IMO, this should be treated as a bug and not an enhancement request.  I still see this error in AWS add-on ver 6.2.0. ... View more

The IAM user/group or role you're using for collection needs permissions to decrypt using the key, specifically the "kms:Decrypt" action. This can be scoped to just the KMS key used on the bucket you're collecting from. An example policy document: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "kms:Decrypt", "Resource": "ARN-OF-KMS-KEY" } ] } ... View more