The policy [here](https://github.com/terraform-ibm-modules/terraform-ibm-icd-mongodb/blob/f43cef8d6fd25f5a300e9547d02e698b3b1c8141/main.tf#L36-L45) can be updated to scope it to the exact KMS key. For an example of the syntax, see https://github.com/terraform-ibm-modules/terraform-ibm-cos/pull/764