Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

ElastiCache Serverless (Valkey) CreateServerlessCache fails with customer-managed KMS key via API but succeeds via Console

0

I’m encountering an issue when creating an ElastiCache Serverless (Valkey) cache using a customer-managed KMS key via the AWS API.

What works

  • Creating the same Valkey Serverless cache via the AWS Console succeeds using the same customer-managed KMS key.
  • Creating the cache without specifying a KMS key (using the AWS-managed key) also succeeds via API.

What fails

  • Creating the cache via API / SDK with KmsKeyId specified consistently fails with:
  • InvalidParameterValue: KMS key access is denied

What has been verified

  • The KMS key is enabled and in the same region as the cache.
  • The service-linked role AWSServiceRoleForElastiCache exists and is actively used.
  • The KMS key policy explicitly allows:
  • AWSServiceRoleForElastiCache:
  • kms:CreateGrant with kms:GrantIsForAWSResource = true
  • kms:Encrypt, kms:Decrypt, kms:GenerateDataKey*, kms:DescribeKey
  • Conditions for kms:ViaService and kms:CallerAccount
  • No policy validation errors are present.

Question

  • Is there a known limitation or additional requirement for using customer-managed KMS keys when provisioning ElastiCache Serverless via API?
  • Is API-based provisioning with CMKs fully supported, or is Console behavior currently different?

Any clarification or confirmation would be appreciated.

Topics
ServerlessDatabaseSecurity, Identity, & Compliance
Tags
Amazon ElastiCacheServerlessAWS Key Management Service
Language
English

asked 8 months ago156 views

2 Answers
0

Hello.

I was able to create a serverless cluster using the AWS CLI with the following command:
Therefore, I think you can create it from the API without any problems.

aws elasticache create-serverless-cache \
     --serverless-cache-name CacheName \
     --engine valkey \
     --kms-key-id 12345678-1234-1234-1234-123456789012

By the way, what kind of error is output?

EXPERT

answered 8 months ago

  • keni
    8 months ago

    I am creating a cluster from a service using an assumed IAM role for authentication.

    1. When the KmsKeyId field is set to the KMS ARN, I get the following error: operation error ElastiCache: CreateServerlessCache, https response error StatusCode: 400, RequestID: 516c580e-cc06-4a8c-a600-ad73224d6ee8, InvalidParameterValue: KMS key access is denied with key id: arn:aws:kms:us-west-2:12345678:key/f91d56a2-11b7-1234-1234-123456789012

    2. When the KmsKeyId field is set to the KMS key ID directly, I get this error: operation error ElastiCache: CreateServerlessCache, https response error StatusCode: 400, RequestID: 5fca33f1-874d-4919-881a-77df3f6ae722, InvalidParameterValue: KMS key access is denied with key id: f91d56a2-11b7-1234-1234-123456789012

    However, I am able to create the cluster successfully using the same KMS key via the AWS Console.

    Go SDK reference used https://github.com/aws/aws-sdk-go-v2/blob/service/elasticache/v1.51.9/service/elasticache/api_op_CreateServerlessCache.go#L30

0

turns out, For ElastiCache to accept that key, the caller's IAM Role needs permission

"kms:DescribeKey",
"kms:CreateGrant"

solved.

answered 8 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content