DMS Serverless Replication - getting no permission to access source rds custom kms key

Question

Have source as Postgres RDS and target as S3 bucket.

Source Postgres RDS is encrypted with a custom KMS key. 
While using standard provisioned DMS task, this is working fine, with the custom key being accessed fine and source and target endpoints working fine. Data movement / CDC also verified.

However, we've decided to use DMS serverless replication. While trying to use same endpoints previoulsy working in standard DMS task, but the serverless replication process is failing during testing connection , getting below error:

Test connection failed for endpoint 'source_endpoint' and replication config 'dms-serverless-rep'. Failure Message: 'No permission to access Key 'arn:aws:kms:ap-southeast-2:XXXXXXXXXXXX:key/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx''

setup done for above so far but nothing worked : 
 - DMS serverless service linked role - AWSServiceRoleForDMSServerless - this role has been granted all access in the custom key policy , snippet attached.

Service Role can't be modified, so tried giving full access to the service principle and service linked role from custom key policy, ended up in the same issue.

Also the user account has been granted full access to the key.

kms key policy snippet:

{
            "Sid": "Enable full access to DMS service principal",
            "Effect": "Allow",
            "Principal": {
                "Service": "dms.amazonaws.com"
            },
            "Action": "kms:*",
            "Resource": "*"
        },
        {
            "Sid": "Allow attachment of persistent resources",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::XXXXXXXXXXXX:role/aws-service-role/dms.amazonaws.com/AWSServiceRoleForDMSServerless"
            },
            "Action": "kms:*",
            "Resource": "*"
        },
		
		{
            "Sid": "Allow admin access ",
            "Effect": "Allow",
			"Principal": {
                "AWS": [
                    "arn:aws:iam::XXXXXXXXXXXX:root"
                ]
            },
            "Action": "kms:*",
            "Resource": "*"
        }

subhashr · Accepted Answer

there seems to be some confusion here. please note when we create a dms endpoint with kms key that kms key is used to encrypt the connection parameters for the endpoint and not used to connect to the source or target. 
connection level encryption is provided with ssl or tls and doesnt need to kms to decrypt the source or target storage.

i also understand that it works with provisioned dms and fails with custom kms key (not using aws/dms) for serverless dms. Let me know if it helps. You can always use aws/dms to encrypt the connection  parameters for the endpoint.

subhashr · Answer

you seem to be hitting the limitation as mentioned at https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Serverless.Limitations.html

AWS DMS serverless doesn't support using AWS customer managed keys. AWS DMS serverless only supports using the default DMS key.

DMS Serverless Replication - getting no permission to access source rds custom kms key

Relevant content