Where to add key policy for encrypted sns topic

I have setup 2 sns topics, both has subscription endpoint is aws chatbot that will send message to slack. I use these for codepipeline notification. The first sns topics is configured to use kms key, the second is none. When testing, I notice that the first topic do not send notify to slack, but the second does. So I can conclude that kms key is the reason. How and where do I need to add policy to allow to use KMS key to decrypt the message