// file included in the following:
//
// con-aws-kms-plugin-configuration.adoc


.Configuration for authenticating with EC2 metadata
[source, yaml]
----
kms: AwsKmsService                                            # <1>
kmsConfig:
  endpointUrl: https://kms.<region>.amazonaws.com             # <2>
  ec2MetadataCredentials:
    iamRole: <name_of_IAM_role>                               # <3>
    metadataEndpoint: <EC2_metadata_endpoint>                 # <4>
    credentialLifetimeFactor: 0.8                             # <5>
  region: <region>                                            # <6>
----
<1> Specifies the name of the KMS provider. Use `AwsKmsService`.
<2> AWS KMS endpoint URL, which must include the `https://` scheme.
<3> Name of the IAM role associated with the EC2 instance(s) hosting Kroxylicious.
<4> (Optional) Metadata endpoint used to obtain EC2 metadata. 
Defaults to `\http://169.254.169.254/`.
If using IPv6, use `http://[fd00:ec2::254]` instead.
<5> (Optional) Factor used to determine when to refresh a credential before it expires.
Defaults to `0.8`, which means the credential is refreshed once it reaches 80% of its lifetime.
<6> The AWS region identifier, such as `us-east-1`, specifying where your KMS resources are located. 
This must match the region of the KMS endpoint you're using.
