KMS alias resolves correctly but decrypt still fails for the app role

The application can discover the key alias and reach KMS, yet decrypt operations fail because the key policy and IAM policy do not grant the same effective path.