feat: add KMS decryption permissions to midaz helm configuration

[guimoreirar]

• Included a new IAM policy allowing KMS decryption for resources in the midaz helm.yaml, ensuring secure access to secrets managed by AWS Secrets Manager.

[coderabbitai]

Walkthrough

An IAM policy statement was added to the HelmDeployerRole inline policy within the Helm configuration. The addition grants the kms:Decrypt permission on KMS keys matching the pattern arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/*. The permission is restricted through a kms:ViaService condition that limits decrypt operations to requests made through the Secrets Manager service endpoint in the same region. This enables the Lambda function to decrypt KMS-protected secrets stored in AWS Secrets Manager.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title directly and clearly summarizes the main change: adding KMS decryption permissions to the midaz helm configuration, which matches the file modified and the policy statement added.
Description check	✅ Passed	The description is relevant to the changeset, explaining that a new IAM policy for KMS decryption was added to midaz helm.yaml for secure access to AWS Secrets Manager.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[lerian-studio]

Consider updating CHANGELOG.md to document this change. If this change doesn't need a changelog entry, add the skip-changelog label.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@products/midaz/helm.yaml`:
- Around line 171-177: Replace the overly-broad KMS resource "key/*" with
explicit ARNs by adding new CloudFormation parameters (e.g., RDSKMSKeyArn,
DocumentDBKMSKeyArn, AmazonMQKMSKeyArn) and then update the IAM policy block
(the statement that currently has Action: kms:Decrypt and Resource: !Sub
"arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/*") to reference only those
specific ARN parameters (or a list of the specific key ARNs used by your
secrets) so kms:Decrypt is limited to the RDSKMSKey / DocumentDBKMSKey /
AmazonMQKMSKey resources rather than all keys.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: f348348e-e03d-4232-a7b5-cfa5caeab1d9

📥 Commits

Reviewing files that changed from the base of the PR and between 89db99f and f37dfed.

📒 Files selected for processing (1)

• products/midaz/helm.yaml