title: CloudFormation - Not able to create KMS
body: <p>I am trying to create a KMS Key using Cloudformation unfortunately I am not able to create it. In the console I am getting the following error :</p>
  <pre><code>null (Service: Kms, Status Code: 400, Request ID: 156b452d-8ffb-5517-9jbc-a6yh6e3a79, Extended Request ID: null)
  </code></pre>
  <p>I am not able to understand the root cause of the issue. Please refer to the attached template which I am using to create the KMS :</p>
  <pre><code>AWSTemplateFormatVersion: 2010-09-09
  Description: Testing KMS Using CloudFormation
          
  Resources:
    KMSEncryption:
      Type: AWS::KMS::Key
      Properties:
        Description: KMS-Key
        KeyPolicy:
          Version: '2012-10-17'
          Id: encryption-key
          EnableKeyRotation: 'True'
          PendingWindowInDays: 7
          Statement:
          - Sid: Enable IAM User Permissions
            Effect: Allow
            Principal:
              AWS:
                Fn::Join:
                - ''
                - - 'arn:aws:iam::'
                  - Ref: AWS::AccountId
                  - :root
            Action: kms:*
            Resource: '*'
          - Sid: Allow use of the key
            Effect: Allow
            Principal:
              AWS:
                Fn::Join:
                - ''
                - - 'arn:aws:iam::'
                  - Ref: AWS::AccountId
                  - :role/
                  - !Ref KMSLambdaRole
            Action:
            - kms:DescribeKey
            - kms:Encrypt
            - kms:Decrypt
            - kms:ReEncrypt*
            - kms:GenerateDataKey
            - kms:GenerateDataKeyWithoutPlaintext
            Resource: '*'
          - Sid: Allow administration of the key
            Effect: Allow
            Principal:
              AWS: arn:aws:iam::xxxxxxxxx:user/Shiv
            Action:
            - kms:Create*
            - kms:Describe*
            - kms:Enable*
            - kms:List*
            - kms:Put*
            - kms:Update*
            - kms:Revoke*
            - kms:Disable*
            - kms:Get*
            - kms:Delete*
            - kms:ScheduleKeyDeletion
            - kms:CancelKeyDeletion
  
    EncryptionAlias:
      Type: AWS::KMS::Alias
      Properties:
        AliasName: 'Testing'
        TargetKeyId:
          Ref: KMSEncryption
  
    KMSLambdaRole:
      Type: AWS::IAM::Role
      Properties:
        RoleName: 'TestingKMSAccess'
        AssumeRolePolicyDocument:
          Statement:
          - Action: ['sts:AssumeRole']
            Effect: Allow
            Principal:
              Service: [lambda.amazonaws.com]
        Path: /
        ManagedPolicyArns:
          - arn:aws:iam::aws:policy/ReadOnlyAccess
        Policies:
          - PolicyName: AWSLambdaBasicExecutionRole
            PolicyDocument:
              Version: 2012-10-17
              Statement:
                - Sid: SQS
                  Action:
                    - 'sqs:SendMessage'
                    - 'sqs:SendMessageBatch'
                  Effect: Allow
                  Resource: '*'
  </code></pre>