How to fix Error: Error creating KMS Key: LimitExceededException in Terraform

Use the AWS CLI to list all KMS keys in your region to understand your current usage:

aws kms list-keys --region us-east-1
aws kms list-keys --region us-east-1 | jq '.Keys | length'

This shows you the total number of customer-managed KMS keys already created. Compare this to the default limit of 100,000 keys per region.

Check the AWS Service Quotas console for KMS limits in your account:

aws service-quotas list-service-quotas --service-code kms --region us-east-1

Look for quotas like:
- Customer managed KMS keys
- Cryptographic operation request rates
- The applicable quota for your region

This helps determine if you're hitting a resource limit or a rate limit.

Check if you have KMS keys that are no longer needed:

aws kms describe-key --key-id <key-id> --region us-east-1
aws kms list-aliases --region us-east-1 | grep <key-id>

If you find unused keys, schedule them for deletion using a 7-day wait period:

aws kms schedule-key-deletion --key-id <key-id> --pending-window-in-days 7 --region us-east-1

If the issue is request rate limits (not key count), reduce parallel operations:

terraform apply -parallelism=2

Alternatively, add retry logic in your Terraform provider configuration:

provider "aws" {
  region = "us-east-1"
  
  assume_role {
    role_arn = "arn:aws:iam::ACCOUNT:role/ROLE"
  }
}

Terraform and the AWS provider will automatically retry ThrottlingException errors with exponential backoff.

If you legitimately need more KMS keys or higher request rates, request a quota increase through the AWS Service Quotas console:

1. Go to AWS Service Quotas in the AWS Console
2. Search for 'KMS'
3. Select the quota you want to increase (e.g., 'Customer managed KMS keys')
4. Click 'Request quota increase'
5. Enter your desired value
6. Submit the request

Alternatively, use the CLI:

aws service-quotas request-service-quota-increase --service-code kms --quota-code kms-customer-managed-keys --desired-value 150000 --region us-east-1

Add retry logic to your KMS resource if you're hitting transient rate limits:

resource "aws_kms_key" "example" {
  description             = "KMS key for encryption"
  deletion_window_in_days = 10
  enable_key_rotation     = true

  tags = {
    Name = "my-key"
  }
}

The AWS provider (v3.0+) automatically retries throttling errors. If you're on an older version, upgrade it:

terraform init -upgrade