Question

A developer is building a Lambda function that must decrypt data using a customer managed KMS key owned by the same AWS account. The function's execution role has an IAM policy that allows kms:Decrypt on the specific key ARN. However, calls to Decrypt fail with an AccessDeniedException. The KMS key policy contains only the default statement granting the account root full access. What is the MOST likely cause and correct fix?

Accepted Answer

The KMS key policy must explicitly delegate permissions to IAM by including a statement that allows the account principal to use IAM policies; add a statement granting the root principal kms:* so IAM policies take effect, or grant the role directly in the key policy.

Answer

IAM policies cannot grant KMS permissions at all; you must add a grant using the CreateGrant API for the Lambda execution role.

Answer

The Lambda function needs the kms:GenerateDataKey permission instead of kms:Decrypt, because Decrypt is only used for envelope key generation.

Answer

You must enable automatic key rotation on the customer managed key before the execution role can call Decrypt.