  def ShareKMSKeyWithAWSAccount(self,
                                kms_key_id: str,
                                aws_account_id: str) -> None:
    """Share a KMS key.

    Args:
      kms_key_id (str): The KMS key ID of the key to share.
      aws_account_id (str): The AWS Account ID to share the KMS key with.

    Raises:
      RuntimeError: If the key could not be shared.
    """

    share_policy = {
        'Sid': 'Allow use of the key',
        'Effect': 'Allow',
        'Principal': {
            'AWS': 'arn:aws:iam::{0:s}:root'.format(aws_account_id)
        },
        'Action': [
            # kms:*crypt and kms:ReEncrypt* are necessary to transfer
            # encrypted EBS resources across accounts.
            'kms:Encrypt',
            'kms:Decrypt',
            'kms:ReEncrypt*',
            # kms:CreateGrant is necessary to transfer encrypted EBS
            # resources across regions.
            'kms:CreateGrant'
        ],
        'Resource': '*'
    }
    client = self.aws_account.ClientApi(common.KMS_SERVICE)
    try:
      policy = json.loads(client.get_key_policy(
          KeyId=kms_key_id, PolicyName='default')['Policy'])
      policy['Statement'].append(share_policy)
      # Update the key policy so that it is shared with the AWS account.
      client.put_key_policy(
          KeyId=kms_key_id, PolicyName='default', Policy=json.dumps(policy))
    except client.exceptions.ClientError as exception:
      raise RuntimeError('Could not share KMS key {0:s}: {1:s}'.format(
          kms_key_id, str(exception))) from exception
Share a KMS key.

Args:
kms_key_id (str): The KMS key ID of the key to share.
aws_account_id (str): The AWS Account ID to share the KMS key with.

Raises:
RuntimeError: If the key could not be shared.
libcloudforensics/providers/aws/internal/kms.py