CloudFormation - Not able to create KMS

Question

I am trying to create a KMS Key using Cloudformation unfortunately I am not able to create it. In the console I am getting the following error :

null (Service: Kms, Status Code: 400, Request ID: 156b452d-8ffb-5517-9jbc-a6yh6e3a79, Extended Request ID: null)

I am not able to understand the root cause of the issue. Please refer to the attached template which I am using to create the KMS :

AWSTemplateFormatVersion: 2010-09-09
Description: Testing KMS Using CloudFormation
        
Resources:
  KMSEncryption:
    Type: AWS::KMS::Key
    Properties:
      Description: KMS-Key
      KeyPolicy:
        Version: '2012-10-17'
        Id: encryption-key
        EnableKeyRotation: 'True'
        PendingWindowInDays: 7
        Statement:
        - Sid: Enable IAM User Permissions
          Effect: Allow
          Principal:
            AWS:
              Fn::Join:
              - ''
              - - 'arn:aws:iam::'
                - Ref: AWS::AccountId
                - :root
          Action: kms:*
          Resource: '*'
        - Sid: Allow use of the key
          Effect: Allow
          Principal:
            AWS:
              Fn::Join:
              - ''
              - - 'arn:aws:iam::'
                - Ref: AWS::AccountId
                - :role/
                - !Ref KMSLambdaRole
          Action:
          - kms:DescribeKey
          - kms:Encrypt
          - kms:Decrypt
          - kms:ReEncrypt*
          - kms:GenerateDataKey
          - kms:GenerateDataKeyWithoutPlaintext
          Resource: '*'
        - Sid: Allow administration of the key
          Effect: Allow
          Principal:
            AWS: arn:aws:iam::xxxxxxxxx:user/Shiv
          Action:
          - kms:Create*
          - kms:Describe*
          - kms:Enable*
          - kms:List*
          - kms:Put*
          - kms:Update*
          - kms:Revoke*
          - kms:Disable*
          - kms:Get*
          - kms:Delete*
          - kms:ScheduleKeyDeletion
          - kms:CancelKeyDeletion

  EncryptionAlias:
    Type: AWS::KMS::Alias
    Properties:
      AliasName: 'Testing'
      TargetKeyId:
        Ref: KMSEncryption

  KMSLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: 'TestingKMSAccess'
      AssumeRolePolicyDocument:
        Statement:
        - Action: ['sts:AssumeRole']
          Effect: Allow
          Principal:
            Service: [lambda.amazonaws.com]
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/ReadOnlyAccess
      Policies:
        - PolicyName: AWSLambdaBasicExecutionRole
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Sid: SQS
                Action:
                  - 'sqs:SendMessage'
                  - 'sqs:SendMessageBatch'
                Effect: Allow
                Resource: '*'

Answer 1

Your EnableKeyRotation and PendingWindowInDays should be outside of KeyPolicy:

Resources:
  KMSEncryption:
    Type: AWS::KMS::Key
    Properties:
      Description: KMS-Key
      EnableKeyRotation: 'True'
      PendingWindowInDays: 7
      KeyPolicy:
        Version: '2012-10-17'
        Id: encryption-key
      # the rest

Note, that there could be other issues which are not yet apparent, e.g. non-existing principles.