feat(encryption): implement AWS KMS integration with encryption provider and update related configurations

ansible/roles/encryption/tasks/kms.yml

@@ -0,0 +1,57 @@
+- name: Check if required facts are set
+  ansible.builtin.fail:
+    msg: "The following variables are required: encryption_aws_access_key_id, encryption_aws_secret_access_key, encryption_kms_arn"
+  when:
+    - encryption_aws_access_key_id is not defined
+    - encryption_aws_secret_access_key is not defined
+    - encryption_kms_arn is not defined
+
+- name: Copy aws-encryption-provider binary to the host
+  become: true
+  ansible.builtin.copy:
+    src: aws-encryption-provider
+    dest: /usr/local/bin/aws-encryption-provider
+    mode: '0755'
+
+- name: Copy start script to the host
+  become: true
+  ansible.builtin.template:
+    src: start-encryption-provider.sh.j2
+    dest: /usr/local/bin/start-encryption-provider.sh
+    mode: '0755'
+    owner: root
+    group: root
+
+- name: Create KMS socket directory
+  become: true
+  ansible.builtin.file:
+    path: /var/run/kmsplugin
+    state: directory
+    mode: '0755'
+    owner: root
+    group: root
+
+- name: Create systemd service file for aws-encryption-provider
+  become: true
+  ansible.builtin.template:
+    src: aws-encryption-provider.service.j2
+    dest: /etc/systemd/system/aws-encryption-provider.service
+    mode: '0644'
+
+- name: Reload systemd daemon
+  become: true
+  ansible.builtin.systemd:
+    daemon_reload: true
+    name: aws-encryption-provider
+
+- name: Enable aws-encryption-provider service
+  become: true
+  ansible.builtin.systemd:
+    name: aws-encryption-provider
+    enabled: true
+
+- name: Start aws-encryption-provider service
+  become: true
+  ansible.builtin.systemd:
+    name: aws-encryption-provider
+    state: started