Document encryption_details block in databricks_external_location resource and data source (#4849)

## Changes
<!-- Summary of your changes that are easy to understand -->

Should be merged after #4844

## Tests
<!-- 
How is this tested? Please see the checklist below and also describe any
other relevant tests
-->

- [x] relevant change in `docs/` folder
- [x] has entry in `NEXT_CHANGELOG.md` file

---------

Co-authored-by: vuong-nguyen <[email protected]>

Author: alexott

NEXT_CHANGELOG.md

@@ -24,6 +24,7 @@
 * Update documentation for single-node clusters in `databricks_cluster` resource ([#4817](https://github.com/databricks/terraform-provider-databricks/pull/4817)).
 * Update GCP example for `databricks_external_location` resource ([#4826](https://github.com/databricks/terraform-provider-databricks/pull/4826))
 * Fix formatting for HTTP connection example in `databricks_connection` resource ([#4826](https://github.com/databricks/terraform-provider-databricks/pull/4826))
+* Document `encryption_details` block in `databricks_external_location` resource and data source ([#4849](https://github.com/databricks/terraform-provider-databricks/pull/4849))
 * Update Databricks SQL objects documentation ([#4840](https://github.com/databricks/terraform-provider-databricks/pull/4840))
 * Improve documentation for `databricks_git_credential` resource ([#4837](https://github.com/databricks/terraform-provider-databricks/pull/4837))
 * Rename DLT references to Lakeflow Declarative pipelines ([#4842](https://github.com/databricks/terraform-provider-databricks/pull/4842))

docs/data-sources/external_location.md

@@ -43,7 +43,10 @@ This data source exports the following attributes:
   * `updated_at` - Time at which this catalog was last modified, in epoch milliseconds.
   * `updated_by` - Username of user who last modified catalog.
   * `access_point` - The ARN of the s3 access point to use with the external location (AWS).
-  * `encryption_details` - The options for Server-Side Encryption to be used by each Databricks s3 client when connecting to S3 cloud storage (AWS).
+  * `encryption_details` - A block describing encryption options that apply to clients connecting to cloud storage. Consisting of the following attributes:
+    * `sse_encryption_details` - a block describing server-Side Encryption properties for clients communicating with AWS S3. Consists of the following attributes:
+      * `algorithm` - Encryption algorithm value. Sets the value of the `x-amz-server-side-encryption` header in S3 request.
+      * `aws_kms_key_arn` - ARN of the SSE-KMS key used with the S3 location, when `algorithm = "SSE-KMS"`. 
 
 ## Related Resources
 

docs/resources/external_location.md

@@ -138,9 +138,16 @@ The following arguments are required:
 - `force_destroy` - (Optional) Destroy external location regardless of its dependents.
 - `force_update` - (Optional) Update external location regardless of its dependents.
 - `access_point` - (Optional) The ARN of the s3 access point to use with the external location (AWS).
-- `encryption_details` - (Optional) The options for Server-Side Encryption to be used by each Databricks s3 client when connecting to S3 cloud storage (AWS).
 - `isolation_mode` - (Optional) Whether the external location is accessible from all workspaces or a specific set of workspaces. Can be `ISOLATION_MODE_ISOLATED` or `ISOLATION_MODE_OPEN`. Setting the external location to `ISOLATION_MODE_ISOLATED` will automatically allow access from the current workspace.
 
+### encryption_details block
+
+A block describing encryption options that apply to clients connecting to cloud storage. Consisting of the following attributes
+
+- `sse_encryption_details` - a block describing server-Side Encryption properties for clients communicating with AWS S3. Consists of the following attributes:
+  - `algorithm` - Encryption algorithm value. Sets the value of the `x-amz-server-side-encryption` header in S3 request.
+  - `aws_kms_key_arn` - Optional ARN of the SSE-KMS key used with the S3 location, when `algorithm = "SSE-KMS"`. Sets the value of the `x-amz-server-side-encryption-aws-kms-key-id` header.
+
 ### file_event_queue block
 
 The `file_event_queue` block supports the following:
@@ -160,7 +167,6 @@ The `file_event_queue` block supports the following:
 - `provided_sqs` - (Optional) Configuration for provided Amazon SQS queue.
   - `queue_url` - (Required) The URL of the SQS queue.
 
-
 ## Attribute Reference
 
 In addition to all arguments above, the following attributes are exported: