docs: BSR KMS Configuration Requirements (#3440)

* add docs for additional config reqs for kms

* Update website/content/docs/configuration/session-recording/create-storage-bucket.mdx

Co-authored-by: Dan Heath <76443935+Dan-Heath@users.noreply.github.com>

---------

Co-authored-by: Dan Heath <76443935+Dan-Heath@users.noreply.github.com>

website/content/docs/configuration/kms/awskms.mdx

@@ -31,7 +31,7 @@ kms "awskms" {
 These parameters apply to the `kms` stanza in the Boundary configuration file:
 
 - `purpose` - Purpose of this KMS, acceptable values are: `worker-auth`, `worker-auth-storage`,
-   `root`, `previous-root`, `recovery`, or `config`.
+   `root`, `previous-root`, `recovery`, `bsr`, or `config`.
 
 - `region` `(string: "us-east-1")`: The AWS region where the encryption key
   lives. If not provided, may be populated from the `AWS_REGION` or

website/content/docs/configuration/session-recording/create-storage-bucket.mdx

@@ -55,6 +55,19 @@ Session recording requires specific configuration for both the AWS S3 storage bu
          }
       ]
    }
+
+   ```
+- If you apply KMS encryption to the storage bucket, you must add these additional permissions to the role policy for the storage bucket's IAM user:
+   ```json
+   {
+      "Action": [
+      "kms:Decrypt",
+      "kms:GenerateDataKey",
+      "kms:DescribeKey"
+      ],
+      "Effect": "Allow",
+      "Resource": "arn:aws:kms:us-east-1:1234567890:key/uuid"
+   }
    ```
 
 ### Boundary workers requirements