PermissionsThe Enforce Encryption at Rest Is Enabled for AWS SNS Topics policy pack requires 2 permissions:kms:DescribeKeysns:SetTopicAttributes