Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Aurora auto scaling KMS permissions issue

0

Hi, I have a problem with AWS Aurora auto scaling. When the conditions are met the scaling is failing with following error:

Failed when adding read replica(s) application-autoscaling-redacted. Reason: The specified performanceInsightsKMSKeyId [arn:aws:kms:us-west-2:redacted:key/redacted] doesn't exist, isn't enabled, or isn't accessible with your permissions. (Service: AmazonRDS; Status Code: 400; Error Code: KMSKeyNotAccessibleFault; Request ID: redacted; Proxy: null).

Auto scaling is hardcoded to use AWSServiceRoleForApplicationAutoScaling_RDSCluster role which I can't modify so I can't give it access to use KMS key.

I've tried recreating the auto scaling even after deregistering the scalable target and removing the role so it should be recreated.

Topics
Management & GovernanceDatabase
Tags
IAM PoliciesAWS Auto ScalingAmazon Aurora
Language
English

asked a year ago330 views

1 Answer
0
Accepted Answer

You likely need to add the AutoScaling Role to the Key Policy to give it permissions. If they key is cross account, you'll also likely need to call CreateGrant from the DB account to enable cross-account access.

There's a similar guide for an ASG here that should be a good template to follow: https://docs.aws.amazon.com/autoscaling/ec2/userguide/key-policy-requirements-EBS-encryption.html

EXPERT

answered a year ago

EXPERT

reviewed a year ago

  • Piotr
    a year ago

    Thank you! I had the "Allow service-linked role use of the customer managed key" statement already but I was missing the "Allow attachment of persistent resources" statement.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content