Extended KMS authentication encrypt policy

encrypt-policy.json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "lambda:Invoke*"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:lambda:us-east-1:12345:function:awseipext-production-iad"
        },
        {
            "Action": [
                "kms:Encrypt"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:kms:us-east-1:12345:key/1234abcd-12ab-34cd-56ef-1234567890ab",
            "Condition": {
                "StringEquals": {
                    "kms:EncryptionContext:to": "awseipext-production-iad",
                    "kms:EncryptionContext:from": "myrole-production-iad",
                    "kms:EncryptionContext:user_type": "service"
                },
                "ForAnyValue:StringEquals": {
                    "kms:EncryptionContext:resource": [
                        "52.0.0.1"
                    ],
                    "kms:EncryptionContext:action": [
                        "associate",
                        "disassociate"
                    ]
                },
                "ForAllValues:StringEquals": {
                    "kms:EncryptionContextKeys": [
                        "to",
                        "from",
                        "user_type",
                        "action",
                        "resource"
                    ]
                }
            }
        }
    ]
}