When using Bucket Notifications with SQS (so, something like bucket.onObjectCreated(queue)), in the case the Queue is encrypted with a KMS Key, we correctly trust the S3 Service Principal in the Key's Resource Policy.

We need to do something similar in the case of an SNS subscription to an encrypted SQS Queue (so, topic.subscribeQueue(queue)) - the Key should trust the SNS Service Principal in that case.