{
  "Version": "1",
  "Statement": [
    {
      "Sid": "allow_ram_role_to_use_kms_key",
      "Effect": "Allow",
      "Principal": {
        "RAM": ["acs:ram::<account-id>:*"]
      },
      "Action": ["kms:Encrypt", "kms:Decrypt", "kms:GenerateDataKey", "kms:DescribeKey"],
      "Resource": ["*"]
    }
  ]
}