fix(mpc-party): split KMS permissions for GetPublicKey action

Signed-off-by: Ghislain Cheng <ghislain.cheng@zama.ai>

Author: maxnovawind

modules/mpc-party/main.tf

@@ -262,6 +262,16 @@ resource "aws_kms_key" "mpc_party" {
   policy = jsonencode({
     Version = "2012-10-17"
     Statement = [
+      {
+        Effect = "Allow",
+        Principal = {
+          AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${module.iam_assumable_role_mpc_party.iam_role_name}"
+        },
+        Action = [
+          "kms:GetPublicKey",
+        ],
+        Resource = "*",
+      },
       {
         Effect = "Allow",
         Principal = {
@@ -270,7 +280,6 @@ resource "aws_kms_key" "mpc_party" {
         Action = [
           "kms:Decrypt",
           "kms:GenerateDataKey",
-          "kms:GetPublicKey"
         ],
         Resource = "*",
         Condition = {
@@ -343,7 +352,6 @@ resource "aws_kms_key" "mpc_party_backup" {
         Action = [
           "kms:Decrypt",
           "kms:GenerateDataKey",
-          "kms:GetPublicKey"
         ],
         Resource = "*",
         Condition = {