KMS-Require-an-AWS-Key-Management-Service-key-policy-limiting-creation-of-AWS-KMS-grants-to-AWS-services.json

{
    "Version":"2012-10-17",
    "Statement":[
       {
          "Effect":"Deny",
          "Principal":"*",
          "Action":"kms:CreateGrant",
          "Resource":"*",
          "Condition":{
             "BoolIfExists":{
                "kms:GrantIsForAWSResource":"false",
                "aws:PrincipalIsAWSService":"false"
             }
          }
       }   
     ]
 }