Question

A developer builds a Lambda function that must decrypt objects using a specific customer managed KMS key in the same account. The function's execution role already has an identity-based policy granting kms:Decrypt on that key ARN. However, invocations fail with an AccessDeniedException when calling Decrypt. The KMS key's key policy contains only the default statement granting the root account 'kms:*' but no other statements. What is the MOST likely cause and the correct fix?

Accepted Answer

The default 'kms:*' to root only enables IAM policies to grant access; verify the execution role's policy is attached and the key ARN/region match, since the default policy already allows IAM-based delegation.

Answer

The default key policy with root 'kms:*' delegates permission management to IAM, so the failure is unrelated to KMS; the fix is to add a resource-based bucket policy allowing decrypt.

Answer

The default key policy delegates access control to IAM policies for that account, so the IAM role's kms:Decrypt permission should already work; the real cause is a missing kms:GenerateDataKey permission that must be added to the role.

Answer

A key policy statement explicitly granting the Lambda execution role kms:Decrypt is always mandatory even when the default root statement exists; add a key policy statement naming the role as principal.