PermissionsThe Enforce AWS KMS Keys Allow Only Approved Action Permissions policy pack requires 1 permission:kms:PutKeyPolicy