You need to use

.apply

to create the JSON policy using the kms key. This `up`'s successfully for me, see line 24...