---
title: "exoscale_kms_key_store (Data Source)"
description: "[BETA] Fetch an Exoscale KMS https://community.exoscale.com/product/security/kms/ External Key Store.\nCorresponding resource: exoscalekmskey_store ../resources/kms_key_store.md."
url: https://community.exoscale.com/reference/terraform/provider/data-sources/kms_key_store/
section: reference
last_updated: 2026-10-29
---
> For AI agents: the documentation index is at https://community.exoscale.com/llms.txt. Every page is available as markdown at `<page URL>index.md` or with `Accept: text/markdown`.

# exoscale_kms_key_store (Data Source)

[BETA] Fetch an Exoscale [KMS](https://community.exoscale.com/product/security/kms/index.md) External Key Store.

Corresponding resource: [exoscale_kms_key_store](https://community.exoscale.com/reference/terraform/provider/resources/kms_key_store/index.md).

## Example Usage

```terraform
data "exoscale_kms_key_store" "my_key_store" {
  zone = "ch-gva-2"
  name = "my-key-store"
}

output "my_key_store_id" {
  value = data.exoscale_kms_key_store.my_key_store.id
}
```

Please refer to the [examples](https://github.com/exoscale/terraform-provider-exoscale/tree/master/examples/)
directory for complete configuration examples.


## Schema

### Required

- `zone` (String) The Exoscale [Zone](https://www.exoscale.com/datacenters/) name.

### Optional

- `id` (String) The key store ID to match (conflicts with `name`).
- `name` (String) The key store name to match (conflicts with `id`).
- `timeouts` (Block, Optional) (see [below for nested schema](#nestedblock--timeouts))

### Read-Only

- `created_at` (String) The creation date of the key store.
- `description` (String) The description of the key store.
- `health` (Attributes) The latest periodic health check of the proxy. Only connected key stores are checked, every 10 minutes, and a change to the key store resets it. (see [below for nested schema](#nestedatt--health))
- `proxy` (Attributes) The customer-managed XKS proxy. The secret key is never returned. (see [below for nested schema](#nestedatt--proxy))
- `status` (String) The connection status of the key store (`connected` or `disconnected`). KMS keys can only be created in, and used from, a connected key store.
- `status_since` (String) When the status last changed.
- `type` (String) The key store type (`external-key-store`).

<a id="nestedblock--timeouts"></a>
### Nested Schema for `timeouts`

Optional:

- `read` (String) A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Read operations occur during any refresh or planning operation when refresh is enabled.


<a id="nestedatt--health"></a>
### Nested Schema for `health`

Read-Only:

- `checked_at` (String) When the check completed.
- `error_detail` (String) A short description of the failure, when the check failed.
- `status` (String) `healthy`, `unhealthy` or `unknown`.
- `status_reason` (String) The reason for the status (e.g. `active`, `timeout`, `credential_error`).


<a id="nestedatt--proxy"></a>
### Nested Schema for `proxy`

Read-Only:

- `access_key` (String) The access key used to sign requests to the proxy.
- `endpoint` (String) The HTTPS base URL of the XKS API on the proxy.