Access denied in AWS aurora (RDS database)

Hello.

Are you trying to create an RDS instance encrypted with a customer managed key?
In that case, you need to set "kms:DescribeKey" and "kms:CreateGrant" in the IAM policy for the IAM user you are using.
Try setting the key policy of the customer managed key you are trying to use for encryption to allow IAM users and the IAM policy to allow the above two policies.
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.Keys.html#Overview.Encryption.Keys.Authorizing