Without the permission command `aws kms --region=us-west-1 create-key --description="kube-aws assets"` will fail with:
An error occurred (AccessDeniedException) when calling the CreateKey operation: