密文是指不存在的客户主密钥，答案

【问题标题】：The ciphertext refers to a customer master key that does not exist,密文是指不存在的客户主密钥，
【发布时间】：2022-08-16 05:09:15
【问题描述】：

我有一个lambda 可以访问S3。

之前，这个 lambda 程序运行良好。但最近我更改了 S3 的 KMS 密钥或其他一些安全组设置，（lambda 源代码没有更改）

出现错误。

我猜这 lambda 和 S3 不在 VPC 上，因此安全组不相关。

那么，，，它与KMS密钥有关吗？？？？

S3 是加密的 bf3cf318-1376-44de-a014-XXXXXXXXX，所以我必须给这个 lambda 的 kms 访问权限？？但如何？

还是我完全错了？？

[ERROR] ClientError: An error occurred (AccessDenied) when calling the GetObject operation: The ciphertext refers to a customer master key that does not exist, does not exist in this region, or you are not allowed to access.
Traceback (most recent call last):
  File \"/var/task/app.py\", line 48, in handler
    raise e
  File \"/var/task/app.py\", line 45, in handler
    obj = s3_client.get_object(Bucket=bucket_name, Key=obj_key)
  File \"/var/runtime/botocore/client.py\", line 391, in _api_call
    return self._make_api_call(operation_name, kwargs)
  File \"/var/runtime/botocore/client.py\", line 719, in _make_api_call
    raise error_class(parsed_response, operation_name)
[ERROR] ClientError: An error occurred (AccessDenied) when calling the GetObject operation: The ciphertext refers to a customer master key that does not exist, does not exist in this region, or you are not allowed to access. Traceback (most recent call last):   File \"/var/task/app.py\", line 48, in handler     raise e   File \"/var/task/app.py\", line 45, in handler     obj = s3_client.get_object(Bucket=bucket_name, Key=obj_key)   File \"/var/runtime/botocore/client.py\", line 391, in _api_call     return self._make_api_call(operation_name, kwargs)   File \"/var/runtime/botocore/client.py\", line 719, in _make_api_call     raise error_class(parsed_response, operation_name)

发生源代码错误在这里。

    try:
        logger.info(f\"Try to get the object from bucket [{bucket_name}], key [{obj_key}]\")
        obj = s3_client.get_object(Bucket=bucket_name, Key=obj_key)
    except Exception as e:
        logger.exception(e)
        raise e

添加此策略 lambda 角色

{
    \"Version\": \"2012-10-17\",
    \"Statement\": [
        {
            \"Sid\": \"VisualEditor0\",
            \"Effect\": \"Allow\",
            \"Action\": \"kms:Decrypt\",
            \"Resource\": \"arn:aws:kms:*:678100228133:key/*\"
        }
    ]
}

消息已更改

[ERROR] ClientError: An error occurred (AccessDenied) when calling the PutObject operation: User: arn:aws:sts::678100228133:assumed-role/cm-dev-resource-ResizerLambdaServiceRoleAE27CE82-1WN6YXPJAJDCX/cm-dev-lambda-resizer is not authorized to perform: kms:GenerateDataKey on resource: arn:aws:kms:ap-northeast-1:678100228133:key/e08d0542-a4ba-42e7-9725-106a48fd24c2 because no identity-based policy allows the kms:GenerateDataKey action
Traceback (most recent call last):
  File \"/var/task/app.py\", line 82, in handler
    s3_client.put_object(Bucket=out_bk_name, Key=key, Body=data, ContentType=content_type)
  File \"/var/runtime/botocore/client.py\", line 391, in _api_call
    return self._make_api_call(operation_name, kwargs)
  File \"/var/runtime/botocore/client.py\", line 719, in _make_api_call
    raise error_class(parsed_response, operation_name)
[ERROR] ClientError: An error occurred (AccessDenied) when calling the PutObject operation: User: arn:aws:sts::678100228133:assumed-role/cm-dev-resource-ResizerLambdaServiceRoleAE27CE82-1WN6YXPJAJDCX/cm-dev-lambda-resizer is not authorized to perform: kms:GenerateDataKey on resource: arn:aws:kms:ap-northeast-1:678100228133:key/e08d0542-a4ba-42e7-9725-106a48fd24c2 because no identity-based policy allows the kms:GenerateDataKey action Traceback (most recent call last):   File \"/var/task/app.py\", line 82, in handler     s3_client.put_object(Bucket=out_bk_name, Key=key, Body=data, ContentType=content_type)   File \"/var/runtime/botocore/client.py\", line 391, in _api_call     return self._make_api_call(operation_name, kwargs)   File \"/var/runtime/botocore/client.py\", line 719, in _make_api_call     raise error_class(parsed_response, operation_name)

标签： amazon-web-services amazon-s3 aws-lambda amazon-kms

【解决方案1】：

请参阅粗体显示的错误消息部分：

[ERROR] ClientError：调用GetObject操作时发生错误（AccessDenied）：密文指的是不存在的客户主密钥，在该区域不存在，或者你不被允许访问。

还有你的问题：

所以我必须给这个 lambda 的 kms 访问权限

您似乎没有在IAM role assigned to the Lambda function 中提供 KMS 权限。

KMS keys also have an access policy 可能会阻止 Lambda 访问。如果修复 Lambda 函数的 IAM 角色不能解决这个问题，那么我会考虑这个问题。

【讨论】：

谢谢我将策略添加到角色，消息已更改
请阅读新的错误信息。现在它告诉您缺少 S3 权限，因此您还需要将其添加到 IAM 角色。
我将 kms:* 添加到策略中，它有效。
我的角色和密钥策略都拥有对所有资源的 kms:* 权限。但是，我仍然收到错误消息。我还检查了该地区。

【解决方案2】：

尽管 Lambda 附加了kms decrypt 策略，但我收到了此错误The ciphertext refers to a customer master key...。问题是，我必须在 KMS 密钥本身的基于资源的策略中添加以下策略声明，如下所示；

{
  "Sid": "AllowLambdaDecrypt",
  "Action": [
    "kms:Decrypt", "<add more required actions here>"
  ],
  "Effect": "Allow",
  "Resource": "arn:aws:s3:::<bucketName>/*",
  "Principal": {
    "AWS": [
      "arn:aws:iam:::<account_id>:role/service-role/<lambdaRole>"
    ]
  }
}

笔记：如果您有 aws 管理的 kms 密钥，那么您将无法修改其策略。 (read this limitation)。因此，请确保您使用自己生成的客户管理的 kms 密钥。在我的YouTube video 中查看完整的详细信息

【讨论】：