Question

A CloudOps engineer is troubleshooting an application running on an EC2 instance that must decrypt objects in an S3 bucket encrypted with a customer managed KMS key. The EC2 instance role has an IAM policy granting kms:Decrypt on the key's ARN, but the application receives an AccessDenied error when calling Decrypt. The KMS key policy contains only the default statement granting the root account full access, plus a statement granting a separate administrator role kms:* permissions. What is the MOST likely cause and the correct fix?

Accepted Answer

The KMS key policy does not delegate permission management to IAM; add a key policy statement allowing the account principal (root ARN) to enable IAM policies, or explicitly grant the EC2 role kms:Decrypt in the key policy.

Answer

The EC2 instance role is missing the kms:GenerateDataKey permission; add it to the instance role's IAM policy to allow decryption.

Answer

S3 does not support customer managed KMS keys for object encryption; migrate the bucket to use an AWS managed key (aws/s3) instead.

Answer

The KMS key must have automatic key rotation enabled before any principal can call Decrypt; enable rotation on the key.