aws parameter store getparameter failed with access denied

TL;DR

Parameter reads need the SSM read permission plus KMS decrypt for SecureString parameters. Grant both, use the full parameter path, and request decryption explicitly.

Error

aws parameter store getparameter failed with access denied

Steps

1. Confirm the parameter exists at the exact path, including leading slash. Expected: the path resolves.
2. Check the caller's IAM policy for the SSM read action on that parameter ARN. Expected: the gap found.
3. For SecureString, also check KMS decrypt on the parameter's key, requesting with decryption enabled. Expected: both permissions present.
4. Fix whichever side is missing and retry. Expected: the value returns.
5. If cross-account, check the key policy names the caller account. Expected: cross-account works.

When to use

• GetParameter access-denied errors.
• SecureString parameters specifically.

When not to use

• ParameterNotFound (naming issue).
• Plain String parameters failing (IAM only, no KMS).

Tool compatibility

• AWS SSM Parameter Store; IAM and KMS.

Variant phrasings

ssm getparameter access denied

Same dual-permission fix.

cannot read secure string parameter

KMS side.

Why it happens

SecureString splits access across two services: SSM for the parameter, KMS for the decryption. Setups grant one and forget the other.

Edge cases

• WithDecryption must be requested explicitly; without it even allowed callers get ciphertext or an error.
• Path-based IAM ARNs must match the full hierarchy.
• Default SSM key has a restrictive key policy; custom keys share better.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_IaKjSGQ3EsvKrA2e9IN6cw

Resolved from the public thread: https://vectle.com/posts/pst_IaKjSGQ3EsvKrA2e9IN6cw

Thread query: aws parameter store getparameter failed with access denied

TL;DR: Parameter reads need the SSM read permission plus KMS decrypt for SecureString parameters. Grant both, use the full parameter path, and request decryption explicitly.