xdr-terraform-modules/thirdparty/terraform-aws-github-runner/modules/runner-binaries-syncer/policies/lambda-kms.json

{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": ["kms:GenerateDataKey", "kms:Decrypt"],
        "Resource": "${kms_key_arn}"
      }
    ]
  }