Why can't I create a snapshot of my encrypted Amazon EC2 instance?

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

Prerequisites:

• Create an unencrypted snapshot to verify that the issue is with AWS KMS encryption.
• Check your AWS CloudTrail Event history for detailed error messages or additional context.

Based on the error message that you receive when you try to create an encrypted snapshot of the Amazon EBS volume, take the following actions.

Troubleshoot the "AccessDenied: User is not authorized to perform: kmsCreateGrant" error

If the AWS Identity and Access Management (IAM) entity that created the snapshot doesn't have the required permissions, then you receive the "AccessDenied" error message. When you share an encrypted snapshot, you must also share the customer managed key that you used to encrypt the snapshot.

To share the key across AWS accounts, choose Add another account when you create the key. Or, update the AWS KMS key policy to allow the destination account to use the AWS KMS key.

Example AWS KMS key policy:

{
    "Sid": "Allow use of the key for EBS snapshot operations",
    "Effect": "Allow", 
    "Principal": {
        "AWS": "arn:aws:iam::ACCOUNT-ID:role/ROLE-NAME"
    },
    "Action": [
        "kms:DescribeKey",
        "kms:CreateGrant",
        "kms:GenerateDataKey", 
        "kms:GenerateDataKeyWithoutPlaintext",
        "kms:ReEncrypt",
        "kms:Decrypt"
    ],
    "Resource": "*"
}

Note: Replace ACCOUNT-ID with the destination account ID and ROLE-NAME with the IAM role name.

For more information, see Troubleshooting AWS KMS permissions.

Troubleshoot the "No resource-based policies allow access" error

This error occurs when you incorrectly configured cross-account access or when the destination account blocks access.

To troubleshoot this issue, confirm that the AWS KMS key policy allows the destination account to access the key with the required permissions.

Example AWS KMS key policy:

{
    "Sid": "Allow use of the key for EBS snapshot operations",
    "Effect": "Allow", 
    "Principal": {
        "AWS": "arn:aws:iam::ACCOUNT-ID:role/ROLE-NAME"
    },
    "Action": [
        "kms:DescribeKey",
        "kms:CreateGrant",
        "kms:GenerateDataKey", 
        "kms:GenerateDataKeyWithoutPlaintext",
        "kms:ReEncrypt",
        "kms:Decrypt"
    ],
    "Resource": "*"
}

Note: Replace ACCOUNT-ID with the destination account ID and ROLE-NAME with the IAM role name.

Then, share the encrypted snapshot and the AWS KMS key with the destination account.

Make sure that the destination account's Service Control Policies (SCPs) in AWS Organizations don't block access. AWS evaluates SCPs before IAM or resource-based policies.

For cross-Region configurations, run the following AWS CLI describe-key command to make sure that the users can access the AWS KMS in the destination Region:

aws kms describe-key --key-id example-key-id --region example-region

Note: Replace example-key-id with your AWS KMS key ID and example-region.

If users can't access the key in the destination Region, then make sure that you created multi-Region replica keys.

For more information, see Allowing users in other accounts to use an AWS KMS key.

Troubleshoot the "Resource does not exist in this Region" error

To troubleshoot this issue, make sure that you correctly configured access to the encryption key in the required AWS Regions.

To verify that the AWS KMS key exists in the destination Region, run the following list-keys command:

aws kms list-keys --region example-region

Note: Replace example-region with the destination Region.

If the key doesn't exist in the destination Region, then update the AWS KMS key policy to grant access to the account in the destination Region.

Example AWS KMS key policy:

{
    "Sid": "Allow use of the key for EBS snapshot operations",
    "Effect": "Allow", 
    "Principal": {
        "AWS": "arn:aws:iam::ACCOUNT-ID:role/ROLE-NAME"
    },
    "Action": [
        "kms:DescribeKey",
        "kms:CreateGrant",
        "kms:GenerateDataKey", 
        "kms:GenerateDataKeyWithoutPlaintext",
        "kms:ReEncrypt",
        "kms:Decrypt"
    ],
    "Resource": "*"
}

Note: Replace ACCOUNT-ID with the destination account ID and ROLE-NAME with the IAM role name.

For cross-Region configurations, make sure that you created multi-Region replica keys.

To check whether the AWS KMS key has the required permissions, run the following get-key-policy command:

aws kms get-key-policy --key-id example-key-id --policy-name default --region example-region

Note: Replace example-key-id with your AWS KMS key ID and example-region with your destination Region.

If the AWS KMS key policy doesn't include the required permissions, then update the AWS KMS key policy.