+------------+-----------------------------------------------------------------------------+
| ID         | cck-001                                                                     |
| Key        | arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012 |
| Roles      | arn:aws:iam::123456789012:role/role1,                                       |
|            | arn:aws:iam::123456789012:role/role2                                        |
| Cloud      | AWS                                                                         |
| State      | IN_USE                                                                      |
| Created At | 2022-11-12 08:24:00 +0000 UTC                                               |
+------------+-----------------------------------------------------------------------------+

Copy and append these permissions into the key policy "Statements" field of the ARN in your AWS key management system to authorize access for your Confluent Cloud cluster.

{
	"Sid" : "Allow Confluent accounts to use the key",
	"Effect" : "Allow",
	"Principal" : {
		"AWS" : [
			"arn:aws:iam::123456789012:role/role1",
			"arn:aws:iam::123456789012:role/role2"
		]
	},
	"Action" : [ "kms:Encrypt", "kms:Decrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*", "kms:DescribeKey" ],
	"Resource" : "*"
}, {
	"Sid" : "Allow Confluent accounts to attach persistent resources",
	"Effect" : "Allow",
	"Principal" : {
		"AWS" : [
			"arn:aws:iam::123456789012:role/role1",
			"arn:aws:iam::123456789012:role/role2"
		]
	},
	"Action" : [ "kms:CreateGrant", "kms:ListGrants", "kms:RevokeGrant" ],
	"Resource" : "*"
}
