AWS KMS Permission Issue: User Not Authorized to Perform kms:CreateGrant

If you're encountering an error message that says "User not authorized to perform kms:CreateGrant," this article is for you. This error typically occurs when a user doesn't have the necessary permissions to perform a specific action in AWS Key Management Service (KMS). In this article, we will explain what this error means, why it occurs, and how to fix it.

What is the kms:CreateGrant Permission?

The kms:CreateGrant permission is a permission in AWS KMS that allows a user to create a grant. A grant is a document that gives permissions to AWS KMS keys. With a grant, you can delegate access to a KMS key to another AWS account or to IAM users in your own account.

Why Does the "User Not Authorized to Perform kms:CreateGrant" Error Occur?

The "User not authorized to perform kms:CreateGrant" error occurs when a user doesn't have the necessary permissions to create a grant. This can happen if the user is not explicitly granted the kms:CreateGrant permission or if the user is part of a group that doesn't have the necessary permissions.

How to Fix the "User Not Authorized to Perform kms:CreateGrant" Error

To fix the "User not authorized to perform kms:CreateGrant" error, you need to grant the user the necessary permissions. Here are the steps to follow:

1. Sign in to the AWS Management Console as an administrator.
2. Navigate to the IAM service.
3. Find the user that is encountering the error and click on their name.
4. Click on the "Permissions" tab.
5. Click on "Add inline policy" to create a new policy.
6. Select "Custom Policy" and click on "Select."
7. Enter a name for the policy, such as "KMSCreateGrantPolicy."
8. Enter the following policy document:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "kms:CreateGrant",
"Resource": "*"
}
]
}

This policy document grants the user the kms:CreateGrant permission on all KMS keys. If you want to limit the permission to specific keys, you can replace the asterisk (*) in the Resource field with the ARN of the key.

After you've created the policy, click on "Review policy" and then "Create policy" to save it. The user should now have the necessary permissions to create a grant.

The "User not authorized to perform kms:CreateGrant" error occurs when a user doesn't have the necessary permissions to create a grant in AWS KMS. To fix this error, you need to grant the user the kms:CreateGrant permission. You can do this by creating an inline policy and granting the user the necessary permissions. By following the steps in this article, you should be able to resolve the error and grant the user the necessary permissions.

References