How do I resolve an Amazon RDS instance or Aurora cluster that’s in an inaccessible encryption state?

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

Important: It's best practice to turn on backups for encrypted Amazon RDS instances and Aurora clusters. For more information, see Determining whether encryption is turned on for a DB instance and Determining whether encryption is turned on for a DB cluster.

Inaccessible-encryption-credentials-recoverable state

Your Amazon RDS DB instance or Aurora DB cluster must be able to access the AWS Key Management Service (AWS KMS) encryption key. If the instance or cluster can't access the AWS KMS encryption key, then the cluster or instance enters an inaccessible-encryption-credentials-recoverable state.

To resolve the inaccessible-encryption-credentials-recoverable state, take the following actions:

• Confirm that the AWS Account that has the AWS KMS key is active.
  Note: If the account is suspended, then reactivate the suspended account.

• Confirm that you turned on the AWS KMS key.

• Check if the AWS KMS key is scheduled for deletion. If the key is scheduled for deletion, then cancel the scheduled key deletion.

• Use AWS CloudShell to restart your DB instance or cluster. Or, run one of the following AWS CLI commands to restart your Amazon RDS or Aurora instance or cluster.
  To restart your Amazon RDS DB instance, run the jstart-db-instance command:

  aws rds start-db-instance --db-instance-identifier example-instance

  Note: Replace example-instance with the name of your Amazon RDS instance.

  To restart your Aurora DB cluster, run the start-db-cluster command:

  aws rds start-db-cluster --db-cluster-identifier example-cluster

  Note: Replace example-cluster with your Aurora cluster name.

Inaccessible-encryption-credentials state

If the Amazon RDS instance or Aurora cluster doesn't recover in 7 days, then the instance or cluster moves to the terminal inaccessible-encryption-credentials state.

Because you can't stop DB instances with read replicas, cross-Region read replicas, and in-region read replicas, these instances bypass the recoverable state. When the Amazon RDS instance can't access the AWS KMS key after 2 hours, the instances then directly transition to the terminal inaccessible-encryption-credentials state.

To resolve the inaccessible-encryption-credentials state, perform a snapshot restore as a new Amazon RDS instance or Aurora cluster. Or, perform a point in time recovery (PITR) to a specified time period for the new Amazon RDS instance or Aurora cluster.

Note: You must have the AWS KMS key available to perform the snapshot restore or PITR. If you deleted or lost the AWS KMS key, then you can't recover the data.

If you can't delete the DB instance or cluster that's in the inaccessible-encryption-credential state, then use the AWS CLI to turn off deletion protection.

• For an Amazon RDS instance, run the modify-db-instance command:

  aws rds modify-db-instance --db-instance-identifier example-instance --no-deletion-protection

  Note: Replace example-instance with the name of your instance.
• For an Aurora cluster, run the modify-db-cluster command:

  aws rds modify-db-cluster --db-cluster-identifier example-cluster --no-deletion-protection

  Note: Replace example-cluster with the name of your cluster.

To delete an Amazon RDS DB instance or Aurora DB cluster that's in the inaccessible-encryption-credentials state, run the following AWS CLI commands.

• For an Amazon RDS instance, run the delete-db-instance command:

  aws rds delete-db-instance --db-instance-identifier example-instance --skip-final-snapshot

  Note: Replace example-instance with the name of your Amazon RDS instance.
• For an Aurora cluster, run the following delete-db-cluster command:

  aws rds delete-db-cluster --db-cluster-identifier example-cluster --skip-final-snapshot

  Note: Replace example-cluster with your Amazon Aurora cluster name.

If your Amazon RDS instance or Aurora cluster doesn't delete after you run the preceding commands, then contact AWS Support.

Related information

Encrypting Amazon RDS resources

Encrypting Aurora resources