How do I resolve the AWS KMS key policy error?

Short description

If you didn't correctly modify your AWS KMS key policy, then the PutKeyPolicy AWS KMS API operation fails. Then, you might get one of the following error messages:

"PutKeyPolicy request failed MalformedPolicyDocumentException - Policy contains a statement with one or more invalid principals."

"Policy contains a statement with one or more invalid principals"

To resolve this issue, complete one or more of the following resolution actions.

Resolution

Use valid JSON syntax

Confirm that you use a valid JSON policy document resource type. To troubleshoot JSON syntax errors, paste the JSON policy document into a JSON formatting tool. Remove unnecessary characters, and then include missed characters. Make sure that you remove any duplicate JSON policy elements and Security Identifying (SID) values.

Specify principal elements

In the principal element in the JSON policy, confirm that you created a AWS Identity and Access Management (IAM) identity and a valid Amazon Resource Name (ARN).

The key policy is in effect only in the AWS Region that contains the AWS KMS key. If the AWS KMS key policy has permissions to another AWS account or principal, then the key policy might not be in effect. Make sure that your key policy contains the AWS KMS key in the correct Region.

You must specify the principal element as the IAM identity. If you specified an AWS service as the principal, then make sure that AWS KMS supports the service. For the AWS services that support the condition key and make the requests with a forward access session, use the kms:ViaService AWS KMS condition key.

AWS services that make direct calls to AWS KMS must have the service principal in the Principal element. Check that the AWS service that you use directly calls AWS KMS.

Opt-in to the Region

The account that you share the AWS KMS keys with, must opt-in to the Region in the recipient account. Make sure that you activate the Region in the recipient account. You can also share another AWS KMS key in a Region that you activated in the AWS account and recipient account.