AppFlow permissions error when calling CreateConnectorProfile API

I'm calling CreateConnectorProfile from a Lambda, and I get the following error :

An error occurred (ValidationException) when calling the CreateConnectorProfile operation: CreateConnectorProfile failed as AppFlow is unable to create secret in customer account {MyAWSAccountId}. Ensure the IAM user has permissions secretsmanager:CreateSecret and secretsManager:PutResourcePolicy. If customer managed KMS key was provided, ensure AppFlow also has access to the key. Please give the required permissions and try to create the connector profile again.

My Lambda's execution role has the Managed Policy AmazonAppFlowFullAccess attached. The customer managed KMS Key (which is passed in as the kmsArn to the CreateConnectorProfile call) has the following policy :

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "appflow.amazonaws.com"
            },
            "Action": [
                "kms:Encrypt",
                "kms:GenerateDataKey",
                "kms:Decrpyt"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::{MyAwsAccountId}:root"
            },
            "Action": "kms:*",
            "Resource": "*"
        }
    ]
}

What permissions am I missing?