A machine learning engineer is using Amazon SageMaker to train a model. The training data is stored in an S3 bucket encrypted with AWS KMS. The SageMaker training job fails with an AccessDenied error when trying to read the data. Which IAM policy addition should resolve the issue?