Question

A financial services company trains models in the us-east-1 account and copies the resulting model artifacts to an S3 bucket in a disaster-recovery account located in us-west-2. Both buckets use SSE-KMS with customer managed keys. When a SageMaker training job in us-east-1 tries to write artifacts that are then replicated, and when the DR account's SageMaker attempts to deploy the model, the team encounters AccessDenied errors on decryption. What is the MOST likely root cause and correct remediation?

Accepted Answer

The DR account's KMS key policy and the SageMaker execution role in that account do not grant kms:Decrypt on the DR-region key; update the key policy and role permissions to allow the DR SageMaker role to decrypt the replicated objects.

Answer

S3 replication cannot copy SSE-KMS encrypted objects at all; disable encryption on the source bucket so objects replicate in plaintext.

Answer

KMS keys are global resources, so the same key ARN works in both regions; the error is caused by an expired IAM session and will resolve on retry.

Answer

SageMaker automatically re-encrypts artifacts with an AWS managed key on deployment, so the customer managed key permissions are irrelevant; switch both buckets to SSE-S3.