diff --git a/modules/ManagementGovernance/acm-cert-expiry-notice/README.md b/modules/ManagementGovernance/acm-cert-expiry-notice/README.md
index 83198a7..76eb0fa 100644
--- a/modules/ManagementGovernance/acm-cert-expiry-notice/README.md
+++ b/modules/ManagementGovernance/acm-cert-expiry-notice/README.md
@@ -67,12 +67,12 @@ An error occurred (ValidationException) when calling the PutAccountConfiguration
 
 ## Inputs
 
-| Name | Description | Type | Default | Required |
-|------|-------------|------|---------|:--------:|
-| days-before-expiry | ACM DaysBeforeExpiry account configuration | `number` | `45` | no |
-| email-addresses | Set of email addresses to receive SNS notifications | `set(string)` | n/a | yes |
-| res-prefix | Resource name prefix | `string` | `"aws"` | no |
-| sns-kms-key-arn | ARN of KMS key used for SNS encryption | `string` | `null` | no |
+| Name | Description                                                                      | Type | Default | Required |
+|------|----------------------------------------------------------------------------------|------|---------|:--------:|
+| days-before-expiry | ACM DaysBeforeExpiry account configuration                                       | `number` | `45` | no |
+| email-addresses | Set of email addresses to receive SNS notifications                              | `set(string)` | n/a | yes |
+| res-prefix | Resource name prefix                                                             | `string` | `"aws"` | no |
+| sns-kms-key-arn | ARN of KMS key used for SNS encryption. This key must allow events.amazonaws.com | `string` | `null` | no |
 
 ## Outputs
 
diff --git a/modules/ManagementGovernance/acm-cert-expiry-notice/variables.tf b/modules/ManagementGovernance/acm-cert-expiry-notice/variables.tf
index 00997a4..13a63ec 100644
--- a/modules/ManagementGovernance/acm-cert-expiry-notice/variables.tf
+++ b/modules/ManagementGovernance/acm-cert-expiry-notice/variables.tf
@@ -17,6 +17,6 @@ variable "res-prefix" {
 
 variable "sns-kms-key-arn" {
   type        = string
-  description = "ARN of KMS key used for SNS encryption"
+  description = "ARN of KMS key used for SNS encryption. This key must allow events.amazonaws.com"
   default     = null
 }
\ No newline at end of file