templates/hail-ami.template.yaml [355:373]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  policyEmrEbsEncryption:
    Condition: "CondEnableEncryption"
    Type: "AWS::IAM::Policy"
    Properties:
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: "allowEbsGenerateDataKey"
            Action:
              - "kms:CreateGrant"
              - "kms:Decrypt"
              - "kms:DescribeKey"
              - "kms:Encrypt"
              - "kms:GenerateDataKeyWithoutPlaintext"
              - "kms:ReEncrypt*"
            Effect: "Allow"
            Resource: !Ref pKmsEbsArn
      PolicyName: "kms-ebs-access"
      Roles:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



templates/hail-emr.template.yaml [771:789]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  policyEmrEbsEncryption:
    Condition: "CondEnableEncryption"
    Type: "AWS::IAM::Policy"
    Properties:
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: "allowEbsGenerateDataKey"
            Action:
              - "kms:CreateGrant"
              - "kms:Decrypt"
              - "kms:DescribeKey"
              - "kms:Encrypt"
              - "kms:GenerateDataKeyWithoutPlaintext"
              - "kms:ReEncrypt*"
            Effect: "Allow"
            Resource: !Ref pKmsEbsArn
      PolicyName: "kms-ebs-access"
      Roles:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



