Hardware HSM Envelope Encryption & BYOK Data Vault

resource "aws_kms_key" "data_key" {
  description             = "TinyCTO Production BYOK Master Key"
  deletion_window_in_days = 30
  enable_key_rotation     = true

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "Enable IAM User Permissions"
        Effect = "Allow"
        Principal = { AWS = "arn:aws:iam::123456789012:root" }
        Action   = "kms:*"
        Resource = "*"
      },
      {
        Sid    = "Strict Encryption Context Enforcement"
        Effect = "Allow"
        Principal = { AWS = "arn:aws:iam::123456789012:role/ProductionApp" }
        Action   = ["kms:Encrypt", "kms:Decrypt", "kms:GenerateDataKey"]
        Resource = "*"
        Condition = {
          StringEquals = {
            "kms:EncryptionContext:Environment" = "production"
            "kms:EncryptionContext:Pillar"      = "financial"
          }
        }
      }
    ]
  })
}

apiVersion: v1
kind: Secret
metadata:
  name: kms-transit-config
  namespace: security
stringData:
  vault-transit-engine: "transit/keys/customer-data-key"
  encryption-context-env: "production"
  key-type: "aes256-gcm96"