variable "name" {
  type = string
}

variable "admin_arn" {
  description = "IAM principal (role/user ARN) with administrative KMS access; empty = account root"
  type        = string
  default     = ""
}

# Required: an empty list would render a key-policy statement with no principal,
# which AWS rejects at apply time. Pass the ECS task role ARN (see ecs module).
variable "app_principal_arns" {
  description = "App task roles allowed to encrypt and decrypt PHI (e.g. [\"<name>-fargate-task\"])"
  type        = list(string)
}

variable "deletion_window_days" {
  type    = number
  default = 30
}

variable "tags" {
  type    = map(string)
  default = {}
}