make deploy ENV=dev
...
Terraform will perform the following actions:
...
  # module.santa_api.module.rule_store.aws_kms_key.store_sse_key will be updated in-place
  ~ resource "aws_kms_key" "store_sse_key" {
        id                                 = "******
      ~ policy                             = jsonencode(
          ~ {
              ~ Statement = [
                    # (2 unchanged elements hidden)
                    {
                        Action    = [
                            "kms:List*",
                            "kms:Get*",
                            "kms:Describe*",
                        ]
                        Effect    = "Allow"
                        Principal = {
                            Service = "dynamodb.amazonaws.com"
                        }
                        Resource  = "*"
                        Sid       = "Allow DynamoDB to get information about the CMK"
                    },
                  + {
                      + Action    = [
                          + "kms:Update*",
                          + "kms:UntagResource",
                          + "kms:TagResource",
                          + "kms:ScheduleKeyDeletion",
                          + "kms:Revoke*",
                          + "kms:ReEncrypt*",
                          + "kms:Put*",
                          + "kms:List*",
                          + "kms:Get*",
                          + "kms:GenerateDataKey*",
                          + "kms:Encrypt",
                          + "kms:Enable*",
                          + "kms:Disable*",
                          + "kms:DescribeKey",
                          + "kms:Describe*",
                          + "kms:Delete*",
                          + "kms:Decrypt",
                          + "kms:Create*",
                          + "kms:CancelKeyDeletion",
                        ]
                      + Effect    = "Allow"
                      + Principal = {
                          + AWS = [
                              + "*****",
                              + "*****,
                            ]
                        }
                      + Resource  = "*"
                      + Sid       = "Allow access for Key Administrators"
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        tags                               = {}
        # (10 unchanged attributes hidden)
    }
...
Plan: 3 to add, 8 to change, 3 to destroy.
Apply complete! Resources: 3 added, 8 changed, 3 destroyed.

Outputs:
sync_base_url = "https://***********"