---
schema_version: "1"
id: 6e8bcdc5968cec85716e0c45352e49c0da3ca4136aab38a3d5050a9b3d86de8f
title: Troubleshoot SSE-KMS with VPC Endpoint Errors
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/data-cloud/data-cloud-int/guides/awss3/c360-a-awss3-bucket-policies-troubleshooting.md
canonical_url: https://developer.salesforce.com/docs/data/data-cloud-int/guide/c360-a-awss3-bucket-policies-troubleshooting.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: c2f1e32b048e938482f04d5f5987d428efcb8c4f55ae5c41fb52039cb9d0c49a
products:
  - Data 360 Integration Guide
  - Data 360 Developer Documentation
---
# Troubleshoot SSE-KMS with VPC Endpoint Errors

If Data 360 fails to retrieve encrypted objects after you apply VPC endpoint or KMS policies, use this table to identify and resolve common issues.

| Symptom                                                                                                   | Likely Cause                                                              | Resolution                                                                                                                                                           |
| --------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `AccessDenied` or `KMS.AccessDeniedException` on encrypted object retrieval after adding VPC restrictions | `aws:SourceVpce` or `aws:SourceVpc` condition added to the KMS key policy | Remove the VPC condition from your KMS key policy. Apply it to your S3 bucket policy as a Deny statement scoped to the Data 360 IAM user with your VPCE ID.          |
| Retrieval works without VPC restriction but fails after security hardening                                | Security team added VPC restrictions to both bucket and KMS policies      | Check your KMS key policy for VPC conditions and remove them. Verify that your bucket policy has a Deny statement for the Data 360 IAM user with the VPCE condition. |
| Intermittent access failures after a policy change                                                        | IAM policy propagation delay or cached credentials                        | Wait 5–10 minutes for policy changes to propagate, then retry. Verify all three policies (bucket, KMS, IAM) are consistent.                                          |
| `AccessDenied` even though the VPC condition is only on the bucket policy                                 | The Data 360 IAM user lacks S3 permissions or KMS decrypt access          | Verify that the IAM user has S3 access (via bucket policy `Allow` or identity-based policy) and that the KMS key policy grants decrypt access to the IAM user's ARN. |
| Access works but `kms:ViaService` condition is missing from key policy                                    | KMS key policy is overly permissive                                       | Add the `kms:ViaService` condition to restrict KMS access to S3 service calls only. This condition tightens your security posture.                                   |