{
 "Version": "2012-10-17",
 "Statement": [
   {
     "Effect": "Allow",
     "Action": [
       "kms:Decrypt"
     ],
     "Resource": [
       "<your KMS key ARN>"
     ]
   }
 ]
}