[FEATURE] Add condition to restrict source account on Encryption Stack

[pabhermoso]

Describe the feature

When building the Encryption Stack, there is an overly permissive role for the logs:

{ "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:ReEncrypt" ], "Effect": "Allow", "Principal": { "Service": "logs.eu-west-1.amazonaws.com" }, "Resource": "*" }

Use Case

Detail for security least priviledge.

Proposed Solution

No response

Other Information

No response

Acknowledgements

• [ ] I may be able to implement this feature request
• [ ] This feature might incur a breaking change

Environment details (OS name and version, etc.)

CDK