<p>I am trying to create an encrypted persistent volume claim with an EBS StorageClass with the below k8s yaml:</p>
<pre><code>    ---
#########################################################
# Encrypted storage for Redis AWS EBS
#########################################################
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: encrypted-redis-data
provisioner: kubernetes.io/aws-ebs
reclaimPolicy: Retain
allowVolumeExpansion: true
parameters:
  encrypted: &quot;true&quot;

---
#########################################################
# Persistent volume for redis
#########################################################
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: redis-data-encry
  labels:
    name: redis-data-encry
spec:
  storageClassName: encrypted-redis-data
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 100Mi
</code></pre>
<p>Upon doing so the persistent volume claim is stuck in &quot;Pending&quot; status with the following error:</p>
<blockquote>
<p>Failed to provision volume with StorageClass &quot;encrypted-redis-data&quot;: failed to create encrypted volume: the volume disappeared after creation, most likely due to inaccessible KMS encryption key</p>
</blockquote>
<p>How can I fix this and create the EBS volume?</p>

<p>I found out the answer thanks to IronMan. I added the proper KMS permissions to the EKS cluster and the volume was created. Answer found here:
<a href="https://github.com/kubernetes/kubernetes/issues/62171#issuecomment-380481349" rel="nofollow noreferrer">https://github.com/kubernetes/kubernetes/issues/62171#issuecomment-380481349</a></p>
<pre><code>{
    &quot;Version&quot;: &quot;2012-10-17&quot;,
    &quot;Statement&quot;: [
        {
            &quot;Sid&quot;: &quot;Minimal_EBS_KMS_Create_and_Attach&quot;,
            &quot;Effect&quot;: &quot;Allow&quot;,
            &quot;Action&quot;: [
                &quot;kms:Decrypt&quot;,
                &quot;kms:GenerateDataKeyWithoutPlaintext&quot;,
                &quot;kms:CreateGrant&quot;
            ],
            &quot;Resource&quot;: &quot;key arn&quot;
        }
    ]
}
</code></pre>
