I have written a policy following AWS documentation on how to set up an Amazon SNS topic with server-side encryption. I am following this example –
Set up an Amazon SNS topic with server-side encryption.

Here is my cloudformation script for your reference –

AWSTemplateFormatVersion: 2010-09-09
Description: SNS Topic with policy

Resources:
  TestTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: test

  TestTopicPolicy:
    DependsOn:
     - "TestTopic"
    Type: AWS::SNS::TopicPolicy
    Properties:
      Topics:
        - !Ref TestTopic
      PolicyDocument:
        Id: TopicPolicy
        Version: 2008-10-17
        Statement:
          - Sid: FirstTopicStatement
            Effect: Allow
            Principal:
              Service: "s3.amazonaws.com"
            Action:
              - SNS:Publish
            Resource: !Ref TestTopic
            Condition:
              ArnEquals:
                aws:SourceArn: !Join ["", ["arn:aws:s3:::", !Sub "test-bucket-${AWS::AccountId}"]]

          - Sid: "EncryptionAtRest"
            Effect: "Allow"
            Principal:
              Service: "sns.amazonaws.com"
            Action:
              - "kms:Decrypt"
              - "kms:GenerateDataKey"
            Resource: "*"
            Condition:
              StringEquals:
                kms:EncryptionContext:aws:sns:topicArn: !Ref TestTopic

When i am executing the script, i am getting the following error –

Resource handler returned message: "Invalid parameter: Policy statement action out of service scope! (Service: Sns, Status Code: 400, Request ID

The problem is with the second policy. If i remove the second policy, it is working.

The same script ran correctly only few days back. I am not sure if something changed in between. Thanks in advance for your help.