source/repositories/compliant-framework-management-services-core/templates/management-services-assets-bucket.yml [29:115]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      EnableKeyRotation: true
      KeyPolicy:
        Version: 2012-10-17
        Id: key-policy-1
        Statement:
          - Sid: Allow administration of the key
            Effect: Allow
            Principal:
              AWS:
                - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:root
            Action:
              - kms:CancelKeyDeletion
              - kms:CreateAlias
              - kms:CreateGrant
              - kms:CreateKey
              - kms:DeleteAlias
              - kms:DeleteImportedKeyMaterial
              - kms:DescribeKey
              - kms:DisableKey
              - kms:DisableKeyRotation
              - kms:EnableKey
              - kms:EnableKeyRotation
              - kms:GenerateDataKeyWithoutPlaintext
              - kms:GenerateRandom
              - kms:GetKeyPolicy
              - kms:GetKeyRotationStatus
              - kms:GetParametersForImport
              - kms:ImportKeyMaterial
              - kms:ListAliases
              - kms:ListGrants
              - kms:ListKeyPolicies
              - kms:ListKeys
              - kms:ListResourceTags
              - kms:ListRetirableGrants
              - kms:PutKeyPolicy
              - kms:RetireGrant
              - kms:RevokeGrant
              - kms:ScheduleKeyDeletion
              - kms:TagResource
              - kms:UntagResource
              - kms:UpdateAlias
              - kms:UpdateKeyDescription
            Resource: "*"
          - Sid: Allow Account root use of the key
            Effect: Allow
            Principal:
              AWS: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:root
            Action:
              - kms:Decrypt
              - kms:DescribeKey
              - kms:Encrypt
              - kms:GenerateDataKey
              - kms:GenerateDataKeyWithoutPlaintext
              - kms:GenerateRandom
              - kms:GetKeyPolicy
              - kms:GetKeyRotationStatus
              - kms:ListAliases
              - kms:ListGrants
              - kms:ListKeyPolicies
              - kms:ListKeys
              - kms:ListResourceTags
              - kms:ListRetirableGrants
              - kms:ReEncryptFrom
              - kms:ReEncryptTo
            Resource: "*"
          - Sid: Allow S3 service use of the key
            Effect: Allow
            Principal:
              Service: s3.amazonaws.com
            Action:
              - kms:Decrypt
              - kms:DescribeKey
              - kms:Encrypt
              - kms:GenerateDataKey
              - kms:GenerateDataKeyWithoutPlaintext
              - kms:GenerateRandom
              - kms:GetKeyPolicy
              - kms:GetKeyRotationStatus
              - kms:ListAliases
              - kms:ListGrants
              - kms:ListKeyPolicies
              - kms:ListKeys
              - kms:ListResourceTags
              - kms:ListRetirableGrants
              - kms:ReEncryptFrom
              - kms:ReEncryptTo
            Resource: "*"
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



source/repositories/compliant-framework-management-services-core/templates/management-services-logging-assets.yml [35:121]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      EnableKeyRotation: true
      KeyPolicy:
        Version: 2012-10-17
        Id: key-policy-1
        Statement:
          - Sid: Allow administration of the key
            Effect: Allow
            Principal:
              AWS:
                - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:root
            Action:
              - kms:CancelKeyDeletion
              - kms:CreateAlias
              - kms:CreateGrant
              - kms:CreateKey
              - kms:DeleteAlias
              - kms:DeleteImportedKeyMaterial
              - kms:DescribeKey
              - kms:DisableKey
              - kms:DisableKeyRotation
              - kms:EnableKey
              - kms:EnableKeyRotation
              - kms:GenerateDataKeyWithoutPlaintext
              - kms:GenerateRandom
              - kms:GetKeyPolicy
              - kms:GetKeyRotationStatus
              - kms:GetParametersForImport
              - kms:ImportKeyMaterial
              - kms:ListAliases
              - kms:ListGrants
              - kms:ListKeyPolicies
              - kms:ListKeys
              - kms:ListResourceTags
              - kms:ListRetirableGrants
              - kms:PutKeyPolicy
              - kms:RetireGrant
              - kms:RevokeGrant
              - kms:ScheduleKeyDeletion
              - kms:TagResource
              - kms:UntagResource
              - kms:UpdateAlias
              - kms:UpdateKeyDescription
            Resource: "*"
          - Sid: Allow Account root use of the key
            Effect: Allow
            Principal:
              AWS: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:root
            Action:
              - kms:Decrypt
              - kms:DescribeKey
              - kms:Encrypt
              - kms:GenerateDataKey
              - kms:GenerateDataKeyWithoutPlaintext
              - kms:GenerateRandom
              - kms:GetKeyPolicy
              - kms:GetKeyRotationStatus
              - kms:ListAliases
              - kms:ListGrants
              - kms:ListKeyPolicies
              - kms:ListKeys
              - kms:ListResourceTags
              - kms:ListRetirableGrants
              - kms:ReEncryptFrom
              - kms:ReEncryptTo
            Resource: "*"
          - Sid: Allow S3 service use of the key
            Effect: Allow
            Principal:
              Service: s3.amazonaws.com
            Action:
              - kms:Decrypt
              - kms:DescribeKey
              - kms:Encrypt
              - kms:GenerateDataKey
              - kms:GenerateDataKeyWithoutPlaintext
              - kms:GenerateRandom
              - kms:GetKeyPolicy
              - kms:GetKeyRotationStatus
              - kms:ListAliases
              - kms:ListGrants
              - kms:ListKeyPolicies
              - kms:ListKeys
              - kms:ListResourceTags
              - kms:ListRetirableGrants
              - kms:ReEncryptFrom
              - kms:ReEncryptTo
            Resource: "*"
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



