# KMS key ====================================================================

resource "aws_kms_key" "this" {
  description              = var.description
  key_usage                = var.key_usage
  customer_master_key_spec = var.customer_master_key_spec
  enable_key_rotation      = var.enable_key_rotation
  deletion_window_in_days  = var.deletion_window_in_days
  multi_region             = var.multi_region
  policy                   = local.effective_policy

  tags = local.tags
}

# Aliases --------------------------------------------------------------------

resource "aws_kms_alias" "this" {
  for_each = toset(var.aliases)

  name          = "alias/${each.value}"
  target_key_id = aws_kms_key.this.key_id
}

# Grants ---------------------------------------------------------------------

resource "aws_kms_grant" "this" {
  for_each = var.grants

  name               = each.key
  key_id             = aws_kms_key.this.key_id
  grantee_principal  = each.value.grantee_principal
  operations         = each.value.operations
  retiring_principal = each.value.retiring_principal

  dynamic "constraints" {
    for_each = each.value.constraints != null ? [each.value.constraints] : []
    content {
      encryption_context_equals = constraints.value.encryption_context_equals
      encryption_context_subset = constraints.value.encryption_context_subset
    }
  }
}