The minimum permissions to give the DataSync IAM role on your KMS key policy if your S3 bucket is encrypted with that KMS key.

datasync-kms-key-policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
        "Sid": "Allow use of the key to the DataSync role",
        "Effect": "Allow",
        "Principal": {
            "AWS": [
                "arn:aws:iam::012345678910:role/service-role/AWSDataSyncS3BucketAccess-yann-stoneman-dev-storage-us-east-1-012345678910"
            ]
        },
        "Action": [
            "kms:Encrypt",
            "kms:Decrypt",
            "kms:ReEncrypt*",
            "kms:GenerateDataKey*",
            "kms:DescribeKey"
        ],
        "Resource": "*"
    }
  ]
}