feat: Add support for creating KMS key for KMS-encrypted Volumes (cluster-nodes & PVCs)

[philicious]

Is your request related to a problem? Please describe.

#2121 added support for creating a KMS key, which is then used for secrets encryption.

Now, users also might want to encrypt the EBS volumes. Either with the same KMS key or even a separate one. The key needs policies so the Autoscaler Service-linked role (cluster nodes) as well as the Cluster-Role (for PVCs) can both successfully work with these volumes.
See for permissions https://docs.aws.amazon.com/autoscaling/ec2/userguide/key-policy-requirements-EBS-encryption.html (in addition to that, the cluster-role needs to be added as principal.

Describe the solution you'd like.

Either add these policies optionally to the existing key and use that key in block_device_mappings.ebs config if none specified.
Or add a second KMS key for EBS volumes.

Describe alternatives you've considered.

Up until now, I create KMS key myself with the mentioned policies

Additional context

code used to create the encrypted cluster-node volumes, for which the Autoscaler Service-linked role needs the permissions

eks_managed_node_group_defaults {
    block_device_mappings = {
      default = {
        device_name = "/dev/xvda"

        ebs = {
          encrypted             = true
          kms_key_id            = module.kms.key_arn
        }
      }
    }
}

in addition, a StorageClass with encryption settings is used, for which the cluster-role needs the permissions so persistentvolume-controller can create PVCs. (Also the ebs-csi driver needs same permissions )

parameters:
  type: gp3
  encrypted: "true"
  kmsKeyId: "${kmsKey}"

[bryantbiggs]

This one is quite a bit more complex and I'm not sure yet if support is possible. I will have to think on this a bit more but open to ideas here

[github-actions]

This issue has been automatically marked as stale because it has been open 30 days
with no activity. Remove stale label or comment or this issue will be closed in 10 days

[github-actions]

This issue was automatically closed because of stale in 10 days

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.