how to develop aws policy to allow kms:GenerateDataKey in kms alias "fr-test-eu-central-1-afterbanking-kms-cessioncredit"

format cette policy """{ "Version" : "2012-10-17", "Statement" : [ { "Sid" : "AllowAssumerole", "Effect" : "Allow", "Principal" : { "AWS" : "arn:aws:iam::905418166282:role/fr-test-eu-central-1-cessioncredit-lambda-exec-role" }, "Action" : "secretsmanager:GetSecretValue", "Resource" : "*" } ] }"""