This template creates a symmetric encryption KMS key with a resource tag. The key policy allows a specific IAM user to manage the key.

CloudFormation Template