Lambda "Access Denied" when uploading to S3 - amazon-web-services

Question

I've been working with Serverless (the framework) and I've come across an issue. This might be down to my minimal knowledge of AWS and it's archicture but maybe someone can point me in the right direction.
I've created an S3 bucket with Terraform, it utilises AWS's KMS to give the bucket Server Side Encrpytion. Uploading to this bucket works fine from the CLI, but when using a Lambda created by serverless it returns and "Access Denied".
The serverless yaml has permissions for uploads to S3 and I've tested this with SSE turned off and it works fine.
What I don't understand is how to specify the key for AWS. I thought adding it to the top of the service might work (but to no avail).
Here is the yaml file:
service:
name: lambdas
awsKmsKeyArn: [KEY GOES HERE]
custom:
serverless-offline:
port: 3000
bucket:
name: evidence-bucket
serverSideEncryption: aws:kms
sseKMSKeyId: [ KEY GOES HERE]
provider:
name: aws
runtime: nodejs12.x
region: eu-west-2
iamRoleStatements:
- Effect: Allow
Action:
- s3:ListBucket
- s3:PutObject
- s3:PutObjectAcl
Resource: "arn:aws:s3:::${self:custom.bucket.name}/*"
- Effect: Allow
Action:
- kms:Encrypt
- kms:Decrypt
- kms:DescribeKey
Resource: "[KEY GOES HERE]"
functions:
storeEvidence:
handler: handler.storeEvidence
environment:
BUCKET: ${self:custom.bucket.name}
events:
- http:
path: store-evidence
method: post
Do I need an additional plugin? There is a lot of information about creating a bucket with serverless but not for using an existing bucket with SSE? How do I get around this "Access Denied" message?

Answer 1

As jarmod in the comment said, you are missing the kms:GenerateDataKey. Here I am gonna show you what exact need to add to your existing yaml shown above:
# ...
provider:
name: aws
runtime: nodejs12.x
region: eu-west-2
iamRoleStatements:
- Effect: Allow
Action:
- s3:ListBucket
- s3:PutObject
- s3:PutObjectAcl
Resource: "arn:aws:s3:::${self:custom.bucket.name}/*"
- Effect: Allow
Action:
- kms:Encrypt
- kms:Decrypt
- kms:DescribeKey
- kms:GenerateDataKey # <------ this is the new permission
Resource: "[KEY GOES HERE]"
#...
And it is worth to note that if your code literally just use s3:PutObject to upload, you don't need to add Encrypt,DescribeKey permissions. See: https://aws.amazon.com/premiumsupport/knowledge-center/s3-access-denied-error-kms/
If your code involves multipart upload, you do need kms:DescribeKey, kms:Encrypt and more permissions(like kms:ReEncrypt*, kms:GenerateDataKey*...) See details: https://docs.aws.amazon.com/AmazonS3/latest/dev/mpuAndPermissions.html

Answer 2

Try this:
iamRoleStatements:
- Effect: Allow
Action:
- s3:*
Resource: "arn:aws:s3:::${self:custom.bucket.name}/*"
- Effect: Allow
Action:
- kms:*
Resource: "[KEY GOES HERE]"
If this works, you know you were missing some action. Its then a painful process of finding that missing action, or if your happy, just leave the *s in.