Question

A developer manages a customer managed KMS key in Account A that encrypts objects in an S3 bucket. A Lambda function running in Account B must decrypt those objects. The developer has already added an IAM policy to the Lambda execution role in Account B allowing kms:Decrypt on the key ARN, but the function still receives an AccessDeniedException from KMS. What is the MOST likely cause and correct fix?

Accepted Answer

The KMS key policy in Account A does not grant access to Account B; update the key policy to allow Account B (or its principal) to use the key, in addition to the IAM policy in Account B.

Answer

Cross-account KMS decryption is not supported; copy the key material to Account B and re-encrypt the objects.

Answer

The Lambda role needs the kms:CreateGrant permission on itself; add it to the Account B IAM policy to enable decryption.

Answer

The key must be an AWS managed key rather than a customer managed key for cross-account access to work.