EFS Recovery failed - You do not have permission to use the specified KMS key

Recovery might fail with this error:

This error message is an indicator that the IAM Role used for the recovery is not listed as a Key User on the KMS key.

Follow the instructions below and then retry the recovery:

1. Identify the IAM Role name from the EFS Recovery screen:

2. Go to KMS and add the IAM Role as a Key User for the KMS Key you are using in the recovery:

• Related Articles

• Recovery of an encrypted volume may fail: "Not authorized to use key"

  Performing a cross account recovery of an encrypted volume, or of an instance containing an encrypted volume may not work if the target account cannot access the encryption key from the source account. Error may appear in the CPM Server log as below: ...

• EBS/RDS DR & Recovery with KMS key

  When copying cross account an EBS/RDS Volume encrypted with custom KMS, a KMS key should also be available in the other account. There are 2 ways that CPM uses for checking KMS key - Alias & Tag KMS Tag When using custom tag, you are telling CPM to ...

• File level restore may fail with the "Failed adding share permission" error

  File level restore may fail with the "Failed adding share permission" error: ERROR:  share_snapshot(.\cpmserver\cpm\aws_utils.py:265)  Failed adding share permission to snapshot snap-1234567890abcdef (original volume: vol-abcdef1234567890) Failed. ...

• Encrypted Snapshot Recovery from DR account may fail with the “Given key ID is not accessible” error

  Problem: DR recovery may fail with the error “Given key ID is not accessible” The following messages may be printed in the CPM Server log: INFO:  recover_volumes_helper(additional_views.py:515)  from account: accountA, to account: accountB ... ...

• DR of an encrypted snapshot may fail with the “Not Authorized to use key” error

  Problem: DR copy may fail with errors like “Not authorized to perform” or “not authorized to use key” Example in CPM backup log: 10-24-18 10:11:04 - Error - Volume DR copy snapshot failed for region US East (N. Virginia), snapshot ...