How to solve Unable to decrypt data key and one or more KMS CMKs had an error?

I have work on third-party message provide ( SendGrid ) with Cognito. for sending otp to user email whenever user signup or forget pass, ..etc, like this. here I am facing one issue.

"Error: Unable to decrypt data key and one or more KMS CMKs had an error. ",
      "  Error #1 ",
      " AccessDeniedException: The ciphertext refers to a customer master key that does not exist, does not exist in this region, or you are not allowed to access.",

**i am not able to decrypt the t cognito secret code **

i am writing my code following this blog:

https://blog.xiggit.com/blog/how-we-use-customer.io-to-send-custom-welcome-emails-through-cognito

https://www.thelambdablog.com/how-to-decrypt-aws-cognito-generated-temporary-codes-in-a-custom-sender-lambda-with-a-kms-key/

so, my quiz is: how to create IAM role + **KMS ** for decrypting Cognito code-parameter.

please anyone help me. thanks

const AWS = require("aws-sdk")
const b64 = require("base64-js")
const encryptionSdk = require("@aws-crypto/client-node")
const env = require("./config/environment.js")

const { encrypt, decrypt } = encryptionSdk.buildClient(
  encryptionSdk.CommitmentPolicy.REQUIRE_ENCRYPT_ALLOW_DECRYPT
)

const generatorKeyId = env.KMS_KEY_ALIAS
const keyIds = [env.KMS_KEY_ID]

const keyring = new encryptionSdk.KmsKeyringNode({ generatorKeyId, keyIds })

exports.handler = async (event) => {
  const { plaintext, messageHeader } = await decrypt(
    keyring,
    b64.toByteArray(event.request.code)
  )

  console.log(event)

  console.log("---------")
  console.log(event.request.code)

  console.log("otp code: " + plaintext)
  console.log("messageHeader: " + messageHeader)

  let triggerSource = event.triggerSource
  let email = event.request.userAttributes.email

  return
}```