These 2 don't need substitution...

Author: xschildw

src/main/resources/templates/global/rds-snapshot-encryption-key.json.vpt

@@ -48,7 +48,7 @@
                         {
                             "Sid": "Allow use of the key",
                             "Effect": "Allow",
-                            "Principal": { "AWS": { "Fn::Sub": "arn:aws:iam::766808016710:root" } },
+                            "Principal": { "AWS": { "arn:aws:iam::766808016710:root" },
                             "Action": [
                                 "kms:Decrypt",
                                 "kms:DescribeKey"
@@ -58,7 +58,7 @@
                         {
                             "Sid": "Allow attachment of persistent resources",
                             "Effect": "Allow",
-                            "Principal": { "AWS": { "Fn::Sub": "arn:aws:iam::766808016710:root" } },
+                            "Principal": { "AWS": { arn:aws:iam::766808016710:root" },
                             "Action": [
                                 "kms:CreateGrant",
                                 "kms:ListGrants",