[
  {
    "Sid": "Allows accounts to Describe the KMS Key",
    "Effect": "Allow",
    "Principal": {
      "AWS": "arn:aws:iam::<pingcap-account>:root"
    },
    "Action": "kms:DescribeKey",
    "Resource": "*"
  },
  {
    "Sid": "Allows accounts to use KMS keys for data encryption and decryption with external ID.",
    "Effect": "Allow",
    "Principal": {
      "AWS": "arn:aws:iam::<pingcap-account>:root"
    },
    "Action": ["kms:Encrypt", "kms:Decrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*"],
    "Resource": "*",
    "Condition": {
      "StringEquals": {
        "kms:EncryptionContext:ExternalId": "<external-id>"
      }
    }
  },
  {
    "Sid": "Allows accounts to create grants for KMS keys.",
    "Effect": "Allow",
    "Principal": {
      "AWS": "arn:aws:iam::<pingcap-account>:root"
    },
    "Action": "kms:CreateGrant",
    "Resource": "*",
    "Condition": {
      "Bool": {
        "kms:GrantIsForAWSResource": "true"
      }
    }
  }
]