AWS Lambda からの KMSAccessDeniedException エラーを解決するにはどうすればよいですか?

Calling the invoke API action failed with this message: Lambda was unable to decrypt the environment variables because KMS access was denied. Please check the function's KMS key settings. KMS Exception: UnrecognizedClientExceptionKMS Message: The security token included in the request is invalid.

$ aws lambda get-function-configuration --function-name yourFunctionName

$ aws lambda update-function-configuration --function-name yourFunctionName --role temporaryValue

$ aws lambda update-function-configuration --function-name yourFunctionName --role originalValue

$ aws lambda update-function-configuration --function-name yourFunctionName --kms-key-arn temporaryValue

$ aws lambda update-function-configuration --function-name yourFunctionName --kms-key-arn originalValue

Lambda was unable to decrypt your environment variables because the KMS access was denied. Please check your KMS permissions. KMS Exception: AccessDeniedException KMS Message: The ciphertext refers to a customer master key that does not exist, does not exist in this region, or you are not allowed to access.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "kms:Decrypt",
            "Resource": "your-KMS-key-arn"
        }
    ]
}

You are not authorized to perform: kms:Encrypt.

You are not authorized to perform: kms:CreateGrant.

User: user-arn is not authorized to perform: kms:ListAliases on resource: * with an explicit deny.

"Statement": [
        {
            "Sid": "statement1",
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt",
                "kms:Encrypt",
                "kms:CreateGrant",
            ],
            "Resource": "your-kms-key-arn"
        },
        {
            "Sid": "statement2",
            "Effect": "Allow",
            "Action": "kms:ListAliases",
            "Resource": "*"
        }
    ]