diff --git a/tf-lambda-iam-role.tf b/tf-lambda-iam-role.tf
index 3035eee..b9acc5d 100644
--- a/tf-lambda-iam-role.tf
+++ b/tf-lambda-iam-role.tf
@@ -44,7 +44,7 @@ data "aws_iam_policy_document" "log_retention" {
     for_each = var.kms_key_arn == null ? [] : [var.kms_key_arn]
     content {
       actions   = ["kms:GenerateDataKey"]
-      resources = [each.value]
+      resources = [statement.value]
     }
   }