title: Lambda cannot access KMS Key
body: <p>When I run my lambda code, I get the following error: </p>
  
  <p><code>The ciphertext refers to a customer master key that does not exist, does not exist in this region, or you are not allowed to access.</code></p>
  
  <p>I have mostly followed <a href="https://aws.amazon.com/blogs/compute/sharing-secrets-with-aws-lambda-using-aws-systems-manager-parameter-store/" rel="noreferrer">this</a> to create the stack using aws-sam-cli, and the relevant sections of the template are below the code.</p>
  
  <p>The relevant code is: </p>
  
  <pre><code>const ssm = new AWS.SSM();
  const param = {
      Name: "param1",
      WithDecryption: true
  };
  const secret = await ssm.getParameter(param).promise();
  </code></pre>
  
  <p>The relevant part of the template.yaml file is:</p>
  
  <pre><code>KeyAlias:
      Type: AWS::KMS::Alias
      Properties:
        AliasName: 'param1Key'
        TargetKeyId: !Ref Key
  Key:
      Type: AWS::KMS::Key
      Properties:
        KeyPolicy:
          Id: default
          Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
            Action:
            - 'kms:Create*'
            - 'kms:Encrypt'
            - 'kms:Describe*'
            - 'kms:Enable*'
            - 'kms:List*'
            - 'kms:Put*'
            - 'kms:Update*'
            - 'kms:Revoke*'
            - 'kms:Disable*'
            - 'kms:Get*'
            - 'kms:Delete*'
            - 'kms:ScheduleKeyDeletion'
            - 'kms:CancelKeyDeletion'
            Resource: '*'
            Sid: Allow root account all permissions except to decrypt the key
          Version: 2012-10-17
  
  LambdaFunction:
      Type: AWS::Serverless::Function
      Properties:
        CodeUri: ../
        Handler: app.lambda
        Runtime: nodejs8.10
        Policies:
        - DynamoDBReadPolicy:
            TableName: !Ref Table
        - KMSDecryptPolicy:
            KeyId: !Ref Key
        - Statement:
           - Action:
             - "ssm:GetParameter"
             Effect: Allow
             Resource: !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/param1"
  </code></pre>
  
  <p>Does the <code>KMSDecryptPolicy</code> not allow the use of the key?  What am I missing?  Thanks!</p>
  
  <p>EDIT:  Changing the template to below works, but I'd really like to use the <code>KMSDecryptPolicy</code> in the lambda definition if possible.</p>
  
  <pre><code>LambdaFunction:
      Type: AWS::Serverless::Function
      Properties:
        CodeUri: ../
        Handler: app.lambda
        Runtime: nodejs8.10
        Policies:
        - DynamoDBReadPolicy:
            TableName: !Ref Table
        - KMSDecryptPolicy:
            KeyId: !Ref Key
        - Statement:
           - Action:
             - "ssm:GetParameter"
             Effect: Allow
             Resource: !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/param1"
  
  Key:
      Type: AWS::KMS::Key
      Properties:
        KeyPolicy:
          Id: default
          Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
            Action:
            - 'kms:Create*'
            - 'kms:Encrypt'
            - 'kms:Describe*'
            - 'kms:Enable*'
            - 'kms:List*'
            - 'kms:Put*'
            - 'kms:Update*'
            - 'kms:Revoke*'
            - 'kms:Disable*'
            - 'kms:Get*'
            - 'kms:Delete*'
            - 'kms:ScheduleKeyDeletion'
            - 'kms:CancelKeyDeletion'
            Resource: '*'
            Sid: Allow root account all permissions except to decrypt the key
          - Sid: 'Allow use of the key for decryption by the LambdaFunction'
            Effect: Allow
            Principal:
              AWS: !GetAtt LambdaFunctionRole.Arn
            Action:
            - 'kms:Decrypt'
            Resource: '*'        
          Version: 2012-10-17
  </code></pre>