diff --git a/modules/ManagementGovernance/acm-cert-expiry-notice/README.md b/modules/ManagementGovernance/acm-cert-expiry-notice/README.md
index 76eb0fa..fe50d39 100644
--- a/modules/ManagementGovernance/acm-cert-expiry-notice/README.md
+++ b/modules/ManagementGovernance/acm-cert-expiry-notice/README.md
@@ -11,6 +11,25 @@ This module sets up event rule and sns notification. Deliver email notifications
 
 An error occurred (ValidationException) when calling the PutAccountConfiguration operation: Days before expiry cannot be over 45.
 ```
+* KMS key for SNS must allow events.amazonaws.com. Check that this statement is present in the KMS key policy. Otherwise you will get FailedInvocation in event rule graph and there is no other debug info.
+```json
+{
+"Sid": "Allow publish from events",
+"Effect": "Allow",
+"Principal": {
+"Service": "events.amazonaws.com"
+},
+"Action": [
+"kms:Encrypt",
+"kms:Decrypt",
+"kms:ReEncrypt*",
+"kms:GenerateDataKey*",
+"kms:DescribeKey"
+],
+"Resource": "*"
+}
+```
+
 
 ## Sample Event bridge event
 ```json