Issue with Creating Spot Fleet Using Encrypted AMI from Another Account

When working with encrypted AMIs across accounts for Spot Fleet, there are specific permission requirements that need to be addressed.

The issue you're experiencing is related to how the Spot Fleet service accesses the KMS key used to encrypt the AMI. While your policy includes many necessary permissions, there are a few key elements missing.

For encrypted AMIs, when using a Spot Fleet, you need to ensure that the AWSServiceRoleForEC2SpotFleet service-linked role has proper permissions to use the customer managed key (CMK). Your current policy is missing some required permissions and has structural issues.

The key policy should include two specific statement blocks:

1. "Allow use of the key" statement that includes permissions for:

• kms:Encrypt
• kms:Decrypt
• kms:ReEncrypt*
• kms:GenerateDataKey*
• kms:DescribeKey

2. "Allow attachment of persistent resources" statement that includes:

• kms:CreateGrant
• kms:ListGrants
• kms:RevokeGrant

Your current policy is missing the kms:ListGrants and kms:RevokeGrant permissions, which are essential for the Spot Fleet service to work with encrypted AMIs across accounts.

Additionally, when using grants (which is the recommended approach for cross-account scenarios with AWS services), you should include a condition that restricts grant creation to AWS resources:

"Condition": {"Bool": {"kms:GrantIsForAWSResource": true}}

While it's true that you can launch a regular EC2 instance with the shared encrypted AMI, Spot Fleet has additional requirements because it's a service that launches instances on your behalf, requiring more extensive KMS permissions.

Regarding your question about copying AMIs: While copying an encrypted AMI to your account is one solution (and gives you full control), it's not strictly required. You can use a shared encrypted AMI directly if the proper KMS key permissions are configured correctly for the service roles involved.
Sources
Spot Fleet permissions - Amazon Elastic Compute Cloud
Troubleshoot copy errors between Regions or Accounts in Amazon EC2 | AWS re:Post
ASG KMS customer managed key | AWS re:Post

You can share AMIs encrypted with customer-managed KMS keys across accounts and launch EC2 instances directly from them. However, there are some important considerations:

1. For the target account (Account-B in your case), the IAM user or role needs specific permissions to perform these KMS operations on the source account's KMS key:

• kms:DescribeKey
• kms:ReEncrypt*
• kms:CreateGrant
• kms:Decrypt

2. While launching instances from a shared encrypted AMI, AWS recommends re-encrypting the volumes using a KMS key in the target account rather than using the source account's KMS key. This protects you if:

• The source KMS key is compromised
• The source account revokes permissions
• You lose access to encrypted volumes created using the source KMS key

The error you're experiencing with Spot Fleet might be related to the re-encryption process. When launching a regular EC2 instance, you have the option to specify a different KMS key for re-encryption in the target account. Try modifying your Spot Fleet configuration to include re-encryption settings using a KMS key from your account (Account-B).

You don't need to copy the AMI to your account first - sharing encrypted AMIs across accounts is supported with a single API call, as long as the proper KMS key permissions are in place.

The key difference between your EC2 instance success and Spot Fleet failure might be related to the re-encryption settings rather than the sharing mechanism itself.

References

[1] How to share encrypted AMIs across accounts to launch encrypted EC2 instances

[2] Share an AMI with specific AWS accounts

Hi, Thanks for your answer. I've already added every permission that mentioned in AWS documentation and your answers as well. Unfortunately, it didn't work. When I run the following command, I received **"implicitDeny" **and "AllowedByOrganizations": false message. Can I assume that it has been restricted by SCP?

aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::{TARGET-ID}:role/my-ec2-spot-fleet-instance-service-iam-role \
  --action-names kms:DescribeKey \
  --resource-arns arn:aws:kms:eu-west-1:{SOURCE-ID}:key/121232-cecee343-3eecba8985b9

I got that

{
    "EvaluationResults": [
        {
            "EvalActionName": "kms:DescribeKey",
            "EvalResourceName": "arn:aws:kms:eu-west-1:{SOURCE-ID}:key/121232-cecee343-3eecba8985b9",
            "EvalDecision": "implicitDeny",
            "MatchedStatements": [],
            "MissingContextValues": [],
            "OrganizationsDecisionDetail": {
                "AllowedByOrganizations": false
            }
        }
    ]
}

Hi,

I was working surprisingly when on call with AWS Support without making any changes :D