Add encryption support

[06kellyjac]

Resolves #27

This PR allows for users to specify the default_kms_key_name attribute to enable encryption.

Encryption can be enabled on a bucket by bucket basis similar to the existing settings: versioning and force_delete

The TF handles for empty strings because while an empty string is a valid input that results in a normal google managed key bucket, terraform will see this as a change every terraform apply.
There is no enable = false attribute option to have the encryption block ignored.
See the bottom of the PR for an example & plan demonstrating the issue

(Also bumps the version in requirements to match the compatibility section)

---

Example Usage:

Here bucket a will have CMEK encryption and bucket b will have the default google managed encryption

module "gcs_buckets" {
  source     = "./some/location/terraform-google-cloud-storage"
  project_id = local.project_id
  prefix     = "test"
  names      = [ "a", "b" ]

  encryption_key_names = {
    a: data.google_kms_crypto_key.key.self_link
  }
}

Resulting Plan:

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # module.gcs_buckets.google_storage_bucket.buckets[0] will be created
  + resource "google_storage_bucket" "buckets" {
      + bucket_policy_only = true
      + force_destroy      = false
      + id                 = (known after apply)
      + labels             = {
          + "name" = "test-eu-a"
        }
      + location           = "EU"
      + name               = "test-eu-a"
      + project            = "<REDACTED>"
      + self_link          = (known after apply)
      + storage_class      = "MULTI_REGIONAL"
      + url                = (known after apply)

      + encryption {
          + default_kms_key_name = "<REDACTED>"
        }

      + versioning {
          + enabled = false
        }
    }

  # module.gcs_buckets.google_storage_bucket.buckets[1] will be created
  + resource "google_storage_bucket" "buckets" {
      + bucket_policy_only = true
      + force_destroy      = false
      + id                 = (known after apply)
      + labels             = {
          + "name" = "test-eu-b"
        }
      + location           = "EU"
      + name               = "test-eu-b"
      + project            = "<REDACTED>"
      + self_link          = (known after apply)
      + storage_class      = "MULTI_REGIONAL"
      + url                = (known after apply)

      + versioning {
          + enabled = false
        }
    }

---

Example of the re-apply issue:

resource "google_storage_bucket" "bucket" {
  project  = local.project_id
  name     = "test-empty-encryption-block"
  location = "EU"

  encryption {
    default_kms_key_name = ""
  }
}

First plan:

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # google_storage_bucket.bucket will be created
  + resource "google_storage_bucket" "bucket" {
      + bucket_policy_only = (known after apply)
      + force_destroy      = false
      + id                 = (known after apply)
      + location           = "EU"
      + name               = "test-empty-encryption-block"
      + project            = "<REDACTED>"
      + self_link          = (known after apply)
      + storage_class      = "STANDARD"
      + url                = (known after apply)

      + encryption {}
    }

Every repeat plan:

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # google_storage_bucket.bucket will be updated in-place
  ~ resource "google_storage_bucket" "bucket" {
        bucket_policy_only = false
        force_destroy      = false
        id                 = "test-empty-encryption-block"
        labels             = {}
        location           = "EU"
        name               = "test-empty-encryption-block"
        project            = "<REDACTED>"
        requester_pays     = false
        self_link          = "https://www.googleapis.com/storage/v1/b/test-empty-encryption-block"
        storage_class      = "STANDARD"
        url                = "gs://test-empty-encryption-block"

      + encryption {}
    }

[06kellyjac]

I've ran the docs and linting jobs from the Makefile but not the integration tests etc.

[morgante]

Thanks for adding this! Just a few minor nits, but overall looks good/fine.

[06kellyjac]

I pushed earlier but I didn't notice it failed because of the commit I made with the GH suggestion.
😅

[06kellyjac]

Force pushed the update to the README I forgot to add with the make command

[morgante]

Thanks for the addition! Also, if you get a chance, it'd be helpful to add this to one of the examples/tests (but that's an optional follow-up).

[06kellyjac]

I've already got most of an example done but it needs a couple tweaks.

I haven't looked much at the tests just yet.