# Overall
* Add second account

# KMS
* Figure out exactly what actions cloudwatch needs. `kms:*` is too permissive.

# SNS
* Allow use of custom key

# SQS
* Allow use of custom key