https://external-secrets.io/latest/provider/aws-secrets-manager/#resource-policy-example

This implies that spec.metadata can be used to set metadata such as KMS Key or policy once for all data objects, but this is not the case.

$ kubectl explain pushsecret.spec.metadata
GROUP:      external-secrets.io
KIND:       PushSecret
VERSION:    v1alpha1

error: field "metadata" does not exist

Perhaps this was meant to be indented over to the right more so it's part of the first data object?