How to Grant AWS Lambda Role Access to KMS for Cross-Region Snapshots

Select Language:

If you’re trying to copy RDS snapshots across regions and encounter errors related to KMS permissions, here’s a simple step-by-step solution to fix the issue, especially when your Lambda function lacks access to the correct KMS key.

First, ensure your Lambda’s execution role has the right permissions to access the KMS key used for encrypting the snapshots. This involves updating the IAM policy attached to the Lambda role to explicitly allow access to the KMS keys in both regions involved.

Here’s what you need to do:

Open the IAM management console and locate your Lambda’s execution role. In your case, it’s named “RL-Lambda-RDS-Snapshot-Management”.

ADVERTISEMENT
Modify the role’s policy to include permissions for the KMS keys in both source and target regions. Your policy should include statements like this:

json
{
“Effect”: “Allow”,
“Action”: [
“kms:Decrypt”,
“kms:Encrypt”,
“kms:GenerateDataKey”,
“kms:DescribeKey”,
“kms:CreateGrant”,
“kms:RevokeGrant”
],
“Resource”: [
“arn:aws:kms:us-west-1:YOUR_ACCOUNT_ID:key/your-kms-key-id”,
“arn:aws:kms:us-west-2:YOUR_ACCOUNT_ID:key/your-kms-key-id”
]
}

Replace YOUR_ACCOUNT_ID and your-kms-key-id with your actual AWS account number and KMS key identifiers.

Confirm that the KMS keys in each region have policies granting access to your Lambda role. Check the key policies attached to the specific KMS keys used for your snapshots. Make sure they authorize the Lambda’s role to perform decrypt/encrypt operations.
Additionally, verify that the KMS key used to encrypt the source snapshot in “us-west-1” is enabled and accessible. If the key is disabled or deleted, you’ll encounter the “KMSKeyNotAccessibleFault” error.
After updating IAM policies, test your Lambda function again. It should now have the necessary permissions to access the KMS keys and perform cross-region snapshot copying.

By explicitly granting permissions for both regions’ KMS keys in your Lambda’s policy and ensuring the keys are active and accessible, you should be able to resolve the error. Remember to double-check the key policies and your IAM role permissions for complete access.

This approach guarantees your Lambda function can interact securely with the KMS keys needed to copy snapshots between regions without encountering access issues.