feat(terraform): ensure kms key policy is defined

[JamesWoolfenden]

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Description

Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context. List any dependencies that are required for this change.

Fixes # (issue)

New/Edited policies (Delete if not relevant)

Description

Include a description of what makes it a violation and any relevant external links.

Fix

How does someone fix the issue in code and/or in runtime?

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove my feature, policy, or fix is effective and works
• New and existing tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

[gruebel]

🍺

[JackChap]

Hi, just curious on the rationale for this? As it's an optional parameter on both CDK and Terraform. Granted it does generate a default policy if none is attached, but it's still optional?

[JamesWoolfenden]

• One of main reasons for using using a CMK rather than the managed AWS keys is that you can set policies on the keys usage, as to who/what can you the key and how.