Better error messaging when no keyring is found.

[seebees]

Currently if no configured keyring is found to unwrap any of the encrypted data keys,
the CMM will throw an unencryptedDataKey has not been set error.
While this error is accurate, it is unhelpful.

[davidyell]

I was Googling for this error and ended up here. The message still doesn't tell me how to fix the error or provide a link for me to learn more.

[seebees]

Thanks, that’s a good call out.
The most common case in which we saw this error was where the principle that is trying to decrypt does not have access to decrypt on any of the configured CMKs. The fix ( #212 ) is to bubble up errors directly from KMS to provide the caller with more context.

If you are getting this “Unable to decrypt data key and one or more KMS CMKs had an error.” message in the latest version when trying to decrypt, let's reopen this and figure out what is going on.

If you are not using KMS or are trying to build your own keyring can we open a new issue? Please include a description of what you’re calling and the error you’re seeing.

[davidyell]

Unfortunately I don't have the code to hand, but as I recall I was using the Node.js AWS SDK. Following along with the decrypt example given here.

Although I am a beginner, so might have just been a code error on my part.

[seebees]

@davidyell I opened #305 as a tracker for this generally.
If you have the code handy and can reproduce the specific case you are talking about please put it there.

[RalphBragg]

Likewise an example end to end with associated necessary KMS policies would be really handy. I've tried following the example and i'm stuck at the same location as @davidyell.

[bardock]

I was using the same example that followed @davidyell.
To avoid this error you must use the key ARN, not the alias, as was noted here:
https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/js-examples.html

To specify a CMK for a decryption keyring in the AWS Encryption SDK for JavaScript, you must use the key ARN. Otherwise, the CMK is not recognized

[RalphBragg]

Hi @bardock - yeah i'm using the ARN's not the alias and this error is still being thrown.
-- Update: Key Properties was the cause of my issue. +1 for better error messaging would be grand!

[seebees]

@RalphBragg What specific key properties was the issue?

@bardock so you were getting this error when using something like alias/myAlias?

I also see that the raw keyrings can leak this error as well
https://github.com/aws/aws-encryption-sdk-javascript/blob/master/modules/raw-keyring/src/raw_keyring_decorators.ts#L61

[bardock]

@RalphBragg What specific key properties was the issue?

@bardock so you were getting this error when using something like alias/myAlias?

I also see that the raw keyrings can leak this error as well
https://github.com/aws/aws-encryption-sdk-javascript/blob/master/modules/raw-keyring/src/raw_keyring_decorators.ts#L61

Yes. This example uses an alias for the generator key, but it works just because it also adds the same CMK as an alternate key.

[seebees]

I think I understand the issue more now.
The check here https://github.com/aws/aws-encryption-sdk-javascript/blob/master/modules/material-management-node/src/node_cryptographic_materials_manager.ts#L108

Getting an unencrypted data key, when one is not set is an error,
so this check throws an error before 'Unencrypted data key is invalid.'
could even be throw.

This also is sub-optimal.
I'm going to start a PR with

No keyring generated an unencrypted data key.
You may not have access to any wrapping keys.

[MrsBookik]

I have seen this error when only one GeneratorKeyId has been used and not additional keys, that I needed for unknown reasons in order to make decrypt work:

Given official example code there are two different key concepts given that I am confused about:

const keyring = new KmsKeyringNode({ generatorKeyId, keyIds });

const { encrypt, decrypt } = buildClient(CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT);
const { result } = await encrypt(keyring, cleartext, { encryptionContext: context });
const { plaintext, messageHeader } = await decrypt(keyring, result);

In order to make encrypt and even decrypt work using KMS, I had to provide a generatorKeyId and second key that I have put into keyIds.
Without the second Key, no decryption will happen and it will raise exception stating

unencryptedDataKey has not been set

Can someone tell me what is the purpose of each on both keys and why do we need both together?

(I was already asking at #951, maybe we can shed some light into this quite undocumented concept)