Access Denied issue in AWS Cross Account S3 PutObject encrypted by AWS Managed Key

Question

I am trying to put a text file from Lambda which is in Account B to S3 bucket in account A. S3 bucket(test-bucket) is having AWS-KMS encryption with aws/s3 Managed Key enabled. 1. I added below permissions in Account A- S3 bucket (test-bucket):

   ```
    {"Version": "2012-10-17",
         "Id": "ExamplePolicy",
         "Statement": [
             {
                 "Sid": "ExampleStmt",
                 "Effect": "Allow",
                 "Principal": {
                     "AWS": "arn:aws:iam::AccountB:role/Lambda-Role"
                 },
                 "Action": "s3:*",
                 "Resource": "arn:aws:s3:::test-bucket/*"
             }
         ]
        }

2. Added below inline policy to my Lambda execution role in Account B:

    {"Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:DescribeKey", "kms:ReEncrypt*" ], "Resource": [ "arn:aws:kms:us-west-2:AccountA:key/AWS-KMS-ID" ] } ] }

This is my Lambda Code:

    res = s3.put_object(
                    Body=message,
                    Key=file_name,
                    Bucket='test-bucket',
                    ACL='bucket-owner-full-control'
                )
    

Getting below error while running this code from Account B Lambda:

    An error occurred (AccessDenied) when calling the PutObject operation: Access Denied

Since the S3 bucket is encrypted by AWS Managed Key so I cannot edit the KMS policy what we do in case of Customer Managed Key.

Someone please guide me what am I missing.

Answer 1

Try granting your lambda function s3:PutObject action permission. So the inline policy of your lambda role should be something like

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "VisualEditor0",
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt",
        "kms:Encrypt",
        "kms:GenerateDataKey",
        "kms:DescribeKey",
        "kms:ReEncrypt*"
      ],
      "Resource": [
        "arn:aws:kms:us-west-2:AccountA:key/AWS-KMS-ID"
      ]
    },
    {
      "Effect": "Allow",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::test-bucket/*"
    }
  ]
}

Answer 2

I've been troubleshooting this for a couple of hours myself.

I don't believe this is possible with the default "AWS Managed Key" when using SSE-KMS. Instead you have to create a CMK and grant the cross account user access to this key.

HTH

Answer 3

Cross account access cannot be granted for AWS Managed Key. Need to use customer managed key or default encryption.

This can be useful- https://aws.amazon.com/premiumsupport/knowledge-center/s3-bucket-access-default-encryption/