In Cloudtrail, AWS KMS events are treated as Management events - technically, a decrypt or encrypt operation is something that acts on data & ideally, it should be a Data op
