AWS Lambda Error - Lambda was unable to decrypt the environment variables because KMS access was denied

#aws#lambda#devops#cloud

This error means Lambda wasn’t able to decrypt environment variables because it lacked the necessary KMS permissions.

Problem

When your Lambda function starts, it fails immediately with:

Lambda was unable to decrypt the environment variables because KMS access was denied.

This happens before your handler runs because Lambda cannot decrypt your environment variables with the KMS key assigned to the function.

Clarifying the Issue

This is a permissions mismatch between:

• The KMS key encrypting your environment variables
• The Lambda execution role that needs to decrypt them

If your execution role isn't allowed to decrypt the key and create the grant Lambda needs, Lambda refuses to start.

Why It Matters

If Lambda cannot decrypt environment variables, the function will not start at all. This breaks:

• Workflows using env vars for config or secrets
• API-driven pipelines
• Event-driven systems
• CI/CD deployments

Restoring correct KMS permissions ensures stable Lambda startup.

Key Terms

• KMS Key: The encryption key securing your environment variables.
• kms:Decrypt: Permission allowing Lambda to decrypt encrypted values.
• kms:CreateGrant: Permission Lambda needs to create a temporary grant so the Lambda service principal can use the key.
• Execution Role: The IAM role Lambda assumes when starting and running.

Steps at a Glance

1. Identify which KMS key encrypts the environment variables.
2. Check CloudWatch Logs for the KMS AccessDenied error.
3. Add kms:Decrypt and kms:CreateGrant to the Lambda execution role.
4. Update the KMS key policy to allow the execution role.
5. Redeploy or refresh the function configuration.
6. Test the function and verify successful startup.

---

Step 1: Identify which KMS key encrypts the environment variables

Open your Lambda function:

Configuration → Environment Variables → Encryption configuration

You’ll see either the AWS-managed aws/lambda key or a customer-managed key such as:

arn:aws:kms:us-east-1:123456789012:key/abcd-1234...

That is the key Lambda is trying to use during startup.

---

Step 2: Check CloudWatch Logs for the KMS failure

Look for:

AccessDeniedException: Lambda was unable to decrypt the environment variables because KMS access was denied.

This confirms a permissions problem—not a code issue.

---

Step 3: Add kms:Decrypt and kms:CreateGrant to the Lambda execution role

Edit the Lambda execution role and attach:

{
  "Effect": "Allow",
  "Action": [
    "kms:Decrypt",
    "kms:CreateGrant"
  ],
  "Resource": "arn:aws:kms:us-east-1:123456789012:key/abcd-1234..."
}

Explanation:

• kms:Decrypt lets Lambda read encrypted values
• kms:CreateGrant lets Lambda create a grant so the Lambda service principal can use the key

Both are required for Lambda to start successfully when using customer-managed keys.

---

Step 4: Update the KMS key policy to allow the Lambda execution role

The KMS key policy must also explicitly allow the Lambda execution role.

Add:

{
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::123456789012:role/MyLambdaExecutionRole"
  },
  "Action": [
    "kms:Decrypt",
    "kms:CreateGrant"
  ],
  "Resource": "*"
}

This ensures the role can use the key during cold starts.

---

Step 5: Redeploy or refresh the Lambda configuration

Trigger Lambda to reload its configuration (and reattempt decrypting env vars):

aws lambda update-function-configuration \
  --function-name MyFunction \
  --environment Variables="{FOO=BAR}"

Expected output:

{
  "FunctionName": "MyFunction",
  "LastModified": "2025-11-14T23:11:00.123+0000"
}

---

Step 6: Test the function and verify successful startup

Invoke the function:

aws lambda invoke \
  --function-name MyFunction \
  response.json

cat response.json

If successful, you'll see your expected handler response.

If it still fails, verify:

• The role ARN in the key policy is correct
• The correct key ARN is set in Lambda’s configuration
• No Deny statements exist anywhere in the key policy

---

Pro Tips

• Always align IAM role permissions and KMS key policies; both matter.
• KMS is regional—ensure the key exists in the same region as the Lambda function.
• Use customer-managed keys only when required; AWS-managed keys reduce operational overhead.
• Keep KMS key policies simple and avoid overlapping allow/deny conditions.

---

Conclusion

This error means Lambda wasn’t able to decrypt environment variables because it lacked the necessary KMS permissions. By granting kms:Decrypt and kms:CreateGrant to your execution role and updating the KMS key policy to match, Lambda can successfully initialize and run your function. Once permissions are aligned, startup becomes stable and predictable.

---

Aaron Rose is a software engineer and technology writer at tech-reader.blog and the author of Think Like a Genius.