<p>Turns out I was missing one very important line in my KMS key policy:</p>

<pre><code>    resources = ["*"]
</code></pre>

<p>Now it works fine, and my full policy looks like this:</p>

<pre><code>{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Allow VPC Flow Logs to use the key",
            "Effect": "Allow",
            "Principal": {
                "Service": "delivery.logs.amazonaws.com"
            },
            "Action": [
                "kms:ReEncrypt",
                "kms:GenerateDataKey",
                "kms:Encrypt",
                "kms:DescribeKey",
                "kms:Decrypt"
            ],
            "Resource": "*"
        }
    ]
}
</code></pre>

CC BY-SA 4.0
2020-05-15T18:05:56.993Z
2020-05-15T18:05:56.993Z
Nic
<p>I'm using Terraform and trying to set up automatic export of VPC flow logs into an S3 bucket in the same AWS account and region (ca-central-1) that has default encryption turned on with AWS-KMS (using a CMK). Even after trying many permutations of policies for KMS and the S3 bucket, the flow logger still always ends up in <code>Access error</code> status.</p>

<p><strong>Update</strong>: When the S3 bucket is reconfigured to use AES-256 as the default encryption (instead of KMS) the VPC flow logs get written normally. So it's definitely a KMS problem.</p>

<p>The <code>aws_flow_log</code> Terraform resource is configured exactly according to the <a href="https://www.terraform.io/docs/providers/aws/r/flow_log.html" rel="nofollow noreferrer">documentation</a>.</p>

<pre><code>resource "aws_flow_log" "vpc_flow_log" {
  log_destination_type = "s3"
  log_destination      = "${aws_s3_bucket.awslogs.arn}"
  traffic_type         = "ALL"
  vpc_id               = "${aws_vpc.vpc.id}"
  depends_on           = ["aws_s3_bucket_policy.awslogs"]
}
</code></pre>

<p><a href="https://i.sstatic.net/F1FAY.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/F1FAY.png" alt="A cropped screenshot of the Flow Logs tab in VPC console showing Status in Access error with a pop-up saying The log destination is not accessible."></a></p>

<p>And the result of <code>aws ec2 describe-flow-logs</code>:</p>

<pre><code>{
  "CreationTime": "2020-05-15T16:22:40.142Z",
  "DeliverLogsErrorMessage": "Access error",
  "DeliverLogsStatus": "FAILED",
  "FlowLogId": "fl-REDACTED",
  "FlowLogStatus": "ACTIVE",
  "ResourceId": "vpc-REDACTED
  "TrafficType": "ALL",
  "LogDestinationType": "s3",
  "LogDestination": "arn:aws:s3:::REDACTED-awslogs",
  "LogFormat": "${version} ${account-id} ${interface-id} ${srcaddr} ${dstaddr} ${srcport} ${dstport} ${protocol} ${packets} ${bytes} ${start} ${end} ${action} ${log-status}"
}
</code></pre>

<p>Curiously, it works fine in my second "sandbox" AWS account where I exclusively use the AWS web console, never Terraform. This account is configured the same way with AWS-KMS on the S3 bucket. </p>

<p>Both accounts seem to have the same configuration, so I can't figure out why it works in the sandbox, but fails in my terraformed account.</p>

<hr>

<h3>S3 bucket</h3>

<p>Default encryption is enabled and and Custom KMS arn is selected.</p>

<p><a href="https://i.sstatic.net/zPWp4.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/zPWp4.png" alt="enter image description here"></a></p>

<p>S3 bucket policy includes statements to allow VPC flow logs delivery from <code>delivery.logs.amazonaws.com</code> as written in <a href="https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-s3.html#flow-logs-s3-permissions" rel="nofollow noreferrer">Publishing flow logs to Amazon S3</a>.</p>

<pre><code>    {
        "Sid": "AWSLogDeliveryAclCheck",
        "Effect": "Allow",
        "Principal": {
            "Service": "delivery.logs.amazonaws.com"
        },
        "Action": "s3:GetBucketAcl",
        "Resource": "arn:aws:s3:::REDACTED-awslogs"
    },
    {
        "Sid": "AWSLogDeliveryWrite",
        "Effect": "Allow",
        "Principal": {
            "Service": "delivery.logs.amazonaws.com"
        },
        "Action": "s3:PutObject",
        "Resource": [
            "arn:aws:s3:::REDACTED-awslogs/*",
            "arn:aws:s3:::REDACTED-awslogs/AWSLogs/REDACTED/*"
        ],
        "Condition": {
            "StringEquals": {
                "s3:x-amz-acl": "bucket-owner-full-control"
            }
        }
    }
</code></pre>

<h3>KMS Key Policy</h3>

<p>KMS key policy includes a statement that allows usage by VPC Flow logs as instructed by <a href="https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-s3.html#flow-logs-s3-cmk-policy" rel="nofollow noreferrer">Required CMK key policy for use with SSE-KMS buckets</a>.</p>

<pre><code>    {
        "Sid": "Allow VPC Flow Logs to use the key",
        "Effect": "Allow",
        "Principal": {
            "Service": "delivery.logs.amazonaws.com"
        },
        "Action": [
            "kms:ReEncrypt",
            "kms:GenerateDataKey",
            "kms:Encrypt",
            "kms:DescribeKey",
            "kms:Decrypt"
        ]
    }
</code></pre>

<hr>

<p>I'm at a loss here. What else can I do to troubleshoot this?</p>

<terraform><amazon-s3><aws-vpc><amazon-kms>
Troubleshooting VPC flow logs with an S3 bucket using SSE-KMS encryption with CMK
Nic
# Troubleshooting VPC flow logs with an S3 bucket using SSE-KMS encryption with CMK

(Asked by: username_0 on 2020-05-15)

I'm using Terraform and trying to set up automatic export of VPC flow logs into an S3 bucket in the same AWS account and region (ca-central-1) that has default encryption turned on with AWS-KMS (using a CMK). Even after trying many permutations of policies for KMS and the S3 bucket, the flow logger still always ends up in Access error status.
Update: When the S3 bucket is reconfigured to use AES-256 as the default encryption (instead of KMS) the VPC flow logs get written normally. So it's definitely a KMS problem.
The aws_flow_log Terraform resource is configured exactly according to the documentation.
resource "aws_flow_log" "vpc_flow_log" {
  log_destination_type = "s3"
  log_destination      = "${aws_s3_bucket.awslogs.arn}"
  traffic_type         = "ALL"
  vpc_id               = "${aws_vpc.vpc.id}"
  depends_on           = ["aws_s3_bucket_policy.awslogs"]
}


And the result of aws ec2 describe-flow-logs:
{
  "CreationTime": "2020-05-15T16:22:40.142Z",
  "DeliverLogsErrorMessage": "Access error",
  "DeliverLogsStatus": "FAILED",
  "FlowLogId": "fl-REDACTED",
  "FlowLogStatus": "ACTIVE",
  "ResourceId": "vpc-REDACTED
  "TrafficType": "ALL",
  "LogDestinationType": "s3",
  "LogDestination": "arn:aws:s3:::REDACTED-awslogs",
  "LogFormat": "${version} ${account-id} ${interface-id} ${srcaddr} ${dstaddr} ${srcport} ${dstport} ${protocol} ${packets} ${bytes} ${start} ${end} ${action} ${log-status}"
}

Curiously, it works fine in my second "sandbox" AWS account where I exclusively use the AWS web console, never Terraform. This account is configured the same way with AWS-KMS on the S3 bucket. 
Both accounts seem to have the same configuration, so I can't figure out why it works in the sandbox, but fails in my terraformed account.

S3 bucket
Default encryption is enabled and and Custom KMS arn is selected.

S3 bucket policy includes statements to allow VPC flow logs delivery from delivery.logs.amazonaws.com as written in Publishing flow logs to Amazon S3.
    {
        "Sid": "AWSLogDeliveryAclCheck",
        "Effect": "Allow",
        "Principal": {
            "Service": "delivery.logs.amazonaws.com"
        },
        "Action": "s3:GetBucketAcl",
        "Resource": "arn:aws:s3:::REDACTED-awslogs"
    },
    {
        "Sid": "AWSLogDeliveryWrite",
        "Effect": "Allow",
        "Principal": {
            "Service": "delivery.logs.amazonaws.com"
        },
        "Action": "s3:PutObject",
        "Resource": [
            "arn:aws:s3:::REDACTED-awslogs/*",
            "arn:aws:s3:::REDACTED-awslogs/AWSLogs/REDACTED/*"
        ],
        "Condition": {
            "StringEquals": {
                "s3:x-amz-acl": "bucket-owner-full-control"
            }
        }
    }

KMS Key Policy
KMS key policy includes a statement that allows usage by VPC Flow logs as instructed by Required CMK key policy for use with SSE-KMS buckets.
    {
        "Sid": "Allow VPC Flow Logs to use the key",
        "Effect": "Allow",
        "Principal": {
            "Service": "delivery.logs.amazonaws.com"
        },
        "Action": [
            "kms:ReEncrypt",
            "kms:GenerateDataKey",
            "kms:Encrypt",
            "kms:DescribeKey",
            "kms:Decrypt"
        ]
    }


I'm at a loss here. What else can I do to troubleshoot this?

**Tags:** terraform, amazon-s3, aws-vpc, amazon-kms


---

## 1 answers

### Answer by username_0 on 2020-05-15. Score: 1

Turns out I was missing one very important line in my KMS key policy:
    resources = ["*"]

Now it works fine, and my full policy looks like this:
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Allow VPC Flow Logs to use the key",
            "Effect": "Allow",
            "Principal": {
                "Service": "delivery.logs.amazonaws.com"
            },
            "Action": [
                "kms:ReEncrypt",
                "kms:GenerateDataKey",
                "kms:Encrypt",
                "kms:DescribeKey",
                "kms:Decrypt"
            ],
            "Resource": "*"
        }
    ]
}


---

