## Module functionality
This module creates two CMK in KMS with aliases secrets_serviceonly and secrets_general for environment in project group:
* Secrets_serviceonly key is supposed to be used only by services itself.
* Secrets_general key could be accessed by services and users.

Also module creates five different IAM policies which controls access to this keys and AWS Secrets manager:
* secrets-services-ro allows to read/list secrets on path *project_group/env_prefix/* and decrypt it using both keys;
* secrets-services-rw allows to read and change secrets on path *project_group/env_prefix/* using both keys; it also allow listing secrets and creating new ones;
* secrets-users-ro allows to read/list secrets on path *project_group/env_prefix/* and decrypt it using secrets_general key;
* secrets-users-rw allows to read and change secrets on path *project_group/env_prefix/* using secrets_general key; it also allow listing secrets and creating new ones;
* secrets-management allows to manage both keys in KMS

Secrets that contains parameters which must be accessed only by services should use secrets_serviceonly key for encryption. Other secrets should be encrypted using secrets_general key.