AWS AmazonKeyManagementServiceClient.decrypt() timed out on EC2 instance

Question

I am trying to use AWS KMS to decrypt data. I am able to use below code successfully locally but the request fails while deployed on EC2 instance. My EC2 is restricted subnet. Do i need to open some specific connection to EC2 to access AWS KMS?

the timeout happens at line

MemoryStream plainText = kmsClient.Decrypt(decryptRequest).Plaintext;


public static string DecryptCC(string data)
    {
        try
        {
            string decryptedString = string.Empty;
            byte[] stringForDecryption = Convert.FromBase64String(data);

            Console.WriteLine("heelo , I am in DC");

            //Move to config
            AmazonKeyManagementServiceConfig config = new AmazonKeyManagementServiceConfig();
            config.RegionEndpoint = RegionEndpoint.APSoutheast2;
            var awsCredentials = new Amazon.Runtime.BasicAWSCredentials("xxxxxxxxxxxxxxxx", "yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy");

            AmazonKeyManagementServiceClient kmsClient = new AmazonKeyManagementServiceClient(awsCredentials, config);
            Console.WriteLine("heelo , I am in DC after client");
            MemoryStream ciphertext = new MemoryStream();
            ciphertext.Write(stringForDecryption, 0, stringForDecryption.Length);

            DecryptRequest decryptRequest = new DecryptRequest()
            {
                CiphertextBlob = ciphertext,

            };
            MemoryStream plainText = kmsClient.Decrypt(decryptRequest).Plaintext;

            //var reader = new StreamReader(plainText);
            decryptedString = Encoding.UTF8.GetString(plainText.ToArray());


            if (decryptedString == null)
            {
                decryptedString = string.Empty;
            }

            return decryptedString;
        }
        catch (Exception ex)
        {
            Console.WriteLine(ex.Message);
        }
        return null;
    }

Answer 1

You can't access any AWS services from inside EC2 unless either your instance has outbound Internet access or the service in question supports VPC endpoints, and you have an endpoint configured correctly.

See Connecting to AWS KMS Through a VPC Endpoint in the KMS Developer Guide.