Backing up an RDS or EC2 server (AMI or Snapshot) that is encrypted with a KMS key (non-default) is a challenge. Here we list the steps to grant permissions across accounts/regions so they can access the keys and complete the backup.
In the example error below, an attempt was made to copy an encrypted RDS backup to another account, and we received this message:
The source snapshot KMS key [arn:aws:kms:us-east-1:111111111111111:key/8aaaaaa0-adaa-43cc-83d1-54ffffff2ab4] does not exist, is not enabled or you do not have permissions to access it.How to fix it? #
In the console, grant permission for the account to access:
https://console.aws.amazon.com/kms/home?region=us-east-1#/kms/keys/——-KMSKEY——-/
In the section: Other AWS accounts, add the destination account (12-digit ID). The key must not be disabled!
2. In the destination account’s IAM, include the policy below (keeping in mind that we tried to use rds:CopyDBSnapshot
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowUseOfTheKey",
"Effect": "Allow",
"Action": "rds:CopyDBSnapshot",
"Resource": "*"
},
{
"Sid": "AllowUseOfTheKey",
"Effect": "Allow",
"Action": [
"kms:Encrypt",
"kms:Decrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*",
"kms:DescribeKey",
"kms:CreateGrant",
"kms:RetireGrant"
],
"Resource": [
"arn:aws:kms:us-east-1:111111111111111:key/8aaaaaa0-adaa-43cc-83d1-54ffffff2ab4"
]
},
{
"Sid": "AllowAttachmentOfPersistentResources",
"Effect": "Allow",
"Action": [
"kms:CreateGrant",
"kms:ListGrants",
"kms:RevokeGrant"
],
"Resource": [
"arn:aws:kms:us-east-1:111111111111111:key/8aaaaaa0-adaa-43cc-83d1-54ffffff2ab4"
],
"Condition": {
"Bool": {
"kms:GrantIsForAWSResource": true
}
}
}
]
}
