How to fix Error: Error creating KMS Key: LimitExceededException in Terraform

TerraformINTERMEDIATEHIGHUpdated Dec 30, 2025· 94 views

The LimitExceededException error occurs when you exceed AWS KMS quotas during Terraform apply. This typically happens when creating too many KMS keys or hitting request rate limits in a region. AWS KMS has default limits like 100,000 customer-managed keys per region and rate limits for cryptographic operations.

Quick fix

Fixes Error: Error creating KMS Key: LimitExceededException

aws kms list-keys --region us-east-1
aws kms list-keys --region us-east-1 | jq '.Keys | length'
  1. Check your current KMS key usage in the region
  2. Review AWS Service Quotas for your region
  3. Identify unused or duplicate KMS keys
  4. Reduce parallelism in Terraform if hitting rate limits
terraform — error
aws kms list-keys --region us-east-1
aws kms list-keys --region us-east-1 | jq '.Keys | length'
Error: Error creating KMS Key: LimitExceededException

What this error means

The LimitExceededException is thrown by AWS KMS when an operation exceeds one of the service's imposed quotas or rate limits. AWS KMS enforces two types of limits: resource limits (like the maximum number of keys per region) and request quotas (like the number of cryptographic operations per second). When Terraform attempts to create a KMS key and this operation violates either type of limit, AWS rejects the request with this exception.

Typical symptoms

  • Terraform apply fails immediately when attempting to create a KMS key resource
  • Error message contains 'LimitExceededException'
  • Error appears in aws_kms_key resource creation
  • Previous similar operations succeeded but the current one fails
  • Multiple parallel Terraform applies hit the same error

Common causes

  1. Reached the per-region customer-managed KMS key limit (default 100,000 keys)
  2. Exceeded request rate quotas for cryptographic operations in the region
  3. Multiple parallel Terraform operations hitting throttling limits simultaneously
  4. Account has soft limit of KMS keys and needs quota increase
  5. Using too many concurrent operations against KMS in a short timeframe

How to fix "Error: Error creating KMS Key: LimitExceededException"

1Check your current KMS key usage in the region

Use the AWS CLI to list all KMS keys in your region to understand your current usage:

bash
aws kms list-keys --region us-east-1
aws kms list-keys --region us-east-1 | jq '.Keys | length'

This shows you the total number of customer-managed KMS keys already created. Compare this to the default limit of 100,000 keys per region.

2Review AWS Service Quotas for your region

Check the AWS Service Quotas console for KMS limits in your account:

bash
aws service-quotas list-service-quotas --service-code kms --region us-east-1

Look for quotas like:
- Customer managed KMS keys
- Cryptographic operation request rates
- The applicable quota for your region

This helps determine if you're hitting a resource limit or a rate limit.

3Identify unused or duplicate KMS keys

Check if you have KMS keys that are no longer needed:

bash
aws kms describe-key --key-id <key-id> --region us-east-1
aws kms list-aliases --region us-east-1 | grep <key-id>

If you find unused keys, schedule them for deletion using a 7-day wait period:

bash
aws kms schedule-key-deletion --key-id <key-id> --pending-window-in-days 7 --region us-east-1
4Reduce parallelism in Terraform if hitting rate limits

If the issue is request rate limits (not key count), reduce parallel operations:

bash
terraform apply -parallelism=2

Alternatively, add retry logic in your Terraform provider configuration:

hcl
provider "aws" {
  region = "us-east-1"
  
  assume_role {
    role_arn = "arn:aws:iam::ACCOUNT:role/ROLE"
  }
}

Terraform and the AWS provider will automatically retry ThrottlingException errors with exponential backoff.

5Request a quota increase if needed

If you legitimately need more KMS keys or higher request rates, request a quota increase through the AWS Service Quotas console:

1. Go to AWS Service Quotas in the AWS Console
2. Search for 'KMS'
3. Select the quota you want to increase (e.g., 'Customer managed KMS keys')
4. Click 'Request quota increase'
5. Enter your desired value
6. Submit the request

Alternatively, use the CLI:

bash
aws service-quotas request-service-quota-increase --service-code kms --quota-code kms-customer-managed-keys --desired-value 150000 --region us-east-1
6Implement exponential backoff in your Terraform code

Add retry logic to your KMS resource if you're hitting transient rate limits:

hcl
resource "aws_kms_key" "example" {
  description             = "KMS key for encryption"
  deletion_window_in_days = 10
  enable_key_rotation     = true

  tags = {
    Name = "my-key"
  }
}

The AWS provider (v3.0+) automatically retries throttling errors. If you're on an older version, upgrade it:

bash
terraform init -upgrade

Advanced notes

AWS KMS quotas are region-specific and account-specific. The default limits differ by region: US East (N. Virginia), US West (Oregon), and Europe (Ireland) support higher request rates (100,000 requests per second for symmetric operations) compared to other regions. Cryptographic operation quotas (Encrypt, Decrypt, GenerateDataKey) are calculated separately from administrative operations (DescribeKey, ListKeys). If you're using KMS keys across multiple services (RDS, DynamoDB, Secrets Manager), requests from those services count toward your overall quotas. Key deletion has a mandatory 7-day waiting period, but you cannot reduce this window. For time-sensitive workloads, plan key creation ahead of time or spread key creation across multiple time windows.

Frequently asked questions

What does "Error: Error creating KMS Key: LimitExceededException" mean?
The LimitExceededException is thrown by AWS KMS when an operation exceeds one of the service's imposed quotas or rate limits. AWS KMS enforces two types of limits: resource limits (like the maximum number of keys per region) and request quotas (like the number of cryptographic operations per second). When Terraform attempts to create a KMS key and this operation violates either type of limit, AWS rejects the request with this exception.
How do I fix "Error: Error creating KMS Key: LimitExceededException"?
The LimitExceededException error occurs when you exceed AWS KMS quotas during Terraform apply. This typically happens when creating too many KMS keys or hitting request rate limits in a region. AWS KMS has default limits like 100,000 customer-managed keys per region and rate limits for cryptographic operations.
What causes "Error: Error creating KMS Key: LimitExceededException"?
Reached the per-region customer-managed KMS key limit (default 100,000 keys) Exceeded request rate quotas for cryptographic operations in the region Multiple parallel Terraform operations hitting throttling limits simultaneously
Is the "Error: Error creating KMS Key: LimitExceededException" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading