Cannot assign KMS grant to role in AWS

Question

I have an encryption key in KMS and two roles: One KeyAdmin role which should be allowed to create a grant to the KeyUser role which should then be able to encrypt/decrypt with the key.

Here is what I am doing:

$ aws kms create-key
{
    "KeyMetadata": {
        "AWSAccountId": "1234567890",
        "KeyId": "99999999-9999-9999-9999-999999999999",
        "Arn": "arn:aws:kms:eu-north-1:1234567890:key/99999999-9999-9999-9999-999999999999",
        "CreationDate": 1583827994.922,
        "Enabled": true,
        "Description": "",
        "KeyUsage": "ENCRYPT_DECRYPT",
        "KeyState": "Enabled",
        "Origin": "AWS_KMS",
        "KeyManager": "CUSTOMER",
        "CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
        "EncryptionAlgorithms": [
            "SYMMETRIC_DEFAULT"
        ]
    }
}

$ cat /tmp/kp.json 
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "KeyAdmin",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::1234567890:role/keyadmin-role"
            },
            "Action": "kms:CreateGrant",
            "Resource": "*"
        },
        {
            "Sid": "KMS account admin access",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::1234567890:root"
            },
            "Action": "kms:*",
            "Resource": "*"
        }
    ]
}

$ aws kms put-key-policy --key-id 99999999-9999-9999-9999-999999999999 --policy-name default --policy file:///tmp/kp.json

$ aws --profile keyadmin-role kms create-grant --key-id 99999999-9999-9999-9999-999999999999 --grantee-principal awn:aws:iam:::1234567890/role/keyuser-role --operations Encrypt Decrypt
{
    "GrantToken": "AQpANGJiNDRhMjVhNGRmNjY0MDBjYTU2YWNlOTkyNWVjNDBkNmFlMDA1Nzc2MmEzMjFkZjk1N2Q2ODc1NzU2ZDYxMiKpAgEBAgB4S7RKJaTfZkAMpWrOmSXsQNauAFd2KjId-VfWh1dW1hIAAAEAMIH9BgkqhkiG9w0BBwagge8wgewCAQAwgeYGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQML6vpVnNolKHIUz9eAgEQgIG4WcppsyTfo4BBKLvV02Wz1K6LlxpNXhhEZVFlCnTzO3Lsat5LBwtlCilPxpcW5N7f8ucjfi_AiH5VYM50_nNqGF1rH5GgzZoDXn76salNvzxF9YoPP3iWiH-NQ7O695kv0svhdONpfrk8nNCBvOeQbQDj9sLCUGbOI3Di51YKKzb9TZd_hwRxWcniAnYphqQkpyYIKttwHmsftZaODzEM64Rj_hU1_bexRwzPW8E75wnjrS_vNNXCHCog5DA2gg4zsbNyECk3qsGQk8yESJzwsKT_lP6Cf8nqrps",
    "GrantId": "e43036820e33b1b372102937aac19093cc84489cf0b0a4ff94fe827fc9eaae9b"
}
$ aws kms list-grants --key-id 99999999-9999-9999-9999-999999999999
{
    "Grants": [
        {
            "KeyId": "arn:aws:kms:eu-north-1:1234567890:key/99999999-9999-9999-9999-999999999999",
            "GrantId": "e43036820e33b1b372102937aac19093cc84489cf0b0a4ff94fe827fc9eaae9b",
            "Name": "",
            "CreationDate": 1583828859.0,
            "GranteePrincipal": "awn:aws:iam:::1234567890/role/keyuser-role",
            "IssuingAccount": "arn:aws:iam::1234567890:root",
            "Operations": [
                "Decrypt",
                "Encrypt"
            ]
        }
    ]
}
$ aws  --profile keyuser-role kms encrypt --key-id 99999999-9999-9999-9999-999999999999 --plaintext "foo"

An error occurred (AccessDeniedException) when calling the Encrypt operation: User: arn:aws:sts::1234567890:assumed-role/keyuser-role/botocore-session-1583827952 is not authorized to perform: kms:Encrypt on resource: arn:aws:kms:eu-north-1:1234567890:key/99999999-9999-9999-9999-999999999999

$ aws  --profile keyuser-role kms encrypt --key-id 99999999-9999-9999-9999-999999999999 --plaintext "foo" --grant-tokens "AQpANGJiNDRhMjVhNGRmNjY0MDBjYTU2YWNlOTkyNWVjNDBkNmFlMDA1Nzc2MmEzMjFkZjk1N2Q2ODc1NzU2ZDYxMiKpAgEBAgB4S7RKJaTfZkAMpWrOmSXsQNauAFd2KjId-VfWh1dW1hIAAAEAMIH9BgkqhkiG9w0BBwagge8wgewCAQAwgeYGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQML6vpVnNolKHIUz9eAgEQgIG4WcppsyTfo4BBKLvV02Wz1K6LlxpNXhhEZVFlCnTzO3Lsat5LBwtlCilPxpcW5N7f8ucjfi_AiH5VYM50_nNqGF1rH5GgzZoDXn76salNvzxF9YoPP3iWiH-NQ7O695kv0svhdONpfrk8nNCBvOeQbQDj9sLCUGbOI3Di51YKKzb9TZd_hwRxWcniAnYphqQkpyYIKttwHmsftZaODzEM64Rj_hU1_bexRwzPW8E75wnjrS_vNNXCHCog5DA2gg4zsbNyECk3qsGQk8yESJzwsKT_lP6Cf8nqrps"

An error occurred (AccessDeniedException) when calling the Encrypt operation: User: arn:aws:sts::1234567890:assumed-role/keyuser-role/botocore-session-1583827952 is not authorized to perform: kms:Encrypt on resource: arn:aws:kms:eu-north-1:1234567890:key/99999999-9999-9999-9999-999999999999

$ aws  --profile keyuser-role sts get-caller-identity
{
    "UserId": "AROA2AD3X6CJC6MODMUZP:botocore-session-1583827952",
    "Account": "1234567890",
    "Arn": "arn:aws:sts::1234567890:assumed-role/keyuser-role/botocore-session-1583827952"
}

Why is the access to key denied for the role holding the grant?

UPDATE

The roles do not have any IAM policies attached.

Answer 1

I made a stupid mistake by passing a errornous grantee-principal flag to the create-grant operation. After replacing

awn:aws:iam:::1234567890/role/keyuser-role

with

arn:aws:iam::1234567890:role/keyuser-role

everything works as expected.

A user in the AWS forum luckily pointed out the error.