AWS Key Management Service (KMS) CMK changes alarm

A CloudWatch alarm that triggers on changes to customer created CMKs: Key creation, deletion, or enabling/disabling operations, imported key material operations, as well as updates to CMK key policies.