Question

A data engineering team stores analytics output in an S3 bucket encrypted with a customer managed KMS key. An IAM role used by a Glue job has an identity-based policy granting kms:Decrypt and kms:GenerateDataKey on the key's ARN, plus full S3 access to the bucket. The Glue job fails with an AccessDenied error when writing encrypted objects. The KMS key policy contains only the default statement granting the account root full access, and no additional statements. Why is the job failing, and what is the minimal correct fix?

Accepted Answer

The key policy must explicitly grant the Glue role's principal (or delegate to IAM via the root statement combined with an IAM policy) permission to use the key; add a key policy statement allowing the role's kms:Decrypt and kms:GenerateDataKey, or confirm the account delegates to IAM.

Answer

Identity-based IAM policies alone are sufficient for KMS; the failure is caused by the bucket policy blocking the Glue role, so update the S3 bucket policy instead.

Answer

The KMS key must be a multi-Region key for Glue to write encrypted objects; replicate the key to the job's Region to resolve the error.

Answer

Enable automatic key rotation on the KMS key, because Glue cannot generate data keys against a key that has never been rotated.