The AWS service or identity that receives the permission. At this time, the only valid principal is acm.amazonaws.com.