title: ECS cluster cannot use KMS key to decrypt "you are not allowed to access"
body: <p>I continue to get the error: </p>
  
  <p><code>software.amazon.awssdk.services.kms.model.KmsException: The ciphertext refers to a customer master key that does not exist, does not exist in this region, or you are not allowed to access.</code></p>
  
  <p>When attempting to decrypt. </p>
  
  <p>I've created a Task execution role with the permission: </p>
  
  <pre><code>"AssumeRolePolicyDocument": {
        "Version": "2008-10-17",
        "Statement": [
          {
            "Effect": "Allow",
            "Principal": {
              "Service": "ecs-tasks.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
          }
        ]
      },
      "ManagedPolicyArns": [
        "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
      ],
      "Policies": [
        {
          "PolicyName": "AllowKmsDecrypt",
          "PolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
              {
                "Effect": "Allow",
                "Action": [
                  "kms:Decrypt"
                ],
                "Resource": [
                  {"Ref": "PrincipalSourceKeyArn"}
                ]
              }
            ]
          }
        }
      ]
  </code></pre>
  
  <p>And the task definition is associated with the role: </p>
  
  <pre><code>        "ExecutionRoleArn": {"Ref": "TaskExecutionRoleArn"},
  </code></pre>
  
  <p>Hm. What else could i be missing? </p>