Optional ReadonlykmsKMS key ARN to encrypt the key pair's private key in Secrets Manager. If omitted, the module's KMS CMK is used.
Use cases: Bring-your-own-key encryption; Compliance-specific key management
AWS: KMS key for Secrets Manager secret encryption
Validation: Optional; valid KMS key ARN
EC2 key pair configuration with optional KMS encryption for the private key secret.