Inaccessible-encryption-credentials-recoverable

When your Amazon RDS DB instance or Aurora DB cluster shows the "inaccessible-encryption-credentials-recoverable" status, it means that the instance cannot access the AWS Key Management Service (AWS KMS) encryption key used to encrypt your database. This is a recoverable state that lasts for seven days, during which you can take action to restore access.

To resolve this issue, follow these steps:

1. Confirm that the AWS account that owns the AWS KMS key is active. If the account was suspended, you need to reactivate it.

2. Verify that the AWS KMS key is enabled and not scheduled for deletion. If the key is scheduled for deletion, cancel the scheduled deletion.

3. Restart your DB instance or cluster using one of these methods:

• Use AWS CloudShell
• Run the AWS CLI command: aws rds start-db-instance --db-instance-identifier your-instance-name (for RDS)
• Run the AWS CLI command: aws rds start-db-cluster (for Aurora)
• Use the AWS Management Console

If you don't recover the DB instance within seven days, it will transition to the terminal "inaccessible-encryption-credentials" state. In this state, the DB instance is no longer usable, and you can only restore it from a backup.

It's important to note that while in the "inaccessible-encryption-credentials-recoverable" state, you will still be billed for storage. However, if it transitions to the terminal "inaccessible-encryption-credentials" state, you will no longer be billed.
Sources
Resolve the inaccessible encryption state in Amazon RDS | AWS re:Post
After AWS account reactivate, I'm not able to access my AWS RDS | AWS re:Post
Encrypting Amazon Aurora resources - Amazon Aurora
Encrypting Amazon RDS resources - Amazon Relational Database Service
Viewing instance status - Amazon Relational Database Service