Adds a cross-account KMS key policy allowing encrypt/decrypt from the specified account IDs.
Used by training, pipeline, and deploy constructs for cross-account model artifact access.
Parameters
kmsKey: IKey
The KMS key to add the policy to (must support addToResourcePolicy)
accountIds: string[]
Target account IDs for cross-account access
kmsActions: string[]
KMS actions to grant (e.g., DECRYPT_ACTIONS + ENCRYPT_ACTIONS from @aws-mdaa/kms-constructs)
Adds a cross-account KMS key policy allowing encrypt/decrypt from the specified account IDs. Used by training, pipeline, and deploy constructs for cross-account model artifact access.