KMS ID or KMS ARN about aurora-snapshot-tool HOT 1 CLOSED

TLDR;

• Don't use the default 'aws/rds' key on cluster. Customer Managed Key (CMK) is appropriate.
• Setup share of CMK if across account is needed.
• Use full ARN in KmsKeySource if across account is needed.

I hit a similar issue with the "KMSKeyNotAccessibleFault" error in the lambda logs. After updating the Aurora cluster with a CMK instead of the default aws/rds key I was able to share the CMK with since I had to share across account.

This guide is shows how to share.
https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-modifying-external-accounts.html

After doing these steps the error persisted and I discovered that the "KmsKeySource" I had entered was simply the Key ID and since I was sharing across accounts I needed to specify the ARN since it contains the local (origin) account ID.

Hope this helps.

from aurora-snapshot-tool.