Add blocked_encryption_types variable to fix perpetual SSE config drift (#289)

Exposes blocked_encryption_types on the aws_s3_bucket_server_side_encryption_configuration
rule block. Defaults to null (attribute omitted) to preserve compatibility with
hashicorp/aws provider versions older than 6.22.0.

On provider >= 6.22.0, GetBucketEncryption returns blocked_encryption_types = ["NONE"]
by default, which does not round-trip with an omitted/empty list and causes perpetual
in-place diffs. Callers on 6.22.0+ can set this to ["NONE"] to silence the drift.

Fixes #287

Author: duality72

README.md

@@ -267,6 +267,7 @@ module "s3_bucket" {
 | <a name="input_availability_zone_id"></a> [availability\_zone\_id](#input\_availability\_zone\_id) | The ID of the availability zone. | `string` | `""` | no |
 | <a name="input_block_public_acls"></a> [block\_public\_acls](#input\_block\_public\_acls) | Set to `false` to disable the blocking of new public access lists on the bucket | `bool` | `true` | no |
 | <a name="input_block_public_policy"></a> [block\_public\_policy](#input\_block\_public\_policy) | Set to `false` to disable the blocking of new public policies on the bucket | `bool` | `true` | no |
+| <a name="input_blocked_encryption_types"></a> [blocked\_encryption\_types](#input\_blocked\_encryption\_types) | List of encryption types to block on the bucket, passed to the `rule` block of `aws_s3_bucket_server_side_encryption_configuration`.<br/><br/>Defaults to `null` (attribute omitted) so the module remains compatible with `hashicorp/aws` provider versions older than 6.22.0, which do not know this field.<br/><br/>On provider >= 6.22.0, AWS's `GetBucketEncryption` returns `blocked_encryption_types = ["NONE"]` by default, which does not round-trip with an omitted/empty list and causes perpetual in-place diffs on `aws_s3_bucket_server_side_encryption_configuration`. To silence that drift, set this to `["NONE"]`. | `list(string)` | `null` | no |
 | <a name="input_bucket_key_enabled"></a> [bucket\_key\_enabled](#input\_bucket\_key\_enabled) | Set this to true to use Amazon S3 Bucket Keys for SSE-KMS, which may or may not reduce the number of AWS KMS requests.<br/>For more information, see: https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-key.html | `bool` | `false` | no |
 | <a name="input_bucket_name"></a> [bucket\_name](#input\_bucket\_name) | Bucket name. If provided, the bucket will be created with this name instead of generating the name from the context | `string` | `null` | no |
 | <a name="input_context"></a> [context](#input\_context) | Single object for setting entire context at once.<br/>See description of individual variables for details.<br/>Leave string and numeric variables as `null` to use default value.<br/>Individual variable settings (non-null) override settings in context object,<br/>except for attributes, tags, and additional\_tag\_map, which are merged. | `any` | <pre>{<br/>  "additional_tag_map": {},<br/>  "attributes": [],<br/>  "delimiter": null,<br/>  "descriptor_formats": {},<br/>  "enabled": true,<br/>  "environment": null,<br/>  "id_length_limit": null,<br/>  "label_key_case": null,<br/>  "label_order": [],<br/>  "label_value_case": null,<br/>  "labels_as_tags": [<br/>    "unset"<br/>  ],<br/>  "name": null,<br/>  "namespace": null,<br/>  "regex_replace_chars": null,<br/>  "stage": null,<br/>  "tags": {},<br/>  "tenant": null<br/>}</pre> | no |

main.tf

@@ -84,7 +84,8 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "default" {
   expected_bucket_owner = var.expected_bucket_owner
 
   rule {
-    bucket_key_enabled = var.bucket_key_enabled
+    bucket_key_enabled       = var.bucket_key_enabled
+    blocked_encryption_types = var.blocked_encryption_types
 
     apply_server_side_encryption_by_default {
       sse_algorithm     = var.sse_algorithm

variables.tf

@@ -458,6 +458,22 @@ variable "bucket_key_enabled" {
   nullable    = false
 }
 
+variable "blocked_encryption_types" {
+  type        = list(string)
+  default     = null
+  description = <<-EOT
+  List of encryption types to block on the bucket, passed to the `rule` block of
+  `aws_s3_bucket_server_side_encryption_configuration`.
+
+  Defaults to `null` (attribute omitted) so the module remains compatible with `hashicorp/aws` provider
+  versions older than 6.22.0, which do not know this field.
+
+  On provider >= 6.22.0, AWS's `GetBucketEncryption` returns `blocked_encryption_types = ["NONE"]` by default,
+  which does not round-trip with an omitted/empty list and causes perpetual in-place diffs on
+  `aws_s3_bucket_server_side_encryption_configuration`. To silence that drift, set this to `["NONE"]`.
+  EOT
+}
+
 variable "expected_bucket_owner" {
   type        = string
   default     = null