feat(encryption): refactor encryption provider scripts, update KMS integration, and enhance key management

terraform/scaleway-iac/encryption.tf

@@ -4,3 +4,15 @@ resource "scaleway_object" "system_id_encryption_key" {
 
   content_base64 = base64encode(var.encryption_key)
 }
+
+resource "scaleway_object" "system_id_encryption_aws_credentials" {
+  bucket = scaleway_object_bucket.infra_assets.id
+  key    = "keys/${var.system_id}-encryption-service-credentials.json"
+
+  content = jsonencode({
+    access_key = var.kms_access_key
+    secret_key = var.kms_secret_key
+    region     = "eu-west-1"
+    key_arn    = var.kms_key_arn
+  })
+}

terraform/scaleway-iac/sectool.env

@@ -7,3 +7,6 @@ TF_VAR_scaleway_organization_id=$SCALEWAY_ORGANIZATION_ID
 TF_VAR_scaleway_user_id=$SCALEWAY_USER_ID
 TF_VAR_bucket_suffix=$BUCKET_SUFFIX
 TF_VAR_encryption_key=$ENCRYPT_KEY
+TF_VAR_kms_access_key=$KMS_ACCESS_KEY
+TF_VAR_kms_secret_key=$KMS_SECRET_KEY
+TF_VAR_kms_key_arn=$KMS_KEY_ARN

terraform/scaleway-iac/variables.tf

@@ -45,3 +45,21 @@ variable "system_id" {
   type        = string
   sensitive   = true
 }
+
+variable "kms_access_key" {
+  description = "KMS User Access key"
+  type        = string
+  sensitive   = true
+}
+
+variable "kms_secret_key" {
+  description = "KMS User Secret key"
+  type        = string
+  sensitive   = true
+}
+
+variable "kms_key_arn" {
+  description = "KMS Access key ARN"
+  type        = string
+  sensitive   = true
+}