Incorrect config validation - `If you have set either region_kms_key_ids or kms_key_id, encrypt_boot must also be true.`

Overview of the Issue / Reproduction steps

Incorrect config validation prevents use of the most efficent build behaviour.

Suppose you want to:

Create an encrypted AMI...
... and do so most efficiently, by using launch_block_device_mappings to launch the build instance encrypted initially, rather than performing a copy/encrypt operation to apply encryption after building an unencrypted AMI first...
... but you also want the final AMI to be copied to other regions using specified keys

The plugin rejects such a configuration with the message:

If you have set either region_kms_key_ids or kms_key_id, encrypt_boot must also be true.

I don't think this is correct. The technique of encrypting via launch_block_device_mappings is documented at https://developer.hashicorp.com/packer/integrations/hashicorp/amazon/latest/components/builder/ebs within the documentation for kms_key_id :

If you have a custom kms key you'd like to apply to the launch volume, and are only building in one region, it is more efficient to leave this and encrypt_boot empty and to instead set the key id in the launch_block_device_mappings (you can find an example below). This saves potentially many minutes at the end of the build by preventing Packer from having to copy and re-encrypt the image at the end of the build.

Just because I've specified region_kms_key_ids to customize the keys to be used for the copy to ami_regions, shouldn't prevent me from using this build technique.

Simplified Packer Buildfile

packer {
  required_plugins {
    amazon = {
      version = "~> 1.0"
      source  = "github.com/hashicorp/amazon"
    }
  }
}

variable "build_region" {
  type    = string
  default = "eu-west-2"
}

variable "distribution_regions" {
  type = list(string)
  default = [
    "eu-west-1",
  ]
}

variable "kms_key_id" {
  type    = string
  default = "mrk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

source "amazon-ebs" "debian" {
  ami_name           = "my-ami-{{timestamp}}"
  region             = var.build_region
  kms_key_id         = var.kms_key_id
  ami_regions        = var.distribution_regions
  region_kms_key_ids = { for region in var.distribution_regions : region => var.kms_key_id }
  instance_type      = "t3.2xlarge"
  launch_block_device_mappings {
    device_name           = "/dev/xvda"
    volume_size           = 8
    volume_type           = "gp3"
    delete_on_termination = true
  }
  source_ami_filter {
    filters = {
      name                = "debian-12-amd64-*"
      root-device-type    = "ebs"
      virtualization-type = "hvm"
      architecture        = "x86_64"
    }
    most_recent = true
    owners      = ["136693071363"] # https://wiki.debian.org/Cloud/AmazonEC2Image
  }
  ssh_username = "admin"
}

build {
  sources = ["source.amazon-ebs.debian"]
}

hashicorp / packer-plugin-amazon

Incorrect config validation - `If you have set either region_kms_key_ids or kms_key_id, encrypt_boot must also be true.` #496

Overview of the Issue / Reproduction steps

Simplified Packer Buildfile