Error: KMS Key Access Denied Error DynamoDB

A KMS access-denied error from DynamoDB means the encryption key cannot be used for the attempted operation. DynamoDB table permissions alone do not establish permission to use a customer managed KMS key.

1. Identify the actual caller and the KMS key ARN in the table's SSEDescription. Check the matching KMS failure in CloudTrail to see which action was denied.
2. Review the key policy, relevant IAM policy and grants together. Look for explicit denies, permissions boundaries, organization policies and restrictive kms:ViaService or encryption-context conditions.
3. Check that the key is enabled and available in the table's Region. A disabled key or one pending deletion is a key-state issue, not a missing DynamoDB read permission.
4. Grant only the KMS operations needed for that workflow on the specific key. Reading encrypted data can require kms:Decrypt; table creation or key changes can involve GenerateDataKey, CreateGrant, DescribeKey and re-encryption permissions.

aws dynamodb describe-table --table-name Orders \
  --query 'Table.SSEDescription'
aws kms describe-key --key-id YOUR_KEY_ARN

Use the ARN returned by DescribeTable and the same Region and role as the failing application. If the key policy delegates access to IAM, the caller also needs the corresponding IAM allow. If policies intentionally restrict use through DynamoDB, retain those restrictions while correcting the principal, Region or table context. Do not replace the policy with unrestricted KMS access.

See DynamoDB encryption and AWS documentation.