KMS密钥创建报错：新密钥策略无法允许未来更新求助

使用KMS密钥模块创建密钥时，设置根账号为密钥所有者，另一个附加PowerUserAccess策略账号对应的SSO角色为管理者，创建或测试模块时收到报错：The new key policy will not allow you to update the key policy in the future。已确认两个账号均存在，代码如下：

module "secrets_manager_policy" {
  source      = "../../"
  description = "A KMS key with managed resource-policy."
  resource_policy_statements = {
    SecretOwner = {
      actions   = ["kms:*"]
      resources = ["*"]
      principals = {
        AWS = [
          "arn:aws:iam::000000:root"
        ]
      }
    }
    SecretManagers = {
      actions = [
        "kms:Decrypt",
        "kms:GenerateDataKey"
      ]
      resources = ["*"]
      principals = {
        AWS = [
          "arn:aws:iam::00000000:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_123445"
        ]
      }
      conditions = {
        StringLike = {
          "kms:ViaService" = [
            "secretsmanager.*.amazonaws.com"
          ]
        }
      }
    }
  }
}

这个报错的核心是执行Terraform创建密钥的身份未被包含在密钥策略中，导致创建后无法再更新密钥策略，AWS会强制校验这一点避免出现策略锁死。

修复步骤：

1. 补全账号ID：AWS账号ID是12位数字，你代码中根账号ARN的000000和管理者角色ARN的00000000位数不足，必须替换为正确的12位账号ID。
2. 确保执行身份有密钥策略修改权限：如果执行Terraform的身份不是根账号，需要在密钥策略中为该身份添加kms:PutKeyPolicy权限；如果是根账号，当前的SecretOwner语句已经授予kms:*权限，补全账号ID后即可解决问题。

修改后的示例代码（替换为正确的12位账号ID）：

module "secrets_manager_policy" {
  source      = "../../"
  description = "A KMS key with managed resource-policy."
  resource_policy_statements = {
    SecretOwner = {
      actions   = ["kms:*"]
      resources = ["*"]
      principals = {
        AWS = [
          "arn:aws:iam::123456789012:root" # 替换为正确的12位根账号ID
        ]
      }
    }
    SecretManagers = {
      actions = [
        "kms:Decrypt",
        "kms:GenerateDataKey"
      ]
      resources = ["*"]
      principals = {
        AWS = [
          "arn:aws:iam::987654321098:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_123445" # 替换为正确的12位管理者账号ID
        ]
      }
      conditions = {
        StringLike = {
          "kms:ViaService" = [
            "secretsmanager.*.amazonaws.com"
          ]
        }
      }
    }
  }
}

内容的提问来源于stack exchange，提问作者AnotherEngineer