EBS DR backup fails with No matching KMS alias on target region

Issue: 

encrypted EBS backup to DR region is failing with following error:

Solution:

When the N2WS server is backing up an encrypted volume, the snapshot will be automatically encrypted with the same KMS key, When the server will then try to copy that snapshot to DR region it will search for KMS key with the same alias in the target region, if it will not find it you will get the above error.

There are two ways to resolve it.

1. create a KMS key with EXACTLY the same alias in the target region. for example if the key is called "MyKMSKey", then the alias column need to show exactly that string in both locations.

2. You can change the behaviour of the server, so if it does not find a matching key in target region it will instead use the AWS default managed key.

You can do it from General Setting -> Security

This will then cause the backup to finish successfully with a warning to the user:

• Related Articles

• EBS/RDS DR & Recovery with KMS key

  When copying cross account an EBS/RDS Volume encrypted with custom KMS, a KMS key should also be available in the other account. There are 2 ways that CPM uses for checking KMS key - Alias & Tag KMS Tag When using custom tag, you are telling CPM to ...

• Cross region copy of RDS snapshots may fail with error: RDS DR copy snapshot failed (in Backup account). No matching KMS alias in target region

  Issue: The Following error may appear in the CPM Server logs: ERROR: start_copy_region(dr_rds.py:301) RDS DR copy snapshot failed (in Backup account). No matching KMS alias on target region (source EU (Frankfurt), target Asia Pacific (Singapore), RDS ...

• Cross-account DR backup of encrypted snapshots of Aurora cluster (RDS) may fail with the “No matching KMS alias” error

  DR of encrypted snapshots of AuroraDB cluster (DRS) may fail with the “No matching KMS alias” error in the Backup log: Error - Aurora DR copy snapshot failed (in Backup account). No matching KMS alias on target region (source <source_region>, target ...

• DR of encrypted snapshots may fail with the “No matching KMS alias” error

  DR of encrypted snapshots may fail with the following error in the Backup log: ERROR: start_copy_region(.\cpmserver\cpm\dr_volume.py:<line number>) Volume DR copy snapshot failed (in Backup account). No matching KMS alias on target region (source ...

• DR may fail with "Error: No KMS info for region" and "failed getting kms aliases"

  The following error may appear in the Backup Log: Error - Failed looking for source KMS (region US West (Oregon), snapshot snap-xxxxxxxx). Error: No KMS info for region us-west-2 (No KMS) This error may appear in cpm_server.log: ERROR: ...