ASG KMS customer managed key

When you have enabled EBS volume automatic encryption using a customer managed KMS key, you need to ensure that the Auto Scaling service has permission to use this key. The error "Client.InvalidKMSKey.InvalidState" typically occurs because the service-linked role used by Auto Scaling doesn't have the necessary permissions to use your customer managed KMS key.

To solve this issue, you need to update your KMS key policy to include permissions for the Auto Scaling service-linked role. Here's what you need to do:

1. For the principal, you need to use the service-linked role for Auto Scaling, which is typically: arn:aws:iam::<your-account-id>:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling

2. Add the following policy statement to your KMS key policy:

{
"Sid": "Allow service-linked role use of the customer managed key",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::<your-account-id>:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling"
},
"Action": [
"kms:Encrypt",
"kms:Decrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*",
"kms:DescribeKey"
],
"Resource": "*"
}

3. You also need to add another policy statement to allow the service-linked role to create grants:

{
"Sid": "Allow attachment of persistent resources",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::<your-account-id>:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling"
},
"Action": "kms:CreateGrant",
"Resource": "*",
"Condition": {
"Bool": {
"kms:GrantIsForAWSResource": true
}
}
}

Adding these policy statements to your KMS key policy will grant the necessary permissions to the Auto Scaling service-linked role to use your customer managed key for encrypting and decrypting EBS volumes, which should resolve the error you're experiencing.
Sources
Troubleshoot Amazon EC2 Auto Scaling: EC2 instance launch failures - Amazon EC2 Auto Scaling
Required AWS KMS key policy for use with encrypted volumes - Amazon EC2 Auto Scaling
Use a shared encrypted AMI in an Auto Scaling group | AWS re:Post
How to resolve “Client.InvalidKMSKey.InvalidState” error when creating an ElasticBeanstalk environment ? | AWS re:Post