"myKey" : {
      "Type" : "AWS::KMS::Key",
      "Properties" : {
          "Description" : "A sample key",
          "KeyPolicy" : {
              "Version": "2012-10-17",
              "Id": "key-default-1",
              "Statement": [
                  {
                      "Sid": "Allow administration of the key",
                      "Effect": "Allow",
                      "Principal": { "AWS": "arn:aws:iam::123456789012:user/Alice" },
                      "Action": [
                          "kms:Create*",
                          "kms:Describe*",
                          "kms:Enable*",
                          "kms:List*",
                          "kms:Put*",
                          "kms:Update*",
                          "kms:Revoke*",
                          "kms:Disable*",
                          "kms:Get*",
                          "kms:Delete*",
                          "kms:ScheduleKeyDeletion",
                          "kms:CancelKeyDeletion"
                      ],
                      "Resource": "*"
                  },
                  {
                      "Sid": "Allow use of the key",
                      "Effect": "Allow",
                      "Principal": { "AWS": "arn:aws:iam::123456789012:user/Bob" },
                      "Action": [
                          "kms:Encrypt",
                          "kms:Decrypt",
                          "kms:ReEncrypt",
                          "kms:GenerateDataKey*",
                          "kms:DescribeKey"
                      ], 
                      "Resource": "*"
                  }
              ]
          }
      }
  }