A key policy JSON document. If you do not provide a key policy, AWS KMS attaches a default key policy to the CMK.