resource "aws_kms_key" "traces" {
  description             = "SSE-KMS CMK for sh-openswe-traces (LangSmith export archive)."
  enable_key_rotation     = true
  deletion_window_in_days = 30

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "EnableIAMPolicies"
        Effect = "Allow"
        Principal = {
          AWS = "arn:aws:iam::${local.account_id}:root"
        }
        Action   = "kms:*"
        Resource = "*"
      }
    ]
  })
}

resource "aws_kms_alias" "traces" {
  name          = local.kms_alias_name
  target_key_id = aws_kms_key.traces.key_id
}