Fix Terraform Error - Error Creating KMS Key - MalformedPolicyDocument

Introduction

MalformedPolicyDocument when creating an aws_kms_key means the key policy JSON is syntactically valid but semantically rejected by KMS — usually a principal ARN that doesn't exist yet, a policy that doesn't grant the account root the required permissions (which can lock you out), or jsonencode producing a structure KMS won't accept. This guide shows how to write a valid KMS key policy in Terraform and avoid the common pitfalls.

Error Message

Error: Error Creating KMS Key - MalformedPolicyDocument

This error typically appears during terraform apply or terraform plan when Terraform encounters a conflict or misconfiguration with the target resource.

Common Causes

1. Resource naming conflicts - A resource with the same name already exists
2. Permission issues - Insufficient IAM or RBAC permissions
3. Configuration mismatch - Parameters that conflict with existing settings
4. State drift - Local state doesn't match actual infrastructure
5. Provider version incompatibility - Outdated provider missing bug fixes

Solution 1 - Check Existing Resources

First, verify whether the resource already exists:

# For AWS resources
aws <service> describe-<resource> --name <resource-name>
 
# Check Terraform state
terraform state list | grep <resource-type>

If the resource exists but isn't in your state:

terraform import <resource_address> <resource_id>

Solution 2 - Fix Configuration

Review your Terraform configuration for issues:

# Ensure unique naming
resource "aws_<resource>" "example" {
  name = "${var.project}-${var.environment}-<resource>"
  
  # Add explicit dependencies if needed
  depends_on = [aws_<dependency>.this]
}

Solution 3 - Update Provider

# Check current provider version
terraform providers
 
# Upgrade to latest
terraform init -upgrade

Solution 4 - Refresh State

# Refresh state to match actual infrastructure
terraform refresh
 
# Or use plan with refresh
terraform plan -refresh=true

Solution 5 - Clean State

If the resource was manually deleted:

# Remove from state
terraform state rm <resource_address>
 
# Re-apply
terraform apply

Prevention

• Use unique naming conventions with environment prefixes
• Implement state locking with DynamoDB or equivalent
• Run terraform plan before every apply
• Keep provider versions pinned and updated
• Use lifecycle blocks for critical resources

resource "aws_<resource>" "critical" {
  # ...
  
  lifecycle {
    prevent_destroy = true
    create_before_destroy = true
  }
}

Hands-On Courses

• Terraform for Beginners — Master troubleshooting
• Terraform Beginners on CopyPasteLearn

Conclusion

The Error Creating KMS Key - MalformedPolicyDocument error is usually caused by resource conflicts or permission issues. By checking existing resources, fixing configuration, and keeping your state clean, you can resolve this error quickly and prevent it from recurring.