feat: dist bucket SSE config

[marekaf]

solves #1320

I took a battle-tested implementation from https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/blob/master/main.tf#L198

example usage:

KMS SSE

...

  runner_binaries_s3_sse_configuration = {
    rule = {
      apply_server_side_encryption_by_default = {
        kms_master_key_id = aws_kms_key.dist.arn
        sse_algorithm     = "aws:kms"
      }
    }
  }

...

resource "aws_kms_key" "dist" {
  description             = "KMS key for dist bucket SES"
  deletion_window_in_days = 10
  key_usage               = "ENCRYPT_DECRYPT"
  enable_key_rotation     = true
  is_enabled              = true
  policy                  = data.aws_iam_policy_document.allow_kms.json
}

S3 SSE

  runner_binaries_s3_sse_configuration = {
    rule = {
      apply_server_side_encryption_by_default = {
        sse_algorithm     = "AES256"
      }
    }
 }

the flexibility in implementation is here to allow using either KMS or S3 SSE https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket

[npalm]

@marekaf did you had time to have a look on my comment?

[marekaf]

@npalm I don't see any comment?

[npalm]

Can you see the comments now, maybe I did not submitted the review :(

[npalm]

@marekaf thanks for your contribution, please you rebase? Some conflicts due to merged of other PR (older one).

[marekaf]

@marekaf thanks for your contribution, please you rebase? Some conflicts due to merged of other PR (older one).

rebased and conflicts fixed

it looks like there is a mismatch between contributors' versions (or default configuration) of terraform-docs, somebody keeps switching between --anchor=true and --anchor=false. It would make sense to add this to .pre-commit-config.yml:

      - id: terraform_docs
        args:
          - --args=--anchor=true

[npalm]

@marekaf thanks for your contribution, please you rebase? Some conflicts due to merged of other PR (older one).

rebased and conflicts fixed

it looks like there is a mismatch between contributors' versions (or default configuration) of terraform-docs, somebody keeps switching between --anchor=true and --anchor=false. It would make sense to add this to .pre-commit-config.yml:

      - id: terraform_docs
        args:
          - --args=--anchor=true

CI checks are failing

[marekaf]

@npalm oops, sorry. Not sure why pre-commit didn't catch that. Should be fixed now.