KMS Decrypt Permissions for AWS Lambda

Question

I can't work it out and the docs are not being very helpful.

I have a lambda that needs to decrypt a value using KMS. I am using sam to deploy my lambda. Initial I tried adding a policy statement

            - Effect: Allow
              Action:
                - kms:Decrypt
              Resource:
                - 'arn:aws:kms:us-west-2:<account>:key/<key>'

but this doesn't work because (as far as i understand it) I need to tell KMS that this resource is allowed to perform this operation. I attempted to fix this by creating an IAM Role that I can attach to a lambda resource which is the AWSLambdaBasicExecutionRole with a policy for my key.

After creating my new role it does not show up in KMS when attempting to add key users although other roles do. I created the role while logged into the console as an IAM user but my role has an arn that includes ther root account id.

aws sam does not have any knowledge of KMS should sam/cloudformation be adding my resource arn to KMS key policy, I would rather do it via a role in iam.

Edit: The error I get when running this is

{"errorType":"AccessDeniedException","errorMessage":"The ciphertext refers to a customer master key that does not exist, does not exist in this region, or you are not allowed to access.","code":"AccessDeniedException","message":"The ciphertext refers to a customer master key that does not exist, does not exist in this region, or you are not allowed to access."

The value I'm using as key is refered to as the key-id in the KMS console.

The policy statement look fine, how do you know it doesn't work? Any error messages? Can you also share the code that runs in your Lambda? — jogold
Thanks i've updated my quesion with the error message and where the key comes from — Alex Edwards

Allan Chua Allan Chua · Accepted Answer · 2020-01-21T06:29:59

Check if the lambda function is running on the same region where the Key is located.
Can you check the syntax of the policy? It should look like the sample below:

      Policies:
        - KMSDecryptPolicy:
            KeyId: 'arn:aws:kms:us-west-2:<account>:key/<key>'

Check the version of SAM CLI in your machine as well :)

KMS Decrypt Permissions for AWS Lambda

1 Answers