Troubleshoot SSE-KMS with VPC Endpoint Errors

If Data 360 fails to retrieve encrypted objects after you apply VPC endpoint or KMS policies, use this table to identify and resolve common issues.

Symptom	Likely Cause	Resolution
`AccessDenied` or `KMS.AccessDeniedException` on encrypted object retrieval after adding VPC restrictions	`aws:SourceVpce` or `aws:SourceVpc` condition added to the KMS key policy	Remove the VPC condition from your KMS key policy. Apply it to your S3 bucket policy as a Deny statement scoped to the Data 360 IAM user with your VPCE ID.
Retrieval works without VPC restriction but fails after security hardening	Security team added VPC restrictions to both bucket and KMS policies	Check your KMS key policy for VPC conditions and remove them. Verify that your bucket policy has a Deny statement for the Data 360 IAM user with the VPCE condition.
Intermittent access failures after a policy change	IAM policy propagation delay or cached credentials	Wait 5–10 minutes for policy changes to propagate, then retry. Verify all three policies (bucket, KMS, IAM) are consistent.
`AccessDenied` even though the VPC condition is only on the bucket policy	The Data 360 IAM user lacks S3 permissions or KMS decrypt access	Verify that the IAM user has S3 access (via bucket policy `Allow` or identity-based policy) and that the KMS key policy grants decrypt access to the IAM user’s ARN.
Access works but `kms:ViaService` condition is missing from key policy	KMS key policy is overly permissive	Add the `kms:ViaService` condition to restrict KMS access to S3 service calls only. This condition tightens your security posture.