anchor.diff:      --name NAME \
       --value World \
       --type SecureString \
  -    --key-id arn:aws:kms:us-east-1:123456789012:key/414a963b-7fe4-4a61-b19f-ea408b9bda3b
  +    --key-id arn:aws:kms:us-east-1:<account-id>:key/414a963b-7fe4-4a61-b19f-ea408b9bda3b
     {
         "Version": 1
     }
  
positive.code:                     "ssm:GetParameter"
                  ],
                  "Resource": [
                      "arn:aws:ssm:us-east-1:123456789012:parameter/GREETING",
                      "arn:aws:ssm:us-east-1:123456789012:parameter/NAME"
                  ]
              }
          ]
  
negative.code:         "Effect": "Allow",
          "Principal": {
            "AWS": [
              "arn:aws:iam::<account-id>:root"
            ]
          },
          "Action": "kms:*",
  