docs: add Dedicated instance KMS keys page

[mintlify]

Adds a new page under Administration → Authentication & access documenting how to create cross-account AWS KMS keys for Kosli Dedicated and share them with Kosli.

Structure

• Prerequisites — what you need from Customer Success (primary/secondary regions, <kosli-account-id>) and from AWS.
• Choose the key shape — one multi-region key (KMS-generated material) vs. two single-region keys (CloudHSM / external key store).
• Create the primary key — six-step wizard walkthrough (configure, labels, admins, usage, key policy JSON with the Kosli statement, review).
• Replicate the key to the secondary region — Regionality tab flow.
• Share the key ARNs with Kosli — where to find them, note that a multi-region pair differs only by region.
• Single-region keys — differences when you must use CloudHSM / an external key store.
• Appendix A - Terraform — the same setup as aws_kms_key + aws_kms_alias + aws_kms_replica_key.

Notes on the source content

• Screenshots referenced in the source (e.g. "KMS service, with eu-central-1 selected", "as indicated in this image") are omitted — no images were attached. Descriptive text stands on its own; happy to add the images later if you drop them into a follow-up.
• "Customer success representative" is referenced consistently as "Customer Success representative" and framed as the source for both the account ID and the region names, matching the source doc's implication.
• Rephrased into second-person / active voice, with heading capitalization matched to the rest of the section (sentence case).
• Nav entry added last in the Authentication & access group after api_key_rotation.

Validation

mint validate and mint broken-links pass on the new page.

---

Generated by Mintlify Agent.

Requested by: marko@kosli.com via Slack
Mintlify session: slack_1778705097.340389_D0ALT8RK1CJ

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
kosli	🟢 Ready	View Preview	Sep 25, 2026, 5:33 PM

[claude]

Claude finished @mbevc1's task in 2m 44s —— View job

---

Doc review

Three findings, all on administration/customer_kms_keys.md, posted inline. Two of them were raised in earlier rounds and are still open at HEAD.

#	Location	Category	Issue
1	administration/customer_kms_keys.md:118	Improvement	The screenshot shows the console's empty Statement1 scaffold ("Action": [], "Principal": {}), not the Kosli statement its alt text claims. Placed right after the "add a comma" instruction, it reads as the finished state — following it ships a key that grants Kosli nothing, silently.
2	administration/customer_kms_keys.md:165	Improvement	Four screenshots publish real AWS account IDs unredacted (341098971036, 533266957720), plus a key material ID and an @kosli.com address in cropped browser chrome — while kms-key-policy-preview.png masks the same IDs and the prose treats the Kosli account ID as need-to-know. Same pass should reconcile the two light-mode shots with the ten dark-mode ones.
3	administration/customer_kms_keys.md:77	Suggestion	The visible <Frame caption> is the right fix for the ticked-checkbox mismatch, but alt was dropped — this is now the only image on the page without one.

Checks that passed, so no finding:

• Both new pages are in config/navigation.json (Administration ▸ Dedicated instance). Neither file exists on main, so no config/redirects.json entry is required.
• Every internal link and anchor resolves: /administration/customer_kms_keys, /administration/authentication/single_sign_on, /administration/managing_users/automated_user_provisioning, #terraform-example, #single-region-keys. All root-relative. I verified these by hand — gh pr checks isn't in this job's allowlist, so I could not read the link-rot result, and per CLAUDE.md it's unreliable anyway.
• The "Step 1 — Configure the key" prose now matches kms-configure-key.png: Multi-region key under Regionality, with KMS and External (Import Key material) both still offered — so the corrected <Note> at line 57 is accurate.
• The console wizard does have six steps: kms-key-policy-preview.png is headed Edit key policy – optional with its own Previous/Next, separate from Review. The Step 5 / Step 6 split is right.
• The Terraform example declares its three variables, pins the AWS provider floor for the top-level region argument, copies the primary's policy onto the replica, and aliases both regions — it matches what the console walkthrough produces.

No cross-file sweep gaps: no other page on the site documents data-at-rest encryption or names the Kosli AWS account, so nothing contradicts these pages.
· branch mintlify/dedicated-kms-keys