# The session CMK is the control plane's envelope-encryption key: Global Control
# encrypts secrets (notably cluster credentials) with it, and Regional Control and
# the data plane decrypt them with the same key. Every session needs one, so this
# is deliberately not gated on any product flag.
resource "aws_kms_key" "session_cmk" {
  description             = "cp9 ${local.session_name} session runtime CMK"
  deletion_window_in_days = 7
  enable_key_rotation     = true

  tags = merge(local.common_tags, {
    Name = "cp9-${local.session_name}-session-cmk"
  })
}

# Sessions created before the key was renamed and un-gated hold it at the old
# address. Without this, the next apply would destroy and recreate the key, and
# every secret already encrypted under it would become undecryptable.
moved {
  from = aws_kms_key.dataflow[0]
  to   = aws_kms_key.session_cmk
}