If Data 360 fails to retrieve encrypted objects after you apply VPC endpoint or KMS policies, use this table to identify and resolve common issues.
| Symptom | Likely Cause | Resolution |
|---|---|---|
AccessDenied or KMS.AccessDeniedException on encrypted object retrieval after adding VPC restrictions |
aws:SourceVpce or aws:SourceVpc condition added to the KMS key policy |
Remove the VPC condition from your KMS key policy. Apply it to your S3 bucket policy as a Deny statement scoped to the Data 360 IAM user with your VPCE ID. |
| Retrieval works without VPC restriction but fails after security hardening | Security team added VPC restrictions to both bucket and KMS policies | Check your KMS key policy for VPC conditions and remove them. Verify that your bucket policy has a Deny statement for the Data 360 IAM user with the VPCE condition. |
| Intermittent access failures after a policy change | IAM policy propagation delay or cached credentials | Wait 5–10 minutes for policy changes to propagate, then retry. Verify all three policies (bucket, KMS, IAM) are consistent. |
AccessDenied even though the VPC condition is only on the bucket policy |
The Data 360 IAM user lacks S3 permissions or KMS decrypt access | Verify that the IAM user has S3 access (via bucket policy Allow or identity-based policy) and that the KMS key policy grants decrypt access to the IAM user's ARN. |
Access works but kms:ViaService condition is missing from key policy |
KMS key policy is overly permissive | Add the kms:ViaService condition to restrict KMS access to S3 service calls only. This condition tightens your security posture. |