无法将KMS授予分配给AWS中的角色

我在KMS中有一个加密密钥，它有两个角色：一个KeyAdmin角色，应被允许为KeyUser角色创建授权，然后，该用户应能够使用该密钥进行加密/解密。

这是我在做什么：

$ aws kms create-key
{
    "KeyMetadata": {
        "AWSAccountId": "1234567890",
        "KeyId": "99999999-9999-9999-9999-999999999999",
        "Arn": "arn:aws:kms:eu-north-1:1234567890:key/99999999-9999-9999-9999-999999999999",
        "CreationDate": 1583827994.922,
        "Enabled": true,
        "Description": "",
        "KeyUsage": "ENCRYPT_DECRYPT",
        "KeyState": "Enabled",
        "Origin": "AWS_KMS",
        "KeyManager": "CUSTOMER",
        "CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
        "EncryptionAlgorithms": [
            "SYMMETRIC_DEFAULT"
        ]
    }
}

$ cat /tmp/kp.json 
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "KeyAdmin",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::1234567890:role/keyadmin-role"
            },
            "Action": "kms:CreateGrant",
            "Resource": "*"
        },
        {
            "Sid": "KMS account admin access",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::1234567890:root"
            },
            "Action": "kms:*",
            "Resource": "*"
        }
    ]
}

$ aws kms put-key-policy --key-id 99999999-9999-9999-9999-999999999999 --policy-name default --policy file:///tmp/kp.json

$ aws --profile keyadmin-role kms create-grant --key-id 99999999-9999-9999-9999-999999999999 --grantee-principal awn:aws:iam:::1234567890/role/keyuser-role --operations Encrypt Decrypt
{
    "GrantToken": "AQpANGJiNDRhMjVhNGRmNjY0MDBjYTU2YWNlOTkyNWVjNDBkNmFlMDA1Nzc2MmEzMjFkZjk1N2Q2ODc1NzU2ZDYxMiKpAgEBAgB4S7RKJaTfZkAMpWrOmSXsQNauAFd2KjId-VfWh1dW1hIAAAEAMIH9BgkqhkiG9w0BBwagge8wgewCAQAwgeYGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQML6vpVnNolKHIUz9eAgEQgIG4WcppsyTfo4BBKLvV02Wz1K6LlxpNXhhEZVFlCnTzO3Lsat5LBwtlCilPxpcW5N7f8ucjfi_AiH5VYM50_nNqGF1rH5GgzZoDXn76salNvzxF9YoPP3iWiH-NQ7O695kv0svhdONpfrk8nNCBvOeQbQDj9sLCUGbOI3Di51YKKzb9TZd_hwRxWcniAnYphqQkpyYIKttwHmsftZaODzEM64Rj_hU1_bexRwzPW8E75wnjrS_vNNXCHCog5DA2gg4zsbNyECk3qsGQk8yESJzwsKT_lP6Cf8nqrps",
    "GrantId": "e43036820e33b1b372102937aac19093cc84489cf0b0a4ff94fe827fc9eaae9b"
}
$ aws kms list-grants --key-id 99999999-9999-9999-9999-999999999999
{
    "Grants": [
        {
            "KeyId": "arn:aws:kms:eu-north-1:1234567890:key/99999999-9999-9999-9999-999999999999",
            "GrantId": "e43036820e33b1b372102937aac19093cc84489cf0b0a4ff94fe827fc9eaae9b",
            "Name": "",
            "CreationDate": 1583828859.0,
            "GranteePrincipal": "awn:aws:iam:::1234567890/role/keyuser-role",
            "IssuingAccount": "arn:aws:iam::1234567890:root",
            "Operations": [
                "Decrypt",
                "Encrypt"
            ]
        }
    ]
}
$ aws  --profile keyuser-role kms encrypt --key-id 99999999-9999-9999-9999-999999999999 --plaintext "foo"

An error occurred (AccessDeniedException) when calling the Encrypt operation: User: arn:aws:sts::1234567890:assumed-role/keyuser-role/botocore-session-1583827952 is not authorized to perform: kms:Encrypt on resource: arn:aws:kms:eu-north-1:1234567890:key/99999999-9999-9999-9999-999999999999

$ aws  --profile keyuser-role kms encrypt --key-id 99999999-9999-9999-9999-999999999999 --plaintext "foo" --grant-tokens "AQpANGJiNDRhMjVhNGRmNjY0MDBjYTU2YWNlOTkyNWVjNDBkNmFlMDA1Nzc2MmEzMjFkZjk1N2Q2ODc1NzU2ZDYxMiKpAgEBAgB4S7RKJaTfZkAMpWrOmSXsQNauAFd2KjId-VfWh1dW1hIAAAEAMIH9BgkqhkiG9w0BBwagge8wgewCAQAwgeYGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQML6vpVnNolKHIUz9eAgEQgIG4WcppsyTfo4BBKLvV02Wz1K6LlxpNXhhEZVFlCnTzO3Lsat5LBwtlCilPxpcW5N7f8ucjfi_AiH5VYM50_nNqGF1rH5GgzZoDXn76salNvzxF9YoPP3iWiH-NQ7O695kv0svhdONpfrk8nNCBvOeQbQDj9sLCUGbOI3Di51YKKzb9TZd_hwRxWcniAnYphqQkpyYIKttwHmsftZaODzEM64Rj_hU1_bexRwzPW8E75wnjrS_vNNXCHCog5DA2gg4zsbNyECk3qsGQk8yESJzwsKT_lP6Cf8nqrps"

An error occurred (AccessDeniedException) when calling the Encrypt operation: User: arn:aws:sts::1234567890:assumed-role/keyuser-role/botocore-session-1583827952 is not authorized to perform: kms:Encrypt on resource: arn:aws:kms:eu-north-1:1234567890:key/99999999-9999-9999-9999-999999999999

$ aws  --profile keyuser-role sts get-caller-identity
{
    "UserId": "AROA2AD3X6CJC6MODMUZP:botocore-session-1583827952",
    "Account": "1234567890",
    "Arn": "arn:aws:sts::1234567890:assumed-role/keyuser-role/botocore-session-1583827952"
}

为什么持有授权角色拒绝访问密钥？

角色没有附加任何IAM策略。