Allow Principals to Encrypt via KMS but Deny Decrypt via KMS

1{
2  "Statement": [
3    {
4      "Sid": "DenyDecrypt",
5      "Effect": "Deny",
6      "Action": "kms:Decrypt",
7      "Resource": "*"
8    },
9    {
10      "Sid": "AllowEncrypt",
11      "Effect": "Allow",
12      "Action": "kms:Encrypt",
13      "Resource": "*"
14    }
15  ],
16  "Version": "2012-10-17"
17}