Problem description
OSS returns a 403 error when a KMS-managed key is specified for encryption or decryption but Key Management Service (KMS) is not activated on the account.
Causes
The request uses a KMS-managed customer master key (CMK) for an operation such as creating an encrypted object or bucket, but KMS is not activated on the account. OSS rejects the request with a 403 error until KMS is active.
Examples
The following example shows a scenario where a requester tries to create a KMS-managed CMK, but KMS is not activated on the account. The request fails with a 403 error.
To activate KMS, call OpenKmsService.
Solutions
Call OpenKmsService to activate KMS on the account.
Call DescribeAccountKmsStatus to confirm that KMS is activated.
Use KMS-managed keys to perform encryption, decryption, and other operations.