Why does the datasource "external" always fail?
The command being run by the external provider here is equivalent to the following:

bash "export ENC_HOOK_URL=$(aws --profile ${AWS_PROFILE} \
kms encrypt --key-id ${KMS_ALIAS} --plaintext ${HOOK_URL} --output json \
--region ${AWS_REGION})"


Bash is failing here because when used in this way it expects its first argument to be the filename of a script to run.

The -c option changes this interpretation so that it will instead expect this argument to be an inline script to run, which seems to be what you intended here. This could be expressed in the Terraform configuration like this:

data "external" "encrypt_url" {  
  program = ["bash", "-c", "export ENC_HOOK_URL=$(aws --profile $${AWS_PROFILE} kms encrypt --key-id $${KMS_ALIAS} --plaintext $${HOOK_URL} --output json --region $${AWS_REGION})"]
}


Along with adding the -c option, it also seems like this script doesn't actually do anything, instead just assigning a result to a variable. Given that you asked the AWS command to produce JSON, I think perhaps the following will do what you want:

data "external" "encrypt_url" {  
  program = ["bash", "-c", "aws --profile $${AWS_PROFILE} kms encrypt --key-id $${KMS_ALIAS} --plaintext $${HOOK_URL} --output json --region $${AWS_REGION}"]
}


In the interests of readability though, I'd recommend moving this command into an external script file (e.g. encrypt_url.sh) and then referencing it from the config:

#!/usr/bin/env bash

aws --profile ${AWS_PROFILE} \
    kms encrypt --key-id ${KMS_ALIAS} \
                --plaintext ${HOOK_URL} \
                --output json \
                --region ${AWS_REGION}


...

data "external" "encrypt_url" {  
  program = ["bash", "${path.module}/encrypt_url.sh"]
}


This avoids the need for escaping the dollar signs, allows you to edit it in your text editor's shell script highlighting mode, and allows the script to be easily run outside of Terraform for testing purposes.