src/lambda_codebase/initial_commit/bootstrap_repository/adf-bootstrap/deployment/global.yml [75:119]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Type: AWS::KMS::Key
    Properties:
      Description: Used by Assumed Roles in Accounts accounts to Encrypt/Decrypt code
      EnableKeyRotation: true
      KeyPolicy:
        Version: "2012-10-17"
        Id: !Ref AWS::StackName
        Statement:
          - Sid: Allows admin of the key
            Effect: Allow
            Principal:
              AWS: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:root
            Action:
              - "kms:CancelKeyDeletion"
              - "kms:Create*"
              - "kms:Decrypt"
              - "kms:Delete*"
              - "kms:Describe*"
              - "kms:DescribeKey"
              - "kms:Disable*"
              - "kms:Enable*"
              - "kms:Encrypt"
              - "kms:GenerateDataKey*"
              - "kms:Get*"
              - "kms:List*"
              - "kms:Put*"
              - "kms:ReEncrypt*"
              - "kms:Revoke*"
              - "kms:ScheduleKeyDeletion"
              - "kms:Update*"
            Resource: "*"
          - Sid: Allow use of the key
            Effect: Allow
            Principal:
              AWS: "*"
            Action:
              - kms:Decrypt
              - kms:DescribeKey
              - kms:Encrypt
              - kms:GenerateDataKey*
              - kms:ReEncrypt*
            Resource: "*"
            Condition:
              StringEquals:
                aws:PrincipalOrgID: !Ref OrganizationId
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



src/lambda_codebase/initial_commit/bootstrap_repository/adf-bootstrap/deployment/regional.yml [47:91]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Type: AWS::KMS::Key
    Properties:
      Description: Used by Assumed Roles in Accounts accounts to Encrypt/Decrypt code
      EnableKeyRotation: true
      KeyPolicy:
        Version: "2012-10-17"
        Id: !Ref AWS::StackName
        Statement:
          - Sid: Allows admin of the key
            Effect: Allow
            Principal:
              AWS: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:root
            Action:
              - "kms:CancelKeyDeletion"
              - "kms:Create*"
              - "kms:Decrypt"
              - "kms:Delete*"
              - "kms:Describe*"
              - "kms:DescribeKey"
              - "kms:Disable*"
              - "kms:Enable*"
              - "kms:Encrypt"
              - "kms:GenerateDataKey*"
              - "kms:Get*"
              - "kms:List*"
              - "kms:Put*"
              - "kms:ReEncrypt*"
              - "kms:Revoke*"
              - "kms:ScheduleKeyDeletion"
              - "kms:Update*"
            Resource: "*"
          - Sid: Allow use of the key
            Effect: Allow
            Principal:
              AWS: "*"
            Action:
              - kms:Decrypt
              - kms:DescribeKey
              - kms:Encrypt
              - kms:GenerateDataKey*
              - kms:ReEncrypt*
            Resource: "*"
            Condition:
              StringEquals:
                aws:PrincipalOrgID: !Ref OrganizationId
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



