feat(kms): add an AWS KMS backend (#5553)

crates/kms/Cargo.toml

@@ -77,6 +77,16 @@ vaultrs = { workspace = true }
 rustify = { workspace = true }
 tokio-util = { workspace = true }
 
+# AWS KMS backend. Credentials come from the standard aws-config provider chain
+# (environment, shared profile, IMDS/container roles); this crate never handles
+# AWS credential material itself.
+aws-config = { workspace = true }
+aws-sdk-kms = { workspace = true, default-features = false, features = ["default-https-client", "rt-tokio"] }
+# SdkError variants and raw HTTP status are needed to classify AWS failures for
+# the operation policy's retry decisions.
+aws-smithy-runtime-api = { workspace = true, features = ["http-1x"] }
+aws-smithy-types = { workspace = true }
+
 [dev-dependencies]
 anyhow = { workspace = true }
 # Debugging recorder for asserting emitted metrics in tests.
@@ -86,6 +96,9 @@ tempfile = { workspace = true }
 temp-env = { workspace = true }
 # "net" backs the scripted loopback Vault used by the policy wiring tests.
 tokio = { workspace = true, features = ["net", "test-util"] }
+# Replays canned AWS KMS HTTP exchanges so the AWS backend tests stay offline.
+aws-smithy-http-client = { workspace = true, default-features = false, features = ["test-util"] }
+http = { workspace = true }
 
 [features]
 default = []