SNS Encryption CMK "KMSAccessDeniedException"

[ellisium]

Hello,

How I try to publish SNS message encrypted via SDK client in lambda deployed via CDK however I get :
Error: CheckupSNS producer error: KMSAccessDeniedException: The ciphertext refers to a customer master key that does not exist, does not exist in this region, or you are not allowed to access. (Service: AWSKMS; Status Code: 400; Error Code: AccessDeniedException; Request ID: 230c4e85-0b4d-4472-970e-d9f6ececf014; Proxy: null)

const checkupSNSHandler =  new NodejsFunction(scope, id, {
   memorySize: config.stage === 'production' ? 1024 : 512,
   runtime: Runtime.NODEJS_18_X,
   timeout: Duration.minutes(1),
   ...lambdaProps,
   bundling: {
     sourceMap: true,
     sourcesContent: false,
     ...lambdaProps.bundling,
   },
   environment: {
     ...(props?.eventBus
       ? { EVENT_BUS_NAME: props.eventBus.eventBusName }
       : {}),
     GATEWAY_ORIGIN: `https://${getSubDomainName('gw')}.${
       config.domainName
     }`,
     IDENTITY_TOKEN_SECRET: config.identityTokenSecret,
     NODE_OPTIONS: '--enable-source-maps',
     RELEASE: config.release,
     STACK: config.subDomainName,
     STAGE: config.stage,
     ...lambdaProps.environment,
   },
 });

 const checkupSNSKey = new Key(this, 'checkupKey', {
   enableKeyRotation: true,
   removalPolicy: props.removalPolicy,
   description: 'KMS key for encrypting the objects in SNS Topic',
 });

 checkupSNSHandler.role?.addToPrincipalPolicy(
   new PolicyStatement({
     resources: [checkupSNSKey.keyArn],
     actions: ['kms:Encrypt', 'kms:GenerateDataKey'],
   }),
 );

 checkupSNSKey.addToResourcePolicy(
   new PolicyStatement({
     sid: 'Allow Lambda to use the key',
     actions: ['kms:Encrypt', 'kms:Decrypt', 'kms:GenerateDataKey'],
     effect: Effect.ALLOW,
     principals: [
       new AccountRootPrincipal(),
       new ServicePrincipal('lambda.amazonaws.com'),
       new ServicePrincipal('sns.amazonaws.com'),
     ],
     resources: ['*'],
   }),
 );