Feature Request: Support for KMS Key on Bastion Instance (Security Zone Compliance) #1024
Description
In environments with Security Zone enabled—created using the Oracle Landing Zone (OLZ) module and following the CIS 2 reference architecture—it is mandatory to use a customer-managed KMS key for all boot volumes. The current OKE module does not expose a variable to set the KMS key for the bastion instance, causing a 403 error when provisioning in these environments.
Expected behavior:
Allow passing a bastion_volume_kms_key_id (or similar) variable to set the KMS key for the bastion's boot volume, just like for operator and worker nodes.
Workaround:
Currently, it is not possible to provision the bastion in Security Zone environments using this module.
Please consider adding this support for full compliance.