[FEATURE] Add condition to restrict source account on Encryption Stack

### Describe the feature

When building the Encryption Stack, there is an overly permissive role for the logs:

{
"Action": [
"kms:Decrypt",
"kms:Encrypt",
"kms:GenerateDataKey*",
"kms:ReEncrypt*"
],
"Effect": "Allow",
"Principal": {
"Service": "logs.eu-west-1.amazonaws.com"
},
"Resource": "*"
}

### Use Case

Detail for security least priviledge.

### Proposed Solution

_No response_

### Other Information

_No response_

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### Environment details (OS name and version, etc.)

CDK