AWS Glue Fails: Missing kms:Decrypt Permission for SSE-KMS
Exhibit
Refer to the exhibit. Error from AWS Glue job: ``` ERROR: An error occurred while calling o75.pyWriteDynamicFrame. Access Denied. User: arn:aws:sts::123456789012:assumed-role/GlueServiceRole/i-abc123 is not authorized to perform: kms:Decrypt on resource: arn:aws:kms:us-east-1:123456789012:key/mrk-1234567890 because no identity-based policy allows the kms:Decrypt action ```
Refer to the exhibit. A data engineer is running an AWS Glue job that reads from an S3 bucket encrypted with a customer-managed KMS key. The job fails with the error shown. What is the most likely cause?
Quick Answer
The answer is that the IAM role used by the Glue job is missing the kms:Decrypt permission. This is correct because when an S3 bucket uses SSE-KMS with a customer-managed KMS key, any service reading from that bucket—including AWS Glue—must have explicit kms:Decrypt permission on that key. Without it, the Glue job cannot decrypt the S3 objects during the read operation, triggering the access failure. On the AWS Certified Data Engineer Associate DEA-C01 exam, this scenario tests your understanding of how KMS permissions interact with S3 encryption at the service level, often appearing as a trap where candidates mistakenly focus on S3 bucket policies instead of the Glue job’s IAM role. A common memory tip: remember that SSE-KMS decryption is a two-step handshake—S3 grants read access, but the KMS key must separately grant decrypt access to the caller. Think “S3 opens the door, KMS unlocks the box.”
⚠ Common exam trap
AWS often tests the distinction between kms:Decrypt and kms:GenerateDataKey, leading candidates to mistakenly choose the latter when the job is only reading data, not writing or generating new encryption keys.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The IAM role used by the Glue job is missing the kms:Decrypt permission.
The error indicates that the AWS Glue job cannot access the S3 bucket because it lacks the necessary KMS permissions. Since the bucket is encrypted with a customer-managed KMS key, the IAM role assigned to the Glue job must include the kms:Decrypt permission to read the encrypted objects. Without this permission, the job fails when attempting to decrypt the data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The S3 bucket policy denies the kms:Decrypt action.
Why it's wrong here
The error points to identity-based policy, not bucket policy.
- ✓
The IAM role used by the Glue job is missing the kms:Decrypt permission.
Why this is correct
The error says no identity-based policy allows kms:Decrypt.
- ✗
The Glue job does not have permission to call kms:GenerateDataKey.
Why it's wrong here
The error specifies kms:Decrypt, not GenerateDataKey.
- ✗
The KMS key policy does not grant the Glue service principal access.
Why it's wrong here
The role is used, not the service principal directly.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DEA-C01 question is part of Courseiva's 1,711-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DEA-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A data engineer is troubleshooting an issue where an IAM role used by AWS Glue cannot read data from an S3 bucket encrypted with SSE-KMS. The bucket policy allows the role to perform s3:GetObject. What additional permission is needed?
hard- A.s3:GetObjectVersion
- ✓ B.kms:Decrypt on the KMS key
- C.s3:GetObjectAcl
- D.kms:GenerateDataKey on the KMS key
Why B: For SSE-KMS, the IAM role needs kms:Decrypt permission on the KMS key to read encrypted objects. Option A (s3:GetObjectVersion) is not required because the bucket policy already allows s3:GetObject; versioning is not relevant here. Option C (s3:GetObjectAcl) is for access control lists, not encryption. Option D (kms:GenerateDataKey) is used for encrypting new objects, not reading existing ones. Therefore, the correct answer is B.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.