{
  "Resources": {
    "MyKey6AB29FA6": {
      "Type": "AWS::KMS::Key",
      "Properties": {
        "KeyPolicy": {
          "Statement": [
            {
              "Action": [
                "kms:Create*",
                "kms:Describe*",
                "kms:Enable*",
                "kms:List*",
                "kms:Put*",
                "kms:Update*",
                "kms:Revoke*",
                "kms:Disable*",
                "kms:Get*",
                "kms:Delete*",
                "kms:ScheduleKeyDeletion",
                "kms:CancelKeyDeletion"
              ],
              "Effect": "Allow",
              "Principal": {
                "AWS": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition"
                      },
                      ":iam::",
                      {
                        "Ref": "AWS::AccountId"
                      },
                      ":root"
                    ]
                  ]
                }
              },
              "Resource": "*"
            },
            {
              "Action": "kms:encrypt",
              "Effect": "Allow",
              "Principal": {
                "AWS": {
                  "Ref": "AWS::AccountId"
                }
              },
              "Resource": "*"
            }
          ],
          "Version": "2012-10-17"
        }
      },
      "DeletionPolicy": "Retain"
    },
    "MyKeyAlias1B45D9DA": {
      "Type": "AWS::KMS::Alias",
      "Properties": {
        "AliasName": "alias/bar",
        "TargetKeyId": {
          "Fn::GetAtt": [
            "MyKey6AB29FA6",
            "Arn"
          ]
        }
      }
    }
  }
}