title: S3 PutObject with KMS encryption fails with 403 "Access Denied" error
body: <p>I've been trying to do a PutObject call to AWS S3 while utilizing server-side encryption with a KMS key, but the call keeps failing with a 403 code and the message says "Access Denied".</p>
  
  <p>Here's the C# code I'm using the make the call:</p>
  
  <pre><code>const string fileName = "test.txt";
  using (var stream = new MemoryStream())
  {
      using (var sw = new StreamWriter(stream))
      {
          sw.AutoFlush = true;
          sw.Write("letsseeifthisworks");
  
          var por = new PutObjectRequest
          {
              BucketName = _bucketname,
              Key = fileName,
              InputStream = stream,
              ServerSideEncryptionMethod = ServerSideEncryptionMethod.AWSKMS,
              ServerSideEncryptionKeyManagementServiceKeyId = _kmsKeyId
          };
  
          var response = _s3Client.PutObject(por);
      }
  }
  </code></pre>
  
  <p>Here's what the HTTP request looks like:</p>
  
  <pre><code>PUT https://notarealcorp.s3.us-west-1.amazonaws.com/test.txt HTTP/1.1
  Content-Type: text/plain
  x-amz-server-side-encryption: aws:kms
  x-amz-server-side-encryption-aws-kms-key-id: arn:aws:kms:us-west-1:&lt;account&gt;:key/&lt;kms-key-guid&gt;
  User-Agent: aws-sdk-dotnet-45/3.3.16.2 aws-sdk-dotnet-core/3.3.21.6 .NET_Runtime/4.0 .NET_Framework/4.0 OS/Microsoft_Windows_NT_6.1.7601_Service_Pack_1 ClientSync
  host: notarealcorp.s3.us-west-1.amazonaws.com
  X-Amz-Date: 20180109T072431Z
  X-Amz-Decoded-Content-Length: 18
  X-Amz-Content-SHA256: STREAMING-AWS4-HMAC-SHA256-PAYLOAD
  Authorization: AWS4-HMAC-SHA256 Credential=&lt;access-key&gt;/20180109/us-west-1/s3/aws4_request, SignedHeaders=content-length;content-type;host;user-agent;x-
  amz-content-sha256;x-amz-date;x-amz-decoded-content-length;x-amz-server-side-encryption;x-amz-server-side-encryption-aws-kms-key-id, Signature=&lt;signature&gt;
  Content-Length: 191
  Expect: 100-continue
  
  12;chunk-signature=&lt;another-signature&gt;
  letsseeifthisworks
  0;chunk-signature=&lt;yet-another-signature&gt;
  </code></pre>
  
  <p>And here's the response:</p>
  
  <pre><code>HTTP/1.1 403 Forbidden
  x-amz-request-id: &lt;request-id&gt;
  x-amz-id-2: &lt;host-id&gt;
  Content-Type: application/xml
  Transfer-Encoding: chunked
  Date: Tue, 09 Jan 2018 07:24:31 GMT
  Connection: close
  Server: AmazonS3
  
  f3
  &lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;Error&gt;&lt;Code&gt;AccessDenied&lt;/Code&gt;&lt;Message&gt;Access Denied&lt;/Message&gt;
  &lt;RequestId&gt;request-id&lt;/RequestId&gt;&lt;HostId&gt;host-id&lt;/HostId&gt;&lt;/Error&gt;
  0
  </code></pre>
  
  <p>These are the IAM permissions I have set up. First, S3:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": "s3:*",
              "Resource": "*"
          }
      ]
  }
  </code></pre>
  
  <p>and then KMS:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "VisualEditor0",
              "Effect": "Allow",
              "Action": "kms:*",
              "Resource": "*"
          }
      ]
  }
  </code></pre>
  
  <p>When I comment out the encryption, the call goes through and I can see the file being created.</p>
  
  <p>I'm unsure what the 'Access Denied' means. What resource am I being denied access to? Any help would be greatly appreciated.</p>