"Lambda-Function-RDS-Snapshot-Management" was working now python errors after minor change

Question

Hi re:Post!

Thank you for your time and help!

My lambda function, "Lambda-Function-RDS-Snapshot-Management", was working as expected.
But then I made (2) small changes to python script and now it errors.

I switched the "SOURCE_REGION" from us-west-1 to us-west-2 (code snippet below):

```
# SOURCE_REGION = "us-west-2"  # Oregon (system)
SOURCE_REGION = "us-west-1"  # N. California (system)
```

And I switched out some db_names:

Was:

db_names = [
        "db-drtest20250410", "db-drtest20240314"
    ]

Is:

db_names = [
        "db-urovant", "db-atlas"
    ]

It should have worked.
Lambda is using the same KMS key (rds-cross-region-replication) when it worked but now errors with:

```
Copying snapshot rds:db-urovant-2025-08-29-05-13-us-east-2 to copy-rds-db-urovant-2025-08-29
Error copying snapshot rds:db-urovant-2025-08-29-05-13-us-east-2: An error occurred (KMSKeyNotAccessibleFault) when calling the CopyDBSnapshot operation: The source snapshot KMS key does not exist, is not enabled or you do not have permissions to access it
Copying snapshot rds:db-atlas-2025-08-29-05-10-us-east-2 to copy-rds-db-atlas-2025-08-29
Error copying snapshot rds:db-atlas-2025-08-29-05-10-us-east-2: An error occurred (KMSKeyNotAccessibleFault) when calling the CopyDBSnapshot operation: The source snapshot KMS key does not exist, is not enabled or you do not have permissions to access it
```

Please advise!

Thanks!

Best Regards,

Donald

Riku_Kobayashi · Accepted Answer

Hello.

As described in the following document, you need to check "Check the source KMS key policy".  
Judging from the error message, I think this is because Lambda does not have access to the KMS key used to encrypt the snapshot in the "us-west-1" region.  
Therefore, please check which KMS key "db-urovant" and "db-atlas" are encrypted with, and set the KMS key policy to allow access from the Lambda IAM role.  
https://repost.aws/knowledge-center/backup-troubleshoot-cross-account-copy#:~:text=Check%20the%20source%20KMS%20key%20policy

Gary Mclean · Answer

As per Riku,

Youve changed your source region to us-west-1 but your KMS Key defined your IAM Policy does not state any KMS Keys in us-west-1
This would need adjusting unless your KMS Key Policy allows your lambda function to Decrypt. You cant use the KMS key in a different region for RDS Shapshots.

Without seeing your full code, its going to be Policy or your poiting to a key which doesnt exist

re:Post Agent · Answer

The error you're experiencing is related to KMS key permissions when copying RDS snapshots across regions. When you changed the source region from us-west-1 to us-west-2, you're now trying to access snapshots that are encrypted with a different KMS key than before.

The error message "KMSKeyNotAccessibleFault" indicates that your Lambda function doesn't have permission to use the KMS key that encrypted the snapshots in the new source region (us-west-2). This happens because:

1. Each AWS region has its own KMS keys
2. When copying encrypted snapshots across regions, you need proper permissions to both:
- The source KMS key (in us-west-2) that encrypted the original snapshots
- The destination KMS key (in your target region) that will encrypt the copied snapshots

To fix this issue:

1. Verify that your Lambda execution role (RL-Lambda-RDS-Snapshot-Management) has permissions to use the KMS key in the us-west-2 region. You need to add the appropriate KMS permissions to your role's policy.

2. In your Python code, you may need to explicitly specify the KMS key ID for the destination region when calling the copy_db_snapshot function:

```python
dest_rds.copy_db_snapshot(
SourceDBSnapshotIdentifier=source_arn,
TargetDBSnapshotIdentifier=target_snapshot_id,
KmsKeyId="arn:aws:kms:destination-region:account-id:key/key-id",
SourceRegion=SOURCE_REGION
)
```

3. Ensure that the KMS key policy in us-west-2 allows your Lambda role to use the key for decryption.

The database name changes shouldn't cause this issue - it's specifically related to the region change and the associated KMS keys used for encryption in that region.  
**Sources**  
[Python code deleted wrong snapshots and tried to copy wrong snapshots | AWS re:Post](https://repost.aws/questions/QU6ai2UEzORDWraNqL7mO52g/python-code-deleted-wrong-snapshots-and-tried-to-copy-wrong-snapshots)  
[Copying a DB snapshot for Amazon RDS - Amazon Relational Database Service](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_CopySnapshot.html)

"Lambda-Function-RDS-Snapshot-Management" was working now python errors after minor change

Copy the snapshot

Verify that your Lambda execution role (RL-Lambda-RDS-Snapshot-Management) has permissions to use the KMS key in the us-west-2 region. You need to add the appropriate KMS permissions to your role's policy.

Add your answer

Relevant content