- Once https://github.com/terraform-ibm-modules/terraform-ibm-cos/pull/764 is merged pull in the new version to the DA. That will ensure any KMS policy created in that module will be scoped to the key. - Update the cross account auth policy created in the DA directly to scope to the exact KMS key