Advanced AI Prompt for Securing Terraform State with Encryption and IAM

Act as a DevSecOps Engineer. Define a rigorous security hardening policy for a highly sensitive [BACKEND_TYPE] Terraform remote state environment. Generate a strict, JSON-formatted IAM policy for [IAM_ROLE_ARN] enforcing absolute least privilege: granting `ListBucket` strictly to the bucket level, and `GetObject`/`PutObject` strictly to the exact `.tfstate` file path. Dictate the implementation of the [ENCRYPTION_STANDARD] (e.g., AES-256 or Customer Managed KMS Keys) for data at rest, and TLS 1.2+ for data in transit. Detail a foolproof operational procedure for auditing programmatic access to the state file via CloudTrail and outline the exact steps to seamlessly rotate the underlying KMS encryption keys without inducing pipeline downtime.