Recovery of an encrypted volume may fail: "Not authorized to use key"

Performing a cross account recovery of an encrypted volume, or of an instance containing an encrypted volume may not work if the target account cannot access the encryption key from the source account.

Error may appear in the CPM Server log as below:

ERROR: share_snapshot(.\cpmserver\cpm\aws_utils.py:301) Failed adding share permission to snapshot snap-xxxxx (original volume: vol-xxxxx). Reason: Not authorized to use key arn:aws:kms:us-east-1:xxxxx:key/xxxxx
ERROR: _prepare_snap_info(.\cpmserver\cpm\cpm_copy_snapshot.py:407) copy snapshot failed for region US East (N. Virginia), snapshot snap-xxxxx. Reason: Failed adding share permission to snapshot snap-xxxxx original volume: vol-xxxxx). Reason: Not authorized to use key arn:aws:kms:us-east-1:xxxxx:key/xxxxx

ERROR: start_copy(.\cpmserver\cpm\cpm_copy_snapshot.py:228) Can't start copy snapshot snap-xxxxx. Error: None

Please double check the AWS account being used for recovery to the target account is listed as a Key User or Key Administrator within the source account.

Also please check both accounts have all necessary permissions, listed here:

https://support.n2ws.com/portal/kb/articles/what-are-the-required-minimal-aws-permissions-roles-for-cpm-operation

Related Articles
Cross account Recovery of an encrypted snapshot with shared custom encryption key may fail
Cross account recovery of an encrypted snapshot which is encrypted with a shared custom encryption key may fail when trying to recover a resource either from DR to backup account or from backup to DR account (same account recovery works). CPM server ...
DR of an encrypted snapshot may fail with the “Not Authorized to use key” error
Problem: DR copy may fail with errors like “Not authorized to perform” or “not authorized to use key” Example in CPM backup log: 10-24-18 10:11:04 - Error - Volume DR copy snapshot failed for region US East (N. Virginia), snapshot ...
Cross account recovery of encrypted volumes may fail
A cross account recovery of an encrypted snapshot may fail with this error: Encrypted snapshots can only create volumes in the owner's account Please upgrade to latest 2.X.X version to resolve the issue. Reference defect number - 6676511295, fixed in ...
Cross-account DR may fail with the "Encrypted snapshots with EBS default key cannot be shared (OperationNotPermitted)" error
DR may fail with the "Encrypted snapshots with EBS default key cannot be shared (OperationNotPermitted)" error: Error - Volume DR copy snapshot failed for region Asia Pacific (Sydney), snapshot snap-0123456789abcdef (to DR account). Reason: Failed ...
Cross-Account and Cross-Region DR of an encrypted RDS database may fail
If cross-region and cross-account backup of an encrypted RDS database is successful, but fails in the cross-region cross-account DR copy, you may see the following error in the cpm logs: ERROR: start_copy_region(dr_rds.py:381) RDS DR copy_snapshot ...

Encrypted volume may fail to recover Not authorized to use key

Recovery of an encrypted volume may fail: "Not authorized to use key"

Related Articles

Cross account Recovery of an encrypted snapshot with shared custom encryption key may fail

DR of an encrypted snapshot may fail with the “Not Authorized to use key” error

Cross account recovery of encrypted volumes may fail

Cross-account DR may fail with the "Encrypted snapshots with EBS default key cannot be shared (OperationNotPermitted)" error

Cross-Account and Cross-Region DR of an encrypted RDS database may fail