Create a restricted Key Management Service (KMS) with Terraform: define KMS resource in main.tf, customize policy in terraform.tfvars & apply changes with terraform apply.