fix: add KMS encryption to DynamoDB state lock table and suppress S3 checks

- Add kms_key_arn to DynamoDB server_side_encryption (CKV_AWS_119)
- Add CKV2_AWS_62, CKV_AWS_18, CKV_AWS_144 to .checkov.baseline
  for aws_s3_bucket.terraform_state (event notifications,
  access logging, and cross-region replication are not needed
  for a Terraform state bucket)

Author: peaceshallom37-rgb

infrastructure/terraform/.checkov.baseline

@@ -367,6 +367,19 @@
                 }
             ]
         },
+        {
+            "file": "/backend.tf",
+            "findings": [
+                {
+                    "resource": "aws_s3_bucket.terraform_state",
+                    "check_ids": [
+                        "CKV2_AWS_62",
+                        "CKV_AWS_18",
+                        "CKV_AWS_144"
+                    ]
+                }
+            ]
+        },
         {
             "file": "/cloudfront.tf",
             "findings": [
@@ -948,4 +961,4 @@
             ]
         }
     ]
-}
+}

infrastructure/terraform/backend.tf

@@ -158,7 +158,8 @@ resource "aws_dynamodb_table" "terraform_state_lock" {
   }
 
   server_side_encryption {
-    enabled = true
+    enabled     = true
+    kms_key_arn = aws_kms_key.terraform_state.arn
   }
 
   tags = merge(local.common_tags, {