templates/security_baseline.template.yaml [391:402]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
            Effect: Allow
            Principal:
              AWS: "*"
            Action:
              - "kms:Decrypt"
              - "kms:ReEncryptFrom"
            Resource: "*"
            Condition:
              StringEquals:
                "kms:CallerAccount": !Sub "${AWS::AccountId}"
              StringLike:
                "kms:EncryptionContext:aws:cloudtrail:arn": !Sub "arn:aws:cloudtrail:*:${AWS::AccountId}:trail/*"
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



templates/security_baseline.template.yaml [414:425]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
            Effect: Allow
            Principal:
              AWS: "*"
            Action:
              - "kms:Decrypt"
              - "kms:ReEncryptFrom"
            Resource: "*"
            Condition:
              StringEquals:
                "kms:CallerAccount": !Sub "${AWS::AccountId}"
              StringLike:
                "kms:EncryptionContext:aws:cloudtrail:arn": !Sub "arn:aws:cloudtrail:*:${AWS::AccountId}:trail/*"
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



