{% set config = merged_configs.get('aws_s3_bucket_server_side_encryption_configuration', {}) %}
{% set comments = compliance_comments.get('aws_s3_bucket_server_side_encryption_configuration', []) %}
# ------------------------------------------------------------------------------
# S3 Bucket Server-Side Encryption Configuration
# ------------------------------------------------------------------------------
{% for comment in comments %}
# {{ comment }}
{% endfor %}

resource "aws_s3_bucket_server_side_encryption_configuration" "this" {
  bucket = aws_s3_bucket.this.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm     = "{{ config.get('sse_algorithm', 'aws:kms') }}"
      kms_master_key_id = {{ config.get('kms_master_key_id', 'null') }}
    }
    bucket_key_enabled = {{ config.get('bucket_key_enabled', true) | lower }}
  }
}
