- Più recenti
- Maggior numero di voti
- Maggior numero di commenti
The most possible reason for this behavior is you might have Default KMS key in your "us-east-1" for EBS and have a custom key for other regions.
This Error corresponds to KMS and the worst part is CloudTrail is not showing these Access Deny's for CreateGrant, however it shows when it's success.
To resolve make sure you know which KMS key is set for EBS default Encryption and Apply Key Grant to Service Role(AWSServiceRoleForAWSCloud9) has Create grant permissions and you can only apply this from CLI as AWSServiceRoleForAWSCloud9 is a Service role.
CLI Command:
aws kms create-grant --region <region-id> --key-id <ebs-default-encryption-key-arn> --grantee-principal arn:aws:iam::<account-id>:role/aws-service-role/cloud9.amazonaws.com/AWSServiceRoleForAWSCloud9 --operations "Encrypt" "Decrypt" "ReEncryptFrom" "ReEncryptTo" "GenerateDataKey" "GenerateDataKeyWithoutPlaintext" "DescribeKey" "CreateGrant"
Then you should be able to create environment with out issues.
Reference: https://docs.aws.amazon.com/cloud9/latest/user-guide/move-environment.html#encrypting-volumes https://docs.aws.amazon.com/kms/latest/developerguide/using-service-linked-roles.html
Contenuto pertinente
- AWS UFFICIALEAggiornata 6 mesi fa
- AWS UFFICIALEAggiornata 3 anni fa
- AWS UFFICIALEAggiornata 9 mesi fa
Sydney (ap-southeast-2)