locals {
  # SSE algorithm: KMS when a CMK ARN is supplied, else AES256 (SSE-S3).
  sse_algorithm = var.kms_key_arn != null ? "aws:kms" : "AES256"

  # Tags: merge caller-supplied tags with the module defaults.
  tags = merge(
    {
      "nova:owner"       = "nova"
      "nova:environment" = "dev"
    },
    var.tags,
  )
}