deployment/publisher.yaml [222:285]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      KmsMasterKeyId:
        Ref: CMK

  CMK:
    Type: AWS::KMS::Key
    Properties:
      Description: Symetric Key for Encrypting Messages in Media Exchange
      Enabled: true
      EnableKeyRotation: true
      PendingWindowInDays: 7
      KeyPolicy:
        Version: 2012-10-17
        Id: node-key-policy
        Statement:
          -
            Sid: KeyManagement
            Effect: Allow
            Principal:
              AWS:
                Fn::Sub: arn:${AWS::Partition}:iam::${AWS::AccountId}:root
            Action:
              - kms:Create*
              - kms:Describe*
              - kms:Enable*
              - kms:List*
              - kms:Put*
              - kms:Update*
              - kms:Revoke*
              - kms:Disable*
              - kms:Get*
              - kms:Delete*
              - kms:TagResource
              - kms:UntagResource
              - kms:ScheduleKeyDeletion
              - kms:CancelKeyDeletion
              - kms:GenerateDataKey*
              - kms:Decrypt
            Resource: '*'

          -
            Sid: "Allow access for Key User (SNS Service Principal)"
            Effect: Allow
            Principal:
              Service: sns.amazonaws.com
            Action:
              - kms:GenerateDataKey*
              - kms:Decrypt
            Resource: '*'

          -
            Sid: "Allow access for Key User (Events Service Principal)"
            Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Action:
              - kms:GenerateDataKey*
              - kms:Decrypt
            Resource: '*'

          -
            Sid: "Allow access for Key User (x-account permissions for subscriber)"
            Effect: Allow
            Principal:
              AWS:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



deployment/subscriber.yaml [138:202]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      KmsMasterKeyId:
        Ref: CMK


  CMK:
    Type: AWS::KMS::Key
    Properties:
      Description: Symetric Key for Encrypting Messages in Media Exchange
      Enabled: true
      EnableKeyRotation: true
      PendingWindowInDays: 7
      KeyPolicy:
        Version: 2012-10-17
        Id: node-key-policy
        Statement:
          -
            Sid: KeyManagement
            Effect: Allow
            Principal:
              AWS:
                Fn::Sub: arn:${AWS::Partition}:iam::${AWS::AccountId}:root
            Action:
              - kms:Create*
              - kms:Describe*
              - kms:Enable*
              - kms:List*
              - kms:Put*
              - kms:Update*
              - kms:Revoke*
              - kms:Disable*
              - kms:Get*
              - kms:Delete*
              - kms:TagResource
              - kms:UntagResource
              - kms:ScheduleKeyDeletion
              - kms:CancelKeyDeletion
              - kms:GenerateDataKey*
              - kms:Decrypt
            Resource: '*'

          -
            Sid: "Allow access for Key User (SNS Service Principal)"
            Effect: Allow
            Principal:
              Service: sns.amazonaws.com
            Action:
              - kms:GenerateDataKey*
              - kms:Decrypt
            Resource: '*'

          -
            Sid: "Allow access for Key User (Events Service Principal)"
            Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Action:
              - kms:GenerateDataKey*
              - kms:Decrypt
            Resource: '*'

          -
            Sid: "Allow access for Key User (x-account permissions for subscriber)"
            Effect: Allow
            Principal:
              AWS:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



