PV provisioning is failed for AWS storageclass lacking KMS privileges
Issue
- 
PVC provisioned with AWS EBS CSI driver or AWS in-tree storageclass is stuck in Pending state with below error messages if KMS key is mentioned in storageclass.
Error for PVC with storageclass of AWS EBS CSI driver:Warning ProvisioningFailed 52m ebs.csi.aws.com_ip-10-0-18-23_568113c3-7636-4891-b68d-baf4fa8c02d5 failed to provision volume with StorageClass "gp2-csi-abc": rpc error: code = Internal desc = Could not create volume "pvc-568113c3-7636-4891-b68d-baf4fa8c02d5": failed to get an available volume in EC2: InvalidVolume.NotFound: The volume 'vol-0a4c40a8419407ddb' does not exist. status code: 400, request id: b7aae59c-aa3c-4e21-ab81-bcd858b4a37b .. Warning ProvisioningFailed 26m (x14 over 52m) ebs.csi.aws.com_ip-10-0-18-23_568113c3-7636-4891-b68d-baf4fa8c02d5 failed to provision volume with StorageClass "gp2-csi-abc": rpc error: code = AlreadyExists desc = Could not create volume "pvc-568113c3-7636-4891-b68d-baf4fa8c02d5": Parameters on this idempotent request are inconsistent with parameters used in previous request(s)Error for PVC with In-tree type of storageclass:
Warning ProvisioningFailed 6s persistentvolume-controller Failed to provision volume with StorageClass "gp2": failed to create encrypted volume: the volume disappeared after creation, most likely due to inaccessible KMS encryption key 
Environment
- OpenShift Container Platform 4.x
 - AWS
 
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.