Issue
please help
How to make sure EC2 is using the custom KMS key; we are using terraform to deploy the EC2 instance, every time the EC2 instance is launched in an auto-scaling group, it crashes with the below error. Seems like the EC2 instance has no access to KMS key
Error: Termination Reason: Client.InternalError: Client error on launch
resource "aws_autoscaling_group" "autoscaling-group" {
name = var.name
availability_zones = var.availability_zones
min_size = var.min_size
desired_capacity = var.desired_capacity
max_size = var.max_size
health_check_type = "EC2"
launch_configuration = aws_launch_configuration.launch_configuration.name
vpc_zone_identifier = local.subnet_id
termination_policies = ["OldestInstance"]
}
resource "aws_launch_configuration" "launch_configuration" {
name = var.name
image_id = var.ami
instance_type = var.instance_type
iam_instance_profile = var.iam_instance_profile_name
security_groups = [aws_security_group.security_group.id]
associate_public_ip_address = true
}
resource "aws_autoscaling_policy" "autoscaling-policy" {
name = var.name
policy_type = "TargetTrackingScaling"
estimated_instance_warmup = "90"
adjustment_type = "ChangeInCapacity"
autoscaling_group_name = aws_autoscaling_group.autoscaling-group.name
}
-- Thank you
Solution
Thank you All for your support, I was able to resolve; The issue was with the kms key grant for ec2 auto scaling service we used the below module and the issue got resolved
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_grant
resource "aws_kms_grant" "a" {
name = "my-grant"
key_id = aws_kms_key.a.key_id
grantee_principal = aws_iam_role.a.arn
operations = ["Encrypt", "Decrypt", "GenerateDataKey"]
}
Answered By - Varadharajan Nadar Answer Checked By - Dawn Plyler (WPSolving Volunteer)