title: The ciphertext refers to a customer master key that does not exist,
body: <p>I have a <code>lambda</code> which accesses the <code>S3</code>.</p>
  <p>Before, this lambda program worked well. But recently I changed KMS key of S3 or some other security group setting, (lambda source code doesn't change)</p>
  <p>There comes error.</p>
  <p>I guess this <code>lambda</code> and <code>S3</code> is not on VPC so security group is not relevant.</p>
  <p>then,,, is it related with KMS key ????</p>
  <p><code>S3</code> is encrypted <code>bf3cf318-1376-44de-a014-XXXXXXXXX</code>, so I must give the kms access permission to this lambda ?? but how?</p>
  <p>Or am I completely wrong??</p>
  <pre><code>[ERROR] ClientError: An error occurred (AccessDenied) when calling the GetObject operation: The ciphertext refers to a customer master key that does not exist, does not exist in this region, or you are not allowed to access.
  Traceback (most recent call last):
    File &quot;/var/task/app.py&quot;, line 48, in handler
      raise e
    File &quot;/var/task/app.py&quot;, line 45, in handler
      obj = s3_client.get_object(Bucket=bucket_name, Key=obj_key)
    File &quot;/var/runtime/botocore/client.py&quot;, line 391, in _api_call
      return self._make_api_call(operation_name, kwargs)
    File &quot;/var/runtime/botocore/client.py&quot;, line 719, in _make_api_call
      raise error_class(parsed_response, operation_name)
  [ERROR] ClientError: An error occurred (AccessDenied) when calling the GetObject operation: The ciphertext refers to a customer master key that does not exist, does not exist in this region, or you are not allowed to access. Traceback (most recent call last):   File &quot;/var/task/app.py&quot;, line 48, in handler     raise e   File &quot;/var/task/app.py&quot;, line 45, in handler     obj = s3_client.get_object(Bucket=bucket_name, Key=obj_key)   File &quot;/var/runtime/botocore/client.py&quot;, line 391, in _api_call     return self._make_api_call(operation_name, kwargs)   File &quot;/var/runtime/botocore/client.py&quot;, line 719, in _make_api_call     raise error_class(parsed_response, operation_name)
  </code></pre>
  <p>The source code error occurs is here.</p>
  <pre><code>    try:
          logger.info(f&quot;Try to get the object from bucket [{bucket_name}], key [{obj_key}]&quot;)
          obj = s3_client.get_object(Bucket=bucket_name, Key=obj_key)
      except Exception as e:
          logger.exception(e)
          raise e
  </code></pre>
  <p>Adding this pollicy lambda role</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Sid&quot;: &quot;VisualEditor0&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: &quot;kms:Decrypt&quot;,
              &quot;Resource&quot;: &quot;arn:aws:kms:*:678100228133:key/*&quot;
          }
      ]
  }
  </code></pre>
  <p>the message is changed</p>
  <pre><code>[ERROR] ClientError: An error occurred (AccessDenied) when calling the PutObject operation: User: arn:aws:sts::678100228133:assumed-role/cm-dev-resource-ResizerLambdaServiceRoleAE27CE82-1WN6YXPJAJDCX/cm-dev-lambda-resizer is not authorized to perform: kms:GenerateDataKey on resource: arn:aws:kms:ap-northeast-1:678100228133:key/e08d0542-a4ba-42e7-9725-106a48fd24c2 because no identity-based policy allows the kms:GenerateDataKey action
  Traceback (most recent call last):
    File &quot;/var/task/app.py&quot;, line 82, in handler
      s3_client.put_object(Bucket=out_bk_name, Key=key, Body=data, ContentType=content_type)
    File &quot;/var/runtime/botocore/client.py&quot;, line 391, in _api_call
      return self._make_api_call(operation_name, kwargs)
    File &quot;/var/runtime/botocore/client.py&quot;, line 719, in _make_api_call
      raise error_class(parsed_response, operation_name)
  [ERROR] ClientError: An error occurred (AccessDenied) when calling the PutObject operation: User: arn:aws:sts::678100228133:assumed-role/cm-dev-resource-ResizerLambdaServiceRoleAE27CE82-1WN6YXPJAJDCX/cm-dev-lambda-resizer is not authorized to perform: kms:GenerateDataKey on resource: arn:aws:kms:ap-northeast-1:678100228133:key/e08d0542-a4ba-42e7-9725-106a48fd24c2 because no identity-based policy allows the kms:GenerateDataKey action Traceback (most recent call last):   File &quot;/var/task/app.py&quot;, line 82, in handler     s3_client.put_object(Bucket=out_bk_name, Key=key, Body=data, ContentType=content_type)   File &quot;/var/runtime/botocore/client.py&quot;, line 391, in _api_call     return self._make_api_call(operation_name, kwargs)   File &quot;/var/runtime/botocore/client.py&quot;, line 719, in _make_api_call     raise error_class(parsed_response, operation_name)
  </code></pre>