KMS decrypt works locally but not from within EC2 instance

1
votes

I am trying to decrypt a file that is stored inside an S3 bucket using KMS. Within an EC2 instance, I am able to retrieve this file from S3, but when I try to decrypt it using KMS, I get the following error:

HTTPSConnectionPool(host='kms.us-east-1.amazonaws.com', port=443): Max retries exceeded with url: / (Caused by ConnectTimeoutError(, 'Connection to kms.us-east-1.amazonaws.com timed out. (connect timeout=60)'))

I am however able to decrypt this file successfully from my local machine. Does anyone know why this may be?

If additional info is required, I would be happy to provide it :)

2
amazon-web-servicesaws-kms
You can't access KMS from anywhere, including inside EC2, unless you have Internet access from the machine. It sounds like you don't. – Michael - sqlbot

2 Answers

0
votes

When you enable VPC for your Lambda AWS shows you following message -

When you enable VPC, your Lambda function will lose default internet access. If you require external internet access for your function, ensure that your security group allows outbound connections and that your VPC has a NAT gateway.

So make sure your lambda has access to internet with correct security groups and NAT gateway.

Also note having IG for your subnet is not sufficient. You need to have a NAT instance or gateway and a route from your subnet to that gateway in route table for lambda to have internet access associated to a custom VPC.

AWS Lambda uses the VPC information you provide to set up ENIs that allow your Lambda function to access VPC resources. Each ENI is assigned a private IP address from the IP address range within the Subnets you specify, but is not assigned any public IP addresses. Therefore, if your Lambda function requires Internet access (for example, to access AWS services that don't have VPC endpoints, such as Kinesis), you can configure a NAT instance inside your VPC or you can use the Amazon VPC NAT gateway. You cannot use an Internet gateway attached to your VPC, since that requires the ENI to have public IP addresses.

Important :

If your Lambda function needs Internet access, do not attach it to a public subnet or to a private subnet without Internet access. Instead, attach it only to private subnets with Internet access through a NAT instance or an Amazon VPC NAT gateway.

Source : http://docs.aws.amazon.com/lambda/latest/dg/vpc.html

0
votes

One case can be that you are connecting to s3 bucket using VPC endpoint and not have an internet connection.

If this is the case then you have to enable internet connectivity either via NAT or putting your instance in a public subnet.