title: Using Encrypted EBS Volumes in Auto Scaling Groups with CMK owned by a different AWS account
body: <p>I'm trying to use Auto Scaling groups in AWS to create and manage instances created from AMIs with encrypted snapshots, which have been encrypted by a CMK owned by a different AWS account. </p>
  
  <p>I keep getting the error "Client.InternalError: Client error on launch". According to Scenario 2 at <a href="https://docs.aws.amazon.com/autoscaling/ec2/userguide/ts-as-instancelaunchfailure.html#ts-as-instancelaunchfailure-12" rel="noreferrer">https://docs.aws.amazon.com/autoscaling/ec2/userguide/ts-as-instancelaunchfailure.html#ts-as-instancelaunchfailure-12</a>, I need to create a grant to the CMK with the Auto Scaling group service-linked role as the grantee principal. </p>
  
  <p>I tried following the guidelines in the AWS documentation and at <a href="https://forums.aws.amazon.com/thread.jspa?threadID=277523" rel="noreferrer">https://forums.aws.amazon.com/thread.jspa?threadID=277523</a> for setting up the grant.</p>
  
  <p>However, I keep getting an AccessDeniedException saying that my user is not authorised to perform kms:CreateGrant on the CMK. </p>
  
  <p>I feel like I've followed the instructions perfectly, but it's not working. I'm hoping someone might be able to provide some insight.</p>