KMS encryption

[nitrocode]

KMS encryption as a default

From bridgecrew

     Resource: aws_s3_bucket.default | ID: BC_AWS_GENERAL_56 

terraform-aws-tfstate-backend/main.tf

Lines 174 to 180 in 7372db1

	server_side_encryption_configuration {
	rule {
	apply_server_side_encryption_by_default {
	sse_algorithm = "AES256"
	}
	}
	}

Should be

  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        kms_master_key_id = var.kms_master_key_id
        sse_algorithm     = "aws:kms"
      }
    }
  }

where kms_master_key_id should be something like ?

variable "kms_master_key_id" {
  default = "alias/aws/s3"
}

or simply keep kms_master_key_id = "" and set a dynamic for apply_server_side_encryption_by_default

[Nuru]

We may add support for KMS encryption in the future, but we will not make it the default.