add missing permission

* https://docs.aws.amazon.com/awscloudtrail/latest/userguide/encrypting-cloudtrail-log-files-with-aws-kms.html
widdix · Feb 12, 2024 · 4c755b3 · 4c755b3
1 parent c62e8dc
commit 4c755b3
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/security/kms-key.yaml b/security/kms-key.yaml
@@ -188,6 +188,7 @@ Resources:
               Service: 'cloudtrail.amazonaws.com'
             Action:
             - 'kms:GenerateDataKey*'
+            - 'kms:DescribeKey'
             Resource: '*'
             Condition:
               StringLike: