feat(Cloud Storage): Add bucket encryption sample

[betsy-lichtenberg]

Description

Fixes # b/284014407

Checklist

Readiness

• Yes, merge this PR after it is approved
• No, don't merge this PR after it is approved

Style

• My sample follows the rules described for Terraform in the Effective Samples style guide
• My sample follows the other requirements and best practices in the Contributing
  guide

Testing

• I have performed tests described in the Contributing guide:

  • Tests pass: terraform apply
  • Lint pass: terraform fmt check

Intended location

• Yes, this sample will be (or already is) included on cloud.google.com
  Location(s): https://cloud.google.com/docs/terraform/resource-management/store-state

• No, this sample won't be included on cloud.google.com
  Reason:

API enablement

• If the sample needs an API enabled to pass testing, I have added the service to the Test setup file

Review

• If this sample adds a new directory, I have added codeowners to the CODEOWNERS file

[snippet-bot]

Here is the summary of changes.

You are about to add 1 region tag.

• storage/flask_google_cloud_quickstart/main.tf:92, tag storage_kms_encryption_tfstate

---

This comment is generated by snippet-bot.
If you find problems with this result, please file an issue at:
https://github.com/googleapis/repo-automation-bots/issues.
To update this comment, add snippet-bot:force-run label or use the checkbox below:

• Refresh this comment

[betsy-lichtenberg]

The error in the logs is Error: googleapi: Error 403: Permission denied on Cloud KMS key. Please ensure that your Cloud Storage service account has been authorized to use this key., forbidden

But the sample does give permission on lines 112-118

[msampathkumar]

I got the same error Error 403: Permission denied on Cloud KMS key on the first try! During the re-run this error did not happen.

But I see Error: Error creating KeyRing: googleapi: Error 409: KeyRing projects/.../locations/us/keyRings/test-terraform-state already exists. during re-runs

[betsy-lichtenberg]

briangrant@ said:

That looks like an API problem.

https://buganizer.corp.google.com/issues/261484976

We're adding stronger API guidance on that topic:
aip-dev/google.aip.dev#1060

[msampathkumar]

LGTM.

All 5 successful checks passed