{% set config = merged_configs.get('google_kms_crypto_key', {}) %}
# Compliance: {{ compliance_comments.get('google_kms_crypto_key', []) | join(', ') }}
resource "google_kms_crypto_key" "main" {
  name            = "{{ config.get('name', '${var.project_id}-key') }}"
  key_ring        = google_kms_key_ring.main.id
  rotation_period = "{{ config.get('rotation_period', '7776000s') }}"
  purpose         = "{{ config.get('purpose', 'ENCRYPT_DECRYPT') }}"

  version_template {
    algorithm        = "{{ config.get('algorithm', 'GOOGLE_SYMMETRIC_ENCRYPTION') }}"
    protection_level = "{{ config.get('protection_level', 'SOFTWARE') }}"
  }

  lifecycle {
    prevent_destroy = {{ config.get('prevent_destroy', true) | lower }}
  }
}
