title: AWS permissions required to copy and encrypt AMI
body: <p>I am trying to copy an AMI from one AWS account to another and encrypt it with a CMK in the target account.</p>
  
  <p>The key policy on the CMK is:</p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Id": "key-default",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {
          "AWS": "arn:aws:iam::TARGET-ACCOUNT-NUMBER:root"
        },
        "Action": "kms:*",
        "Resource": "*"
      }
    ]
  }
  </code></pre>
  
  <p>I have created a role in the target account with the following policy:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "kms:ListAliases",
                  "kms:GenerateDataKey",
                  "kms:DescribeKey",
                  "kms:Encrypt",
                  "ec2:CopyImage"
              ],
              "Resource": "*"
          }
      ]
  }
  </code></pre>
  
  <p>Also attached to this role is the <code>AmazonEC2ReadOnlyAccess</code> policy.</p>
  
  <p>If I log in to the root account and assume the role in the target account and then try to copy the AMI with my CMK, it fails with <code>Snapshot snap-abc123xyz is in an unexpected state: error</code>. There is no additional information on the snapshot to indicate the root cause.</p>
  
  <p>If I attach the <code>AdministratorAccess</code> policy to the role the AMI copies OK, so it must be a permissions issue.</p>
  
  <p>Can someone provide the list of permissions required to copy an AMI with encryption?</p>