<p>main.tf</p>
<pre><code>  module &quot;s3_bucket&quot; {
  source = &quot;./modules/S3&quot;
  kms_master_key_id = module.kms.kms_arn
}

  module &quot;kms&quot; {
  source = &quot;./modules/kms&quot;
}
</code></pre>
<p>modules/kms/kms.tf</p>
<pre><code>resource &quot;aws_kms_key&quot; &quot;key&quot; {
  policy = data.aws_iam_policy_document.cmk.json
}

resource &quot;aws_kms_alias&quot; &quot;key_alias&quot; {
  name          = &quot;alias/kms-key&quot;
  target_key_id = aws_kms_key.key.id
}
</code></pre>
<p>modules/kms/_outputs.tf</p>
<pre><code>output &quot;kms_arn&quot; {
  value = aws_kms_key.key.arn
}
</code></pre>
<p>modules/S3/main.tf</p>
<pre><code>resource &quot;aws_s3_bucket&quot; &quot;bucket&quot; {

  bucket = &quot;09432804238423098&quot;
  acl    = &quot;private&quot;
  versioning {
    enabled = false
  }
  force_destroy = true
  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        kms_master_key_id = var.kms_master_key_id
        sse_algorithm     = &quot;aws:kms&quot;
      }
    }
  }
}
</code></pre>
<p>modules/S3/variables.tf</p>
<pre><code>variable &quot;kms_master_key_id&quot; {
  default = &quot;&quot;
}
</code></pre>

CC BY-SA 4.0
2022-06-07T10:48:55.160Z
Your answer could be improved with additional supporting information. Please [edit] to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers [in the help center](/help/how-to-answer).
Community
CC BY-SA 4.0
2022-06-07T06:14:21.537Z
2022-06-07T06:14:21.537Z
Bob B
<p>I'm trying to get the arn of the kms key for use in the S3 bucket <code>kms_master_key_id</code>, the code below is how I thought it might work. I can output the arn value to the root but am unsure how to access this in the S3 resource.</p>
<p>main.tf</p>
<pre><code>  module &quot;s3_bucket&quot; {
  source = &quot;./modules/S3&quot;
}

  module &quot;kms&quot; {
  source = &quot;./modules/kms&quot;
}
</code></pre>
<p>outputs.tf</p>
<pre><code>output &quot;kms_arn&quot; {
  value = module.kms.kms_arn
}

</code></pre>
<p>modules/kms/kms.tf</p>
<pre><code>resource &quot;aws_kms_key&quot; &quot;key&quot; {
  policy = data.aws_iam_policy_document.cmk.json
}

resource &quot;aws_kms_alias&quot; &quot;key_alias&quot; {
  name          = &quot;alias/kms-key&quot;
  target_key_id = aws_kms_key.key.id
}
</code></pre>
<p>modules/kms/_outputs.tf</p>
<pre><code>output &quot;kms_arn&quot; {
  value = aws_kms_key.key.arn
}
</code></pre>
<p>modules/S3/main.tf</p>
<pre><code>resource &quot;aws_s3_bucket&quot; &quot;bucket&quot; {

  bucket = &quot;09432804238423098&quot;
  acl    = &quot;private&quot;
  versioning {
    enabled = false
  }
  force_destroy = true
  server_side_encryption_configuration {
   rule {
      apply_server_side_encryption_by_default {
        kms_master_key_id = ../aws_kms_key.key.arn
        sse_algorithm     = &quot;aws:kms&quot;
      }
    }
  }
}
</code></pre>

<terraform>
Retrieving arn from another module
Bob B
# Retrieving arn from another module

(Asked by: username_0 on 2022-06-06)

I'm trying to get the arn of the kms key for use in the S3 bucket kms_master_key_id, the code below is how I thought it might work. I can output the arn value to the root but am unsure how to access this in the S3 resource.
main.tf
  module "s3_bucket" {
  source = "./modules/S3"
}

  module "kms" {
  source = "./modules/kms"
}

outputs.tf
output "kms_arn" {
  value = module.kms.kms_arn
}


modules/kms/kms.tf
resource "aws_kms_key" "key" {
  policy = data.aws_iam_policy_document.cmk.json
}

resource "aws_kms_alias" "key_alias" {
  name          = "alias/kms-key"
  target_key_id = aws_kms_key.key.id
}

modules/kms/_outputs.tf
output "kms_arn" {
  value = aws_kms_key.key.arn
}

modules/S3/main.tf
resource "aws_s3_bucket" "bucket" {

  bucket = "09432804238423098"
  acl    = "private"
  versioning {
    enabled = false
  }
  force_destroy = true
  server_side_encryption_configuration {
   rule {
      apply_server_side_encryption_by_default {
        kms_master_key_id = ../aws_kms_key.key.arn
        sse_algorithm     = "aws:kms"
      }
    }
  }
}

**Tags:** terraform


---

## 1 answers

### Answer by username_0 on 2022-06-07. Score: 0

main.tf
  module "s3_bucket" {
  source = "./modules/S3"
  kms_master_key_id = module.kms.kms_arn
}

  module "kms" {
  source = "./modules/kms"
}

modules/kms/kms.tf
resource "aws_kms_key" "key" {
  policy = data.aws_iam_policy_document.cmk.json
}

resource "aws_kms_alias" "key_alias" {
  name          = "alias/kms-key"
  target_key_id = aws_kms_key.key.id
}

modules/kms/_outputs.tf
output "kms_arn" {
  value = aws_kms_key.key.arn
}

modules/S3/main.tf
resource "aws_s3_bucket" "bucket" {

  bucket = "09432804238423098"
  acl    = "private"
  versioning {
    enabled = false
  }
  force_destroy = true
  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        kms_master_key_id = var.kms_master_key_id
        sse_algorithm     = "aws:kms"
      }
    }
  }
}

modules/S3/variables.tf
variable "kms_master_key_id" {
  default = ""
}

> **Comments:**
> **username_1**: Your answer could be improved with additional supporting information. Please [edit] to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers [in the help center](/help/how-to-answer).  

---

