Question

A company stores encrypted application backups in S3 buckets located in us-east-1 and eu-west-1. All objects are encrypted using SSE-KMS with a single-Region customer managed key created in us-east-1. During a disaster recovery test, an EC2 instance running in eu-west-1 fails to decrypt objects that were replicated to the eu-west-1 bucket, returning an error even though the IAM role has kms:Decrypt permission and the key policy grants access to that role. What is the MOST likely cause and the recommended fix?

Accepted Answer

A single-Region KMS key can only be used to encrypt/decrypt in the Region where it was created; use a multi-Region key with a replica in eu-west-1 so the data can be decrypted locally.

Answer

The IAM role is missing kms:GenerateDataKey; add that permission so the eu-west-1 instance can decrypt the replicated objects.

Answer

S3 replication cannot copy SSE-KMS encrypted objects across Regions; disable KMS encryption on the destination bucket and use SSE-S3 instead.

Answer

The key policy must grant kms:Decrypt to the S3 service principal in eu-west-1; add s3.eu-west-1.amazonaws.com as a principal in the key policy.