Bug-Byte 2: KMS Key does not exist

In the same vein as Bug Byte 1, here is another encryption permission issue you may encounter while working with AWS Key Management Service (KMS). Have you seen an error like the one below in CloudFormation while creating a KMS-encrypted AWS resource?

    
        
"The specified KMS key does not exist or is not allowed to be used" 

    

If so, there’s a chance that the key policy assigned to your Customer Managed Key (CMK) could be the culprit. It is possible that the service you are trying to encrypt does not have access to the KMS key in question.

For example, if you are trying to create a CMK-encrypted CloudWatch log group, check the policy on your key. It should allow access to the key from the CloudWatch logs service, like so:

    
        
{
    "Effect": "Allow",
    "Principal": {
        "Service": "logs..amazonaws.com"
    },
    "Action": [
        "kms:Encrypt*",
        "kms:Decrypt*",
        "kms:ReEncrypt*",
        "kms:GenerateDataKey*",
        "kms:Describe*"
    ],
    "Resource": "*",
    "Condition": {
        "ArnLike": {
            "kms:EncryptionContext:aws:logs:arn": "arn:aws:logs::012345678910:*"
        }
    }
}

    

This error tends to pop up more for managed services.

Hope that helped. Good luck out there in the cloud.

Link to AWS documentation.