使用KMS Grant推送SNS加密主题时遇AccessDeniedException求助

尝试通过角色R1向采用KMS密钥加密的SNS主题推送通知，角色R1的IAM权限配置如下：

{
"Statement": [
    {
        "Action": "sns:Publish",
        "Effect": "Allow",
        "Resource": [
            "arn:..sns..:topicA",
            "arn:..sns..:topicB",
        ],
        "Sid": ""
    },
    {
        "Action": "kms:GenerateDataKey",
        "Effect": "Allow",
        "Resource": [
            "arn:aws:kms:...:key/keyTopicA",
            "arn:aws:kms:...:key/keyTopicB"
        ],
        "Sid": ""
    }
],
"Version": "2012-10-17"
}

KMS密钥keyTopicA和keyTopicB的密钥策略如下：

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "Enable IAM policies",
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::<AccountID>:root"
        },
        "Action": "kms:*",
        "Resource": "*"
    }
]
}

未在密钥策略中显式允许角色R1，而是通过Grant为其授权，keyTopicA的Grant配置如下（keyTopicB的配置与此一致）：

{
   "Grants":[
      {
         "KeyId":"arn:aws:kms:...:key/keyTopicA",
         "GrantId":"<GrantID>",
         "Name":"grantA",
         "GranteePrincipal":"arn:aws:iam::...:role/R1",
         "IssuingAccount":"arn:aws:iam::...:root",
         "Operations":[
            "GenerateDataKey"
         ]
      }
   ]
}

推送通知时出现如下错误：

The ciphertext refers to a customer master key that does not exist, does not exist in this region, or you are not allowed to access. (Service: AWSKMS; Status Code: 400; Error Code: AccessDeniedException;

排除密钥/区域错误后，发现仅在密钥策略中显式添加角色R1时操作正常。请问为何通过Grant授权无法生效，是否遗漏了Grant的相关规则？

导致Grant授权失效的核心原因是遗漏了SNS推送加密主题时所需的额外KMS操作权限，具体分析如下：

• SNS发布加密主题的权限需求
  当向启用KMS加密的SNS主题推送消息时，SNS服务会代表调用者（角色R1）执行两项关键KMS操作：

  • kms:GenerateDataKey：生成数据密钥用于加密消息内容
  • kms:DescribeKey：验证目标KMS密钥的有效性、状态及区域信息
    你的Grant仅授权了GenerateDataKey，未覆盖kms:DescribeKey，导致SNS在密钥验证步骤触发权限拒绝。

• 密钥策略与Grant的授权逻辑差异
  在密钥策略中显式添加角色R1时，通常会授予包含DescribeKey的权限集合，自然覆盖所有操作；而Grant是最小权限授权模式，仅生效你明确指定的操作，未声明的操作会被默认拒绝。

• 修复方案
  更新Grant的Operations字段，补充kms:DescribeKey权限：

{
   "Grants":[
      {
         "KeyId":"arn:aws:kms:...:key/keyTopicA",
         "GrantId":"<GrantID>",
         "Name":"grantA",
         "GranteePrincipal":"arn:aws:iam::...:role/R1",
         "IssuingAccount":"arn:aws:iam::...:root",
         "Operations":[
            "GenerateDataKey",
            "DescribeKey"
         ]
      }
   ]
}

同时建议同步更新角色R1的IAM策略，添加kms:DescribeKey权限（确保IAM策略与Grant权限匹配，避免权限逻辑混淆）。

额外需确认Grant的GranteePrincipal是角色R1的正确ARN，且未设置限制访问的Constraints条件。

内容的提问来源于stack exchange，提问作者Djoby