title: The new key policy will not allow you to update the key policy in the future
body: <p>The title says it all.  I am getting this error whenever I try to create a KMS key via an AWS CloudFormation template.  I am creating the template as an IAM user with administrative permissions, and I want the key to be manageable by any IAM user in the same AWS account with KMS permissions.  I am using the following YAML resource definition for the key:</p>
  
  <pre><code>LambdaKmsKey:
      Type: AWS::KMS::Key
      Properties:
        Enabled: true
        KeyPolicy:
          Version: 2012-10-17
          Statement:
          - Effect: Allow
            Action: kms:*
            Principal:
              AWS: &lt;Principle&gt;
  </code></pre>
  
  <p>And yet, NONE of the following values for <code>&lt;Principal&gt;</code> are working, even if I try to create the stack as the root user!</p>
  
  <ul>
  <li><code>!Join [ "", [ "arn:aws:iam::", !Ref "AWS::AccountId", ":root" ] ]</code></li>
  <li><code>!Join [ "", [ "arn:aws:sts::", !Ref "AWS::AccountId", ":root" ] ]</code></li>
  <li><code>!Ref "AWS::AccountId"</code></li>
  </ul>
  
  <p>I can't just hardcode my user name for the Principal because I want this template to be instantiable by anyone with stack creation permissions.  Does anyone know how to resolve this enormously frustrating situation?  Thanks in advance.</p>
  
  <p><strong>EDIT</strong>:</p>
  
  <p>I should mention that I no longer define KMS Key policies in CloudFormation Templates.  In fact, I now avoid defining <em>any</em> security resources in my CF Templates at all, such as IAM entities, policies, and ACM certificates.  My reasons for this are described in this <a href="https://github.com/DanwareCreations/AwsUtil/issues/3" rel="noreferrer">GitHub issue</a>.</p>