topic Re: "Aws Invalid Kms Key State" when trying to start new cluster on AWS in Administration & Architecture

"Aws Invalid Kms Key State" when trying to start new cluster on AWS

xx123 — Tue, 17 Jun 2025 19:47:05 GMT

Hey,

We just established new environment based on AWS. Our first step was to create Cluster but while doing so, we have encountered an error. We tried different policies, configurations and instance types. All resulted in:

Aws Invalid Kms Key State: The VM was terminated due to invalid KMS key. [details] Client.InvalidKMSKey.InvalidState: Client.InvalidKMSKey.InvalidState: The KMS key provided is in an incorrect state(OnDemand)

Any clues how to fix it? What part of config I did messed up? 🙂

Re: "Aws Invalid Kms Key State" when trying to start new cluster on AWS

SP_6721 — Thu, 19 Jun 2025 14:41:32 GMT

Hi @xx123 ,

The error indicates that the AWS KMS key used for encryption is either misconfigured or missing required permissions.

Make sure the KMS key is enabled
Verify that the KMS key and your Databricks workspace are in the same AWS region
Update the key policy to include your Databricks cross-account IAM role with the following permissions:
kms:CreateGrant, kms:Decrypt, kms:GenerateDataKey*, kms:DescribeKey
Ensure the IAM role ARN is properly included in the key policy

Re: "Aws Invalid Kms Key State" when trying to start new cluster on AWS

xx123 — Wed, 25 Jun 2025 20:02:29 GMT

Yes, I followed this document and that fixed it. Thanks.