How to change the status *“Inaccessible-encryption-credentials-recoverable”* in RDS services

When your Amazon RDS DB instance or Aurora DB cluster shows the "inaccessible-encryption-credentials-recoverable" status, it means that the instance or cluster cannot access the AWS Key Management Service (AWS KMS) encryption key used to encrypt your database. However, this is a recoverable state, and you can take the following steps to resolve it:

1. Confirm that the AWS account that has the AWS KMS key is active. If the account was suspended, ensure it has been properly reactivated.

2. Verify that the AWS KMS key is turned on (enabled) and not scheduled for deletion. If the key is scheduled for deletion, cancel the scheduled deletion.

3. Restart your DB instance or cluster. You can do this using:

• AWS CloudShell
• AWS Management Console
• AWS CLI with the following command:

aws rds start-db-instance --db-instance-identifier your-instance-name

(For Aurora clusters, use the start-db-cluster command instead)

It's important to note that while in the "inaccessible-encryption-credentials-recoverable" state, you are still billed for storage. You have a window of seven days to recover the instance before it transitions to the terminal "inaccessible-encryption-credentials" state, at which point recovery becomes more complex and requires restoration from backups.

If restarting doesn't resolve the issue, double-check all KMS key permissions and settings to ensure the RDS instance has proper access to the encryption key.
Sources
Resolve the inaccessible encryption state in Amazon RDS | AWS re:Post
After AWS account reactivate, I'm not able to access my AWS RDS | AWS re:Post
Viewing instance status - Amazon Relational Database Service
Encrypting Amazon Aurora resources - Amazon Aurora

Hello.

Is the KMS key you are using to encrypt RDS a KMS key you created?
If so, please make sure the KMS key status is available.
If you disable the KMS key you are using to encrypt your RDS, you will lose access to RDS.
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html

Amazon RDS loses access to the KMS key for a DB instance when you disable the KMS key. If you lose access to a KMS key, the encrypted DB instance goes into the inaccessible-encryption-credentials-recoverable state 2 hours after detection in instances where backups are enabled. The DB instance remains in this state for seven days, during which the instance is stopped. API calls made to the DB instance during this time might not succeed. To recover the DB instance, enable the KMS key and restart this DB instance. Enable the KMS key from the AWS Management Console, AWS CLI, or RDS API. Restart the DB instance using the AWS CLI command start-db-instance or AWS Management Console.

As mentioned in the following stackoverflow answer, in some cases you may need to consider restoring from a snapshot.
https://stackoverflow.com/questions/77756208/inaccessible-encryption-credentials-status-of-aws-rds-instance