Unable to access encrypted S3 objects across accounts !!

Hello Rakri,

Thank you for posting your question on the Microsoft Windows Forum!

If downloads from Account B's S3 bucket are failing and the objects are encrypted with AWS KMS, the issue is often not the S3 bucket policy itself but missing permissions in the KMS key policy. For cross-account access, both the S3 permissions and the KMS permissions must allow the requesting principal to decrypt the object. If either permission is missing, downloads can fail with AccessDenied errors even when the object is visible.

Step 1: Confirm the Actual Error

First, identify the exact error returned during download using PowerShell/CMD as administrator:

aws s3 cp s3://bucket-name/object C:\Temp\

aws s3 cp s3://bucket-name/object C:\Users\Username\Downloads\

or

aws s3api get-object </span>
  --bucket bucket-name </span>
  --key object-key </span>
  output.file

Check whether the error mentions:

AccessDenied
kms:Decrypt
KMS key access denied

This helps confirm that the failure is related to KMS permissions rather than bucket permissions.

Step 2: Review KMS Key Policy

The KMS key in Account B must allow the user, role, or account from Account A to use:

JSON:

"kms:Decrypt"
"kms:DescribeKey"

A typical cross-account statement looks similar to:

{
  "Sid": "AllowAccountADecrypt",
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::ACCOUNT-A-ID:root"
  },
  "Action": [
    "kms:Decrypt",
    "kms:DescribeKey"
  ],
  "Resource": "*"
}

Step 3: Verify IAM Permissions in Account A

Even if the KMS key policy allows access, the IAM user or role performing the download must also have permissions such as:

JSON:

{
  "Effect": "Allow",
  "Action": [
    "kms:Decrypt",
    "kms:DescribeKey"
  ],
  "Resource": "arn:aws:kms:REGION:ACCOUNT-B:key/KEY-ID"
}

Step 4: Validate S3 Permissions

Ensure the principal can still access the object through either:

• S3 bucket policy
• IAM policy
• Access Point policy

For example:

s3:GetObject

must be allowed for the same principal attempting the download.

Additional Information Needed

To help identify the safest remediation, could you please provide:

1. Is the download being performed by:
   • An IAM User?
   • An IAM Role?
   • A cross-account application?
2. Is the KMS key:
   • AWS-managed (aws/s3)?
   • Customer-managed (CMK)?
3. What is the exact error message returned during the download attempt?

Reference

For authoritative guidance, please review AWS documentation:

• KMS cross-account access: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-modifying-external-accounts.html
• S3 encrypted object access: https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingKMSEncryption.html

If the information provided was helpful, please consider clicking Accept Answer and consider upvoting it. Doing so helps other community members identify useful solutions to similar issues.