What IAM Role permissions required to restore CMK encrypted EC2 instances ?


Hi there,
Apologies if this question has been answered earlier, unfortunately I am not able to locate it easily :(
When I try to restore an EC2 instance that has been backed up by AWS Backup, it fails with error "Client.InternalError: Client error on launch"
Looks like it is an encryption issue...
The following are the details:

  1. The EC2 instance being backed up has been setup with Volume(s) that are encrypted with Customer Managed Keys (CMK)
  2. We provided full KMS permissions for the role (not my preferred option, but just to test the restores)
  3. The restores attempts terminates the target EC2 instance almost immediately on launch of the restore operation with the error "Client.InternalError: Client error on launch"
    Note: I tested the backup and restore of the EC2 instance with unencrypted volume(s) and it completed successfully
    Please provide guidance to complete restores for EC2 instances setup with CMK
    Thank you,
asked 3 years ago34 views
1 Answer

Issue was caused by the KMS CMK key policy, it has been resolved after providing grant to the backup role

answered 3 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions