Cannot access encrypted files from RDS in S3 bucket

Question

I export data from an Aurora Postgres instance to S3 via the `aws_s3.query_export_to_s3` function. The destination bucket does not have default encryption enabled. When I try to download one of the files I get the following error:

> The ciphertext refers to a customer mast3r key that does not exist, does not exist in this region, or you are not allowed to access.

Note: I had to change the word mast3r because this forum doesn't allow me to post it as it is a "non-inclusive" word...

The reasons seems to be that the files got encrypted with the AWS managed RDS key which has the following policy:

```
{
    "Version": "2012-10-17",
    "Id": "auto-rds-2",
    "Statement": [
        {
            "Sid": "Allow access through RDS for all principals in the account that are authorized to use RDS",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:CreateGrant",
                "kms:ListGrants",
                "kms:DescribeKey"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "kms:CallerAccount": "123456789",
                    "kms:ViaService": "rds.eu-central-1.amazonaws.com"
                }
            }
        },
        {
            "Sid": "Allow direct access to key metadata to the account",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::123456789:root"
            },
            "Action": [
                "kms:Describe*",
                "kms:Get*",
                "kms:List*",
                "kms:RevokeGrant"
            ],
            "Resource": "*"
        }
    ]
}
```

I assume that the access doesn't work because of the `ViaService` condition when trying to decrypt the file via S3.

I tried to access to files with the root user instead of an IAM user and it works. Is there any way to get access with an IAM user? As far as I know, you cannot modify the policy of an AWS managed key. I also don't understand why the root user can decrypt the file as the policy doesn't explicitly grant decrypt permissions to it other than the permissions when called from RDS.

Accepted Answer

`aws_s3.query_export_to_s3` uses the AWS managed Key `aws/s3` to encrypt the exported Data (rather than `aws/rds` listed in the question). The policy for that Key is as follows:
``` json
{
    "Version": "2012-10-17",
    "Id": "auto-s3-2",
    "Statement": [
        {
            "Sid": "Allow access through S3 for all principals in the account that are authorized to use S3",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:DescribeKey"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "kms:CallerAccount": "123456789012",
                    "kms:ViaService": "s3.eu-central-1.amazonaws.com"
                }
            }
        },
        {
            "Sid": "Allow direct access to key metadata to the account",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::123456789012:root"
            },
            "Action": [
                "kms:Describe*",
                "kms:Get*",
                "kms:List*"
            ],
            "Resource": "*"
        }
    ]
}
```
According to this policy, any IAM principal of your account can use that key do `Encrypt`, `Decrypt` etc. via the S3 service (first policy statement), while direct usage is restricted to Metadata only operations (second policy statement). So if your IAM principal resides in the same account as the key and has access to the S3 objects via `GetObject`, they should also be able to decrypt and download the exported data. Reasons I can think of that could prevent this are

1. You try to access the objects from a principal in another Account (that has access to the data e.g. via a cross-account role or bucket policy) but cannot access the AWS managed key `aws/s3` to decrypt.
 2. There is an explicit Deny for your IAM principal that prevents your IAM principal from accessing the key.

Notice that there is no need for explicit denies in that case, as an IAM principal has no means of directly using `aws/s3` to `Decrypt` without going through S3. There is also no possibility for any IAM principal (even root) to obtain this priviledges for that particular key, as

1. the key policy of an AWS managed key such as `aws/s3` can not be altered and  
  2. the key policy of `aws/s3` does not allow `CreateGrant` to delegate access to the key (even for the root user).

Cannot access encrypted files from RDS in S3 bucket

Relevant questions

Move files from S3 Bucket back to Site

How to read S3 object from encrypted S3 bucket using ebextensions files?

encrypted db snapshot restore from S3 not working AWS RDS(mysql) console in an S3 bucket.

Cannot configure Guardduty 'findings export options' to an S3 bucket

Cannot access encrypted files from RDS in S3 bucket

Does S3 same region replication trigger S3 event notifications in the destination bucket?

Can't download file from S3 bucket in another account

S3 bucket access on EC2 Instance using boto3

S3 Bucket cannot be reached in GroundTruth Labeling

Querying postgres RDS from Athena