AWS service or identity that receives the permission. At this time, the only valid principal is acm.amazonaws.com.
acm.amazonaws.com