KMS-Deny-the-accidental-or-intentional-deletion-of-a-KMS-key-and-only-allow-specific-roles-to-delete-KMS-keys.json

{
    "Version":"2012-10-17",
    "Statement":[
       {
          "Effect":"Deny",
          "Principal":"*",
          "Action":[
             "kms:ScheduleKeyDeletion",
             "kms:DeleteAlias",
             "kms:DeleteCustomKeyStore",
             "kms:DeleteImportedKeyMaterial"
          ],
          "Resource":"*",
          "Condition":{
             "ArnNotLike":{
                "aws:PrincipalArn":"arn:aws:iam::${Account}:role/[PRIVILEGED_ROLE]"
             }
          }
       }
    ]
 }