The environment has the following configuration:✑ The instance is allowed the kms:Decrypt action in its IAM role for all resources✑ The AWS KMS CMK status is set to enabled✑ The instance can communicate with the KMS API using a configured VPC endpointWhat is causing the issue?
The kms:GenerateDataKey permission is missing from the EC2 instance’s IAM role
The ARN tag on the CMK contains the EC2 instance’s ID instead of the instance’s ARN
The kms:Encrypt permission is missing from the EC2 IAM role
The KMS CMK key policy that enables IAM user permissions is missing
Explanations:
Thekms:GenerateDataKeypermission is for generating data keys, not for decrypting data. Decrypting requires thekms:Decryptpermission, which is already granted in the IAM role.
The ARN tag on the CMK does not need to include the EC2 instance’s ID. What matters is the key policy and permissions that allow the instance to use the CMK for decryption.
Thekms:Encryptpermission is not required for decryption actions. Onlykms:Decryptis necessary, and the IAM role already allows this.
The KMS CMK’s key policy is crucial for granting permissions to IAM roles. If the key policy doesn’t enable IAM user permissions (for EC2 in this case), decryption will be denied even though the IAM role has the necessary permission.
I sort that the answer is:
The KMS CMK key policy that enables IAM user permissions is missing
In my experience, the answer is:
The KMS CMK key policy that enables IAM user permissions is missing