跨账号AMI创建Terraform Spot实例遇KMS权限错误排查

1. 跨账号场景下缺失接收方账号基础权限 #

你用的是其他账号共享的加密AMI，当前KMS策略只给了Spot相关服务角色授权，但漏掉了发起Spot请求的接收方账号的基础权限。需要在KMS密钥策略里添加接收方账号的权限，允许该账号下的实体访问密钥：

在Allow use of the key语句的Principal中补充接收方账号的根ARN（格式：arn:aws:iam::接收方账号ID:root），或者你运行Terraform所用的具体IAM实体：

"Principal": {
    "AWS": [
        "arn:aws:iam::接收方账号ID:root",
        "arn:aws:iam::xx:role/aws-service-role/spotfleet.amazonaws.com/AWSServiceRoleForEC2SpotFleet",
        "arn:aws:iam::xx:role/aws-service-role/spot.amazonaws.com/AWSServiceRoleForEC2Spot"
    ]
}

2. 调整CreateGrant的条件配置 #

Spot实例启动时，服务角色创建Grant的操作需要额外的条件兼容。修改Allow attachment of persistent resources语句的Condition，补充kms:ViaService限定EC2 Spot服务调用：

"Condition": {
    "Bool": {
        "kms:GrantIsForAWSResource": "true"
    },
    "StringEquals": {
        "kms:ViaService": "ec2.REGION.amazonaws.com"
    }
}

把REGION替换成你实际用的AWS区域，比如us-east-1。

3. 确认源账号的KMS权限配置 #

要确保共享AMI的源账号，已经在KMS密钥策略里授权你的接收方账号可以使用该密钥解密EBS卷——否则哪怕你这边配置到位，源账号的策略限制也会导致失败。

4. Terraform配置额外检查 #

• 确认aws_spot_instance_request或aws_spot_fleet_request资源正确指定了加密AMI，没有额外的EBS加密配置冲突。
• 确保运行Terraform的IAM实体（比如执行计划的角色）拥有kms:DescribeKey、kms:CreateGrant等权限，因为Terraform发起请求时也需要验证密钥权限。

修正后的完整KMS策略示例 #

{
    "Version": "2012-10-17",
    "Id": "key-consolepolicy-1",
    "Statement": [
        {
            "Sid": "Allow use of the key for cross-account and Spot services",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::接收方账号ID:root",
                    "arn:aws:iam::xx:role/aws-service-role/spotfleet.amazonaws.com/AWSServiceRoleForEC2SpotFleet",
                    "arn:aws:iam::xx:role/aws-service-role/spot.amazonaws.com/AWSServiceRoleForEC2Spot"
                ]
            },
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:DescribeKey"
            ],
            "Resource": "*"
        },
        {
            "Sid": "Allow attachment of persistent resources for Spot services",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::xx:role/aws-service-role/spotfleet.amazonaws.com/AWSServiceRoleForEC2SpotFleet",
                    "arn:aws:iam::xx:role/aws-service-role/spot.amazonaws.com/AWSServiceRoleForEC2Spot"
                ]
            },
            "Action": [
                "kms:CreateGrant",
                "kms:ListGrants",
                "kms:RevokeGrant"
            ],
            "Resource": "*",
            "Condition": {
                "Bool": {
                    "kms:GrantIsForAWSResource": "true"
                },
                "StringEquals": {
                    "kms:ViaService": "ec2.us-east-1.amazonaws.com"
                }
            }
        }
    ]
}

注意事项 #

• 替换所有占位符：xx为KMS密钥所属的源账号ID，接收方账号ID为你创建Spot实例的账号ID，us-east-1为实际使用的区域。
• 修改策略后等待5-10分钟，让AWS KMS/IAM策略生效，再重新尝试创建Spot实例。

内容的提问来源于stack exchange，提问作者nevincansel