feat(s3): add KMS key resources and update SSE configuration

Added KMS key resources for ecr_viewer and logging. Updated S3 bucket server-side encryption configuration to reference the new KMS keys.

Author: alismx

s3.tf

@@ -1,3 +1,11 @@
+resource "aws_kms_key" "ecr_viewer" {
+  enable_key_rotation = true
+}
+
+resource "aws_kms_key" "logging" {
+  enable_key_rotation = true
+}
+
 resource "aws_s3_bucket" "ecr_viewer" {
   bucket        = local.s3_viewer_bucket_name
   force_destroy = true
@@ -12,13 +20,12 @@ resource "aws_s3_bucket_public_access_block" "ecr_viewer" {
   restrict_public_buckets = true
 }
 
-# https://avd.aquasec.com/misconfig/aws/s3/avd-aws-0132/
-# trivy:ignore:AVD-AWS-0132
 resource "aws_s3_bucket_server_side_encryption_configuration" "ecr_viewer" {
   bucket = aws_s3_bucket.ecr_viewer.bucket
   rule {
     apply_server_side_encryption_by_default {
-      sse_algorithm = "aws:kms"
+      kms_master_key_id = aws_kms_key.ecr_viewer.arn
+      sse_algorithm     = "aws:kms"
     }
   }
 }
@@ -49,13 +56,12 @@ resource "aws_s3_bucket_public_access_block" "logging" {
   restrict_public_buckets = true
 }
 
-# https://avd.aquasec.com/misconfig/aws/s3/avd-aws-0132/
-# trivy:ignore:AVD-AWS-0132
 resource "aws_s3_bucket_server_side_encryption_configuration" "logging" {
   bucket = aws_s3_bucket.logging.bucket
   rule {
     apply_server_side_encryption_by_default {
-      sse_algorithm = "aws:kms"
+      kms_master_key_id = aws_kms_key.logging.arn
+      sse_algorithm     = "aws:kms"
     }
   }
 }