KMS key does not grant access to anonymous principals

# Restrict KMS key policy to the account root to avoid any public ("*") principals
data "aws_caller_identity" "current" {}

resource "aws_kms_key" "<example_resource_name>" {
  policy = jsonencode({
    Version   = "2012-10-17"
    Statement = [
      {
        Effect    = "Allow"
        Principal = { AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root" } # Critical: limit to account root to remove public access
        Action    = "kms:*"
        Resource  = "*"
      }
    ]
  })
}

# CloudFormation: restrict KMS key policy to account root (removes any public access)
Resources:
  <example_resource_name>:
    Type: AWS::KMS::Key
    Properties:
      KeyPolicy:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: arn:aws:iam::<account_id>:root  # Critical: only account root can access; prevents public "*" principals
            Action: kms:*
            Resource: '*'