The target object uses KMS for server-side encryption protection. When initiating a download or read request, the current credentials (IAM user or role) lack decryption permission for the KMS key (missing kms:Decrypt Action), causing the server to deny the data access request.

Example

You initiate the following request:

GET /abc HTTP/1.1​
Host: bucketname.tos-cn-beijing.volces.com​
Date: GMT Date​
Authorization: authorization xxx​

Because object abc is encrypted with KMS and you don’t have decryption permission for that KMS key, the request fails with an error.

Solution

When accessing KMS-encrypted objects, add the corresponding KMS decryption permission to the IAM identity initiating the current request. Follow the steps below to resolve this issue:

Identify the request identity: Check the tool configuration or business code that caused the error and confirm the IAM user or role linked to the AccessKey used to initiate the request.

Configure IAM policy: log in to the Access Management (IAM) console and add or modify the permission policy for this identity, ensuring that the Action list includes kms:Decrypt permission.

tip

Following the principle of least privilege, replace the wildcard * in the Resource field with the specific TRN path of the KMS key that actually encrypts the object. After the permission policy configuration takes effect, resend the download or access request.

Last updated: 2026.10.20 14:15:56

Public security network record in Beijing: No. 11010802032137