- the
lab account
policy was not in the prior comments, its the plain jane vanilla default one generated at KMS key creation:
{
"Id": "key-consolepolicy-3",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Enable IAM User Permissions",