[Feature] Support BYOK for deployments

[frasdav]

Overview

Add support for setting customer-managed encryption key as part of the ec_deployment resource.

The POST /api/v1/deployments API accepts this currently as settings.byok.key_resource_path:

{
  "resources": {
    # Omitted for brevity
  },
  "settings": {
    "autoscaling_enabled": false,
    "byok": {
      "key_resource_path": "arn:some:key"
    }
  },
  "name": "My deployment",
  "metadata": {
    "system_owned": false
  }
}

Possible Implementation

Testing

Context

Workaround to create a deployment with a customer-managed encryption key without this feature is messy.

3 distinct TF deployments:

1. Deploys KMS key and policy, one off
2. Execs null resource to run curl against EC API to deploy a minimal cluster with CMK in right region, outputs cluster ID, must only be run once
3. Takes an optional cluster ID, if passed it imports the cluster and resets elastic PW, then mushes it into the shape of TF config and takes over going forward

End result is what looks like a normal TF deployed cluster but with CMK enabled.

Your Environment

N/A

[seam-ctooley]

+1 this is a real pain for my team