Activity Log storage account uses a customer-managed key

# Storage account encrypted with a customer-managed key (CMK)
resource "azurerm_storage_account" "<example_resource_name>" {
  name                     = "<example_resource_name>"
  resource_group_name      = "<example_resource_name>"
  location                 = "<example_location>"
  account_tier             = "Standard"
  account_replication_type = "LRS"

  identity {
    type = "SystemAssigned" # Required for Storage to access the Key Vault key
  }

  customer_managed_key {
    key_vault_key_id = "<key_vault_key_id>" # CRITICAL: enables CMK by pointing to the Key Vault key
  }
}

// Storage account encrypted with a customer-managed key (CMK)
resource stg 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: '<example_resource_name>'
  location: resourceGroup().location
  kind: 'StorageV2'
  sku: { name: 'Standard_LRS' }
  identity: { type: 'SystemAssigned' } // Required for Storage to access the Key Vault key
  properties: {
    encryption: {
      keySource: 'Microsoft.Keyvault' // CRITICAL: switches encryption from Microsoft.Storage to CMK
      keyVaultProperties: {
        keyName: '<KeyName>'
        keyVaultUri: '<KeyVaultURI>' // Uses latest key version if not specified
      }
    }
  }
}