How can I declare a KMS Key with a policy that references the ID of the declared key? e.g.

// KMS
  // <https://docs.aws.amazon.com/awscloudtrail/latest/userguide/encrypting-cloudtrail-log-files-with-aws-kms.html>
  const cloudTrailKmsKey: aws.kms.Key = new aws.kms.Key(`${appName}-kms-trail-key`, {
    deletionWindowInDays: 7,
    description: "CloudTrail Trail key",
    policy: accountId.apply(awsAccountId => {
      return JSON.stringify({
        Version: "2012-10-17",
        Statement: [
          {
            Sid: "AllowRootForKms",
            Effect: "Allow",
            Principal: { AWS: `arn:aws:iam::${awsAccountId}:root` },
            Action: "kms:*",
            Resource: "*",
          },
          {
            Sid: "AllowCloudTrailDecryptLogs",
            Effect: "Allow",
            Principal: { Service: "<http://cloudtrail.amazonaws.com|cloudtrail.amazonaws.com>" },
            Action: "kms:Decrypt",
            Resource: "${cloudTrailKmsKey.arn} GOES HERE",
            Condition: {
              Null: { "kms:EncryptionContext:aws:cloudtrail:arn": "false" },
            },
          },
        ],
      });
    }),
  });