0031-00000302

Description

In scenarios where data is replicated across accounts, the Key Management Service (KMS) key used in the destination region has not granted the Decrypt permission to the role that you authorize OSS to use to replicate data by using key policies.

Possible cause

You initiate a cross-account PutBucketReplication request, but the KMS key used in the destination region has not granted the Decrypt permission to the data replication role by using key policies.

Solution

Configure a key policy for cross-account users.

Reference

For more information, see PutBucketReplication.