-Only
+
+- `id` (String) Terraform's internal resource ID. It is structured as "`project_id`,`instance_id`".
+- `key_ring_id` (String) An auto generated unique id which identifies the key ring.

docs/resources/kms_wrapping_key.md

@@ -0,0 +1,47 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "stackit_kms_wrapping_key Resource - stackit"
+subcategory: ""
+description: |-
+  KMS Key resource schema. Must have a region specified in the provider configuration.
+---
+
+# stackit_kms_wrapping_key (Resource)
+
+KMS Key resource schema. Must have a `region` specified in the provider configuration.
+
+## Example Usage
+
+```terraform
+resource "stackit_kms_wrapping_key" "name" {
+  algorithm    = "example algorithm"
+  backend      = "software"
+  description  = "new descr"
+  display_name = "example name"
+  key_ring_id  = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  project_id   = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  purpose      = "example purpose"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `algorithm` (String) The encryption algorithm that the key will use to encrypt data
+- `backend` (String) The backend that is used for KMS. Right now, only software is accepted.
+- `display_name` (String) The display name to distinguish multiple keys
+- `key_ring_id` (String) The ID of the associated key ring
+- `project_id` (String) STACKIT project ID to which the key ring is associated.
+- `purpose` (String) The purpose for which the key will be used
+
+### Optional
+
+- `description` (String) A user chosen description to distinguish multiple keys
+- `region` (String) The resource region. If not defined, the provider region is used.
+
+### Read-Only
+
+- `id` (String) Terraform's internal resource ID. It is structured as "`project_id`,`instance_id`".
+- `wrapping_key_id` (String) The ID of the wrapping key

examples/resources/stackit_kms_key/resource.tf

@@ -0,0 +1,10 @@
+resource "stackit_kms_key" "name" {
+  algorithm    = "example algorithm"
+  backend      = "software"
+  description  = "new descr"
+  display_name = "example name"
+  import_only  = false
+  key_ring_id  = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  project_id   = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  purpose      = "example purpose"
+}

examples/resources/stackit_kms_key_ring/resource.tf

@@ -0,0 +1,6 @@
+resource "stackit_kms_key_ring" "example" {
+  description  = "example description"
+  display_name = "example name"
+  project_id   = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  region_id    = "eu01"
+}

examples/resources/stackit_kms_wrapping_key/resource.tf

@@ -0,0 +1,9 @@
+resource "stackit_kms_wrapping_key" "name" {
+  algorithm    = "example algorithm"
+  backend      = "software"
+  description  = "new descr"
+  display_name = "example name"
+  key_ring_id  = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  project_id   = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  purpose      = "example purpose"
+}

go.mod

@@ -17,13 +17,14 @@ require (
 	github.com/stackitcloud/stackit-sdk-go/services/git v0.7.1
 	github.com/stackitcloud/stackit-sdk-go/services/iaas v0.28.0
 	github.com/stackitcloud/stackit-sdk-go/services/iaasalpha v0.1.21-alpha
+	github.com/stackitcloud/stackit-sdk-go/services/kms v0.5.0
 	github.com/stackitcloud/stackit-sdk-go/services/loadbalancer v1.5.1
 	github.com/stackitcloud/stackit-sdk-go/services/logme v0.25.1
 	github.com/stackitcloud/stackit-sdk-go/services/mariadb v0.25.1
 	github.com/stackitcloud/stackit-sdk-go/services/modelserving v0.5.1
-	github.com/stackitcloud/stackit-sdk-go/services/mongodbflex v1.5.1
+	github.com/stackitcloud/stackit-sdk-go/services/mongodbflex v1.5.2
 	github.com/stackitcloud/stackit-sdk-go/services/objectstorage v1.3.1
-	github.com/stackitcloud/stackit-sdk-go/services/observability v0.9.1
+	github.com/stackitcloud/stackit-sdk-go/services/observability v0.10.0
 	github.com/stackitcloud/stackit-sdk-go/services/opensearch v0.24.1
 	github.com/stackitcloud/stackit-sdk-go/services/postgresflex v1.2.1
 	github.com/stackitcloud/stackit-sdk-go/services/rabbitmq v0.25.1
@@ -37,7 +38,7 @@ require (
 	github.com/stackitcloud/stackit-sdk-go/services/ske v1.3.0
 	github.com/stackitcloud/stackit-sdk-go/services/sqlserverflex v1.3.1
 	github.com/teambition/rrule-go v1.8.2
-	golang.org/x/mod v0.26.0
+	golang.org/x/mod v0.27.0
 )
 
 require github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
@@ -65,7 +66,7 @@ require (
 	github.com/hashicorp/terraform-exec v0.23.0 // indirect
 	github.com/hashicorp/terraform-json v0.25.0 // indirect
 	github.com/hashicorp/terraform-plugin-sdk/v2 v2.37.0 // indirect
-	github.com/hashicorp/terraform-registry-address v0.2.5 // indirect
+	github.com/hashicorp/terraform-registry-address v0.3.0 // indirect
 	github.com/hashicorp/terraform-svchost v0.1.1 // indirect
 	github.com/hashicorp/yamux v0.1.2 // indirect
 	github.com/kr/pretty v0.3.1 // indirect
@@ -76,24 +77,24 @@ require (
 	github.com/mitchellh/go-wordwrap v1.0.0 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
-	github.com/oklog/run v1.1.0 // indirect
+	github.com/oklog/run v1.2.0 // indirect
 	github.com/rogpeppe/go-internal v1.13.1 // indirect
 	github.com/stackitcloud/stackit-sdk-go/services/authorization v0.8.1
 	github.com/stretchr/testify v1.8.4 // indirect
 	github.com/vmihailenco/msgpack v4.0.4+incompatible // indirect
 	github.com/vmihailenco/msgpack/v5 v5.4.1 // indirect
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
 	github.com/zclconf/go-cty v1.16.3 // indirect
-	golang.org/x/crypto v0.40.0 // indirect
-	golang.org/x/net v0.42.0 // indirect
+	golang.org/x/crypto v0.41.0 // indirect
+	golang.org/x/net v0.43.0 // indirect
 	golang.org/x/sync v0.16.0 // indirect
-	golang.org/x/sys v0.34.0 // indirect
-	golang.org/x/text v0.27.0 // indirect
+	golang.org/x/sys v0.35.0 // indirect
+	golang.org/x/text v0.28.0 // indirect
 	golang.org/x/tools v0.35.0 // indirect
 	google.golang.org/appengine v1.6.8 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 // indirect
-	google.golang.org/grpc v1.73.0 // indirect
-	google.golang.org/protobuf v1.36.6 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250804133106-a7a43d27e69b // indirect
+	google.golang.org/grpc v1.74.2 // indirect
+	google.golang.org/protobuf v1.36.7 // indirect
 	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
 )