KMS keys should not be publicly accessible

How to fix it

Have the named key's policy name the principals that may use it, with no statement allowing every principal, including one written the other way round as everyone EXCEPT a named list. The operation writes the whole policy rather than merging into it: start from the current policy and keep the statement giving your own account administrative access, because a key nobody can administer cannot be recovered by you at all. Anything relying on the wildcard loses access the moment you save.

In the console

Key Management Service → Customer managed keys → the key → Key policy

With the AWS CLI

aws kms put-key-policy --key-id <key-id> --policy file://key-policy.json --region <region>

With Terraform

resource "aws_kms_key_policy" "this" {
  key_id = var.key_id
  policy = data.aws_iam_policy_document.no_public_access.json
}