Answers: <p>Turns out I was missing one very important line in my KMS key policy:</p>
  
  <pre><code>    resources = ["*"]
  </code></pre>
  
  <p>Now it works fine, and my full policy looks like this:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "Allow VPC Flow Logs to use the key",
              "Effect": "Allow",
              "Principal": {
                  "Service": "delivery.logs.amazonaws.com"
              },
              "Action": [
                  "kms:ReEncrypt",
                  "kms:GenerateDataKey",
                  "kms:Encrypt",
                  "kms:DescribeKey",
                  "kms:Decrypt"
              ],
              "Resource": "*"
          }
      ]
  }
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2020-05-15T18:05:56.993Z
Answers: 2020-05-15T18:05:56.993Z
Answers: Nic
Body: <p>I'm using Terraform and trying to set up automatic export of VPC flow logs into an S3 bucket in the same AWS account and region (ca-central-1) that has default encryption turned on with AWS-KMS (using a CMK). Even after trying many permutations of policies for KMS and the S3 bucket, the flow logger still always ends up in <code>Access error</code> status.</p>
  
  <p><strong>Update</strong>: When the S3 bucket is reconfigured to use AES-256 as the default encryption (instead of KMS) the VPC flow logs get written normally. So it's definitely a KMS problem.</p>
  
  <p>The <code>aws_flow_log</code> Terraform resource is configured exactly according to the <a href="https://www.terraform.io/docs/providers/aws/r/flow_log.html" rel="nofollow noreferrer">documentation</a>.</p>
  
  <pre><code>resource "aws_flow_log" "vpc_flow_log" {
    log_destination_type = "s3"
    log_destination      = "${aws_s3_bucket.awslogs.arn}"
    traffic_type         = "ALL"
    vpc_id               = "${aws_vpc.vpc.id}"
    depends_on           = ["aws_s3_bucket_policy.awslogs"]
  }
  </code></pre>
  
  <p><a href="https://i.sstatic.net/F1FAY.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/F1FAY.png" alt="A cropped screenshot of the Flow Logs tab in VPC console showing Status in Access error with a pop-up saying The log destination is not accessible."></a></p>
  
  <p>And the result of <code>aws ec2 describe-flow-logs</code>:</p>
  
  <pre><code>{
    "CreationTime": "2020-05-15T16:22:40.142Z",
    "DeliverLogsErrorMessage": "Access error",
    "DeliverLogsStatus": "FAILED",
    "FlowLogId": "fl-REDACTED",
    "FlowLogStatus": "ACTIVE",
    "ResourceId": "vpc-REDACTED
    "TrafficType": "ALL",
    "LogDestinationType": "s3",
    "LogDestination": "arn:aws:s3:::REDACTED-awslogs",
    "LogFormat": "${version} ${account-id} ${interface-id} ${srcaddr} ${dstaddr} ${srcport} ${dstport} ${protocol} ${packets} ${bytes} ${start} ${end} ${action} ${log-status}"
  }
  </code></pre>
  
  <p>Curiously, it works fine in my second "sandbox" AWS account where I exclusively use the AWS web console, never Terraform. This account is configured the same way with AWS-KMS on the S3 bucket. </p>
  
  <p>Both accounts seem to have the same configuration, so I can't figure out why it works in the sandbox, but fails in my terraformed account.</p>
  
  <hr>
  
  <h3>S3 bucket</h3>
  
  <p>Default encryption is enabled and and Custom KMS arn is selected.</p>
  
  <p><a href="https://i.sstatic.net/zPWp4.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/zPWp4.png" alt="enter image description here"></a></p>
  
  <p>S3 bucket policy includes statements to allow VPC flow logs delivery from <code>delivery.logs.amazonaws.com</code> as written in <a href="https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-s3.html#flow-logs-s3-permissions" rel="nofollow noreferrer">Publishing flow logs to Amazon S3</a>.</p>
  
  <pre><code>    {
          "Sid": "AWSLogDeliveryAclCheck",
          "Effect": "Allow",
          "Principal": {
              "Service": "delivery.logs.amazonaws.com"
          },
          "Action": "s3:GetBucketAcl",
          "Resource": "arn:aws:s3:::REDACTED-awslogs"
      },
      {
          "Sid": "AWSLogDeliveryWrite",
          "Effect": "Allow",
          "Principal": {
              "Service": "delivery.logs.amazonaws.com"
          },
          "Action": "s3:PutObject",
          "Resource": [
              "arn:aws:s3:::REDACTED-awslogs/*",
              "arn:aws:s3:::REDACTED-awslogs/AWSLogs/REDACTED/*"
          ],
          "Condition": {
              "StringEquals": {
                  "s3:x-amz-acl": "bucket-owner-full-control"
              }
          }
      }
  </code></pre>
  
  <h3>KMS Key Policy</h3>
  
  <p>KMS key policy includes a statement that allows usage by VPC Flow logs as instructed by <a href="https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-s3.html#flow-logs-s3-cmk-policy" rel="nofollow noreferrer">Required CMK key policy for use with SSE-KMS buckets</a>.</p>
  
  <pre><code>    {
          "Sid": "Allow VPC Flow Logs to use the key",
          "Effect": "Allow",
          "Principal": {
              "Service": "delivery.logs.amazonaws.com"
          },
          "Action": [
              "kms:ReEncrypt",
              "kms:GenerateDataKey",
              "kms:Encrypt",
              "kms:DescribeKey",
              "kms:Decrypt"
          ]
      }
  </code></pre>
  
  <hr>
  
  <p>I'm at a loss here. What else can I do to troubleshoot this?</p>
  
Tags: <terraform><amazon-s3><aws-vpc><amazon-kms>
Title: Troubleshooting VPC flow logs with an S3 bucket using SSE-KMS encryption with CMK
UserDisplayName: Nic
ThreadText: # Troubleshooting VPC flow logs with an S3 bucket using SSE-KMS encryption with CMK
  
  (Asked by: username_0 on 2020-05-15)
  
  I'm using Terraform and trying to set up automatic export of VPC flow logs into an S3 bucket in the same AWS account and region (ca-central-1) that has default encryption turned on with AWS-KMS (using a CMK). Even after trying many permutations of policies for KMS and the S3 bucket, the flow logger still always ends up in `Access error` status.
  
  **Update**: When the S3 bucket is reconfigured to use AES-256 as the default encryption (instead of KMS) the VPC flow logs get written normally. So it's definitely a KMS problem.
  
  The `aws_flow_log` Terraform resource is configured exactly according to the [documentation](https://www.terraform.io/docs/providers/aws/r/flow_log.html).
  
  ```
  resource "aws_flow_log" "vpc_flow_log" {
    log_destination_type = "s3"
    log_destination      = "${aws_s3_bucket.awslogs.arn}"
    traffic_type         = "ALL"
    vpc_id               = "${aws_vpc.vpc.id}"
    depends_on           = ["aws_s3_bucket_policy.awslogs"]
  }
  
  ```
  
  [![A cropped screenshot of the Flow Logs tab in VPC console showing Status in Access error with a pop-up saying The log destination is not accessible.](https://i.sstatic.net/F1FAY.png)](https://i.sstatic.net/F1FAY.png)
  
  And the result of `aws ec2 describe-flow-logs`:
  
  ```
  {
    "CreationTime": "2020-05-15T16:22:40.142Z",
    "DeliverLogsErrorMessage": "Access error",
    "DeliverLogsStatus": "FAILED",
    "FlowLogId": "fl-REDACTED",
    "FlowLogStatus": "ACTIVE",
    "ResourceId": "vpc-REDACTED
    "TrafficType": "ALL",
    "LogDestinationType": "s3",
    "LogDestination": "arn:aws:s3:::REDACTED-awslogs",
    "LogFormat": "${version} ${account-id} ${interface-id} ${srcaddr} ${dstaddr} ${srcport} ${dstport} ${protocol} ${packets} ${bytes} ${start} ${end} ${action} ${log-status}"
  }
  
  ```
  
  Curiously, it works fine in my second "sandbox" AWS account where I exclusively use the AWS web console, never Terraform. This account is configured the same way with AWS-KMS on the S3 bucket.
  
  Both accounts seem to have the same configuration, so I can't figure out why it works in the sandbox, but fails in my terraformed account.
  
  ---
  
  ### S3 bucket
  
  Default encryption is enabled and and Custom KMS arn is selected.
  
  [![enter image description here](https://i.sstatic.net/zPWp4.png)](https://i.sstatic.net/zPWp4.png)
  
  S3 bucket policy includes statements to allow VPC flow logs delivery from `delivery.logs.amazonaws.com` as written in [Publishing flow logs to Amazon S3](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-s3.html#flow-logs-s3-permissions).
  
  ```
      {
          "Sid": "AWSLogDeliveryAclCheck",
          "Effect": "Allow",
          "Principal": {
              "Service": "delivery.logs.amazonaws.com"
          },
          "Action": "s3:GetBucketAcl",
          "Resource": "arn:aws:s3:::REDACTED-awslogs"
      },
      {
          "Sid": "AWSLogDeliveryWrite",
          "Effect": "Allow",
          "Principal": {
              "Service": "delivery.logs.amazonaws.com"
          },
          "Action": "s3:PutObject",
          "Resource": [
              "arn:aws:s3:::REDACTED-awslogs/*",
              "arn:aws:s3:::REDACTED-awslogs/AWSLogs/REDACTED/*"
          ],
          "Condition": {
              "StringEquals": {
                  "s3:x-amz-acl": "bucket-owner-full-control"
              }
          }
      }
  
  ```
  
  ### KMS Key Policy
  
  KMS key policy includes a statement that allows usage by VPC Flow logs as instructed by [Required CMK key policy for use with SSE-KMS buckets](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-s3.html#flow-logs-s3-cmk-policy).
  
  ```
      {
          "Sid": "Allow VPC Flow Logs to use the key",
          "Effect": "Allow",
          "Principal": {
              "Service": "delivery.logs.amazonaws.com"
          },
          "Action": [
              "kms:ReEncrypt",
              "kms:GenerateDataKey",
              "kms:Encrypt",
              "kms:DescribeKey",
              "kms:Decrypt"
          ]
      }
  
  ```
  
  ---
  
  I'm at a loss here. What else can I do to troubleshoot this?
  
  **Tags:** terraform, amazon-s3, aws-vpc, amazon-kms
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2020-05-15. Score: 1
  
  Turns out I was missing one very important line in my KMS key policy:
  
  ```
      resources = ["*"]
  
  ```
  
  Now it works fine, and my full policy looks like this:
  
  ```
  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "Allow VPC Flow Logs to use the key",
              "Effect": "Allow",
              "Principal": {
                  "Service": "delivery.logs.amazonaws.com"
              },
              "Action": [
                  "kms:ReEncrypt",
                  "kms:GenerateDataKey",
                  "kms:Encrypt",
                  "kms:DescribeKey",
                  "kms:Decrypt"
              ],
              "Resource": "*"
          }
      ]
  }
  
  ```
  
  
  ---
  
  