feat: Allow overriding Performance Insights KMS key

Add performance_insights_kms_key_arn variable to allow specifying a
custom KMS key ARN for Performance Insights encryption. When null
(default), falls back to the component's RDS CMK.

This is needed when a cluster was initially created with PI disabled
(or with a different KMS key), and PI is later enabled via Terraform.
In that scenario, the cluster already has a PI KMS key assigned by AWS
(typically the default aws/rds managed key), and the component
unconditionally tries to set the RDS CMK — which AWS rejects because
PI KMS keys cannot be changed after cluster creation.

The new variable allows users to pass the ARN of the key already in
use, preventing the InvalidParameterCombination error:

  "You can't change your Performance Insights KMS key."

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: vyrwu

src/cluster-regional.tf

@@ -34,7 +34,7 @@ module "aurora_postgres_cluster" {
   storage_encrypted                    = var.storage_encrypted
   storage_type                         = var.storage_type
   kms_key_arn                          = var.storage_encrypted ? module.kms_key_rds.key_arn : null
-  performance_insights_kms_key_id      = var.performance_insights_enabled ? module.kms_key_rds.key_arn : null
+  performance_insights_kms_key_id      = var.performance_insights_enabled ? coalesce(var.performance_insights_kms_key_arn, module.kms_key_rds.key_arn) : null
   maintenance_window                   = var.maintenance_window
   enabled_cloudwatch_logs_exports      = var.enabled_cloudwatch_logs_exports
   enhanced_monitoring_role_enabled     = var.enhanced_monitoring_role_enabled

src/variables.tf

@@ -200,6 +200,12 @@ variable "performance_insights_enabled" {
   description = "Whether to enable Performance Insights"
 }
 
+variable "performance_insights_kms_key_arn" {
+  type        = string
+  default     = null
+  description = "ARN of the KMS key for Performance Insights encryption. If null, defaults to the RDS CMK."
+}
+
 variable "database_insights_mode" {
   type        = string
   description = "The database insights mode for the RDS cluster. Valid values are `standard`, `advanced`. See https://registry.terraform.io/providers/hashicorp/aws/6.16.0/docs/resources/rds_cluster#database_insights_mode-1"