title: AWS: AccessDeniedException when calling ssm:GetParameterHistory on SSM Parameter
body: <p>I am trying to write a lambda that listens for Parameter Store change events from CloudWatch and gets history data for the parameter by calling <code>boto3.client('ssm').get_parameter_history(Name=event["name"],WithDecryption=True)</code>. This method fails with the message:</p>
  
  <blockquote>
    <p>botocore.exceptions.ClientError: An error occurred (AccessDeniedException) when calling the GetParameterHistory operation: The ciphertext refers to a customer master key that does not exist, does not exist in this region, or you are not allowed to access. (Service: AWSKMS; Status Code: 400; Error Code: AccessDeniedException; Request ID: blah-blah-blah)</p>
  </blockquote>
  
  <p>Below is what the lambda's execution role looks like:</p>
  
  <pre><code>{
    "roleName": "myapp-paramstore-updates-webhook-role",
    "policies": [
      {
        "document": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": "logs:CreateLogGroup",
              "Resource": "arn:aws:logs:eu-west-1:000000000000:*"
            },
            {
              "Effect": "Allow",
              "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents"
              ],
              "Resource": [
                "arn:aws:logs:eu-west-1:000000000000:log-group:/aws/lambda/ssm-paramstore-updates-webhook:*"
              ]
            }
          ]
        },
        "name": "LambdaBasicExeRole",
        "type": "inline"
      },
      {
        "document": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Sid": "VisualEditor0",
              "Effect": "Allow",
              "Action": [
                "kms:DescribeKey",
                "ssm:GetParameter"
              ],
              "Resource": [
                "arn:aws:kms:eu-west-1:000000000000:key/*",
                "arn:aws:ssm:eu-west-1:000000000000:parameter/myorg/myteam/slack/webhooks/ssm-paramstore-updates-webhook",
                "arn:aws:ssm:eu-west-1:000000000000:parameter/myorg/myteam/slack/webhooks/system-eventsupdates-webhook"
              ]
            },
            {
              "Sid": "VisualEditor1",
              "Effect": "Allow",
              "Action": "ssm:GetParameterHistory",
              "Resource": "arn:aws:ssm:*:*:parameter/*"
            }
          ]
        },
        "name": "readonly-ssm-paramstore-updates-webhook",
        "type": "inline"
      }
    ],
    "trustedEntities": [
      "lambda.amazonaws.com"
    ]
  }
  </code></pre>
  
  <p>Before I used <code>ssm:GetParameterHistory</code>, there was <code>ssm:DescribeParameters</code>, but I needed to get some version info, hence the change. Everything is in the same region, the lambda and the parameters.</p>
  
  <p>What additional permissions do I need now and on what resource in order to fix this?</p>