"No Configured Keyring was able to decrypt the Data Key" while performing GetItem

[motica1]

I am using the example Examples/runtimes/java/DynamoDbEncryption/src/main/java/software/amazon/cryptography/examples/enhanced/EnhancedPutGetExample.java as reference and trying to run GetItem and it results into the below error.

Request processing failed; nested exception is software.amazon.awssdk.core.exception.SdkClientException: Unable to unmarshall response (No Configured Keyring was able to decrypt the Data Key. The list of encountered Exceptions is available via `list`.). Response Code: 200, Response Text: OK] with root cause
poc-demo-app  | software.amazon.cryptography.materialproviders.model.CollectionOfErrors: No Configured Keyring was able to decrypt the Data Key. The list of encountered Exceptions is available via `list`.

I have read the reasoning for the error here but not sure what i can do to fix it as I am not explicitly saving the data key while encrypting and saving the item. Also verified the permissions look good to me on the key. Can you share some pointers please?

[texastony]

@motica1
The AWS Database Encryption SDK (DB-ESDK) is an Envelope Encryption Library.
In envelope encryption, the data key is used to encrypt the content,
and then it is encrypted by the "wrapping key" and serialized with the content.

to fix it as I am not explicitly saving the data key

Put another way, the DB-ESDK is saving the encrypted data key for you
when you encrypt and persist the item to DDB.

But your application cannot decrypt the data key.

Are you certain that your application has KMS Decrypt permission on the kmsKeyId?

You could confirm this by running a test in your application's environment
that invokes KMS GenerateDataKey (numberOfBytes should be 256) and then
uses the CipherTextBlob of the Generate Data Key Response
as the CipherTextBlob for a KMS Decrypt invocation.

If the both KMS calls succeed, your environment has the
correct credentials & permissions for calling the KMS key.

If you can prove that your environment has the
correct credentials & permissions for KMS,
but you are still getting this error,
please attach a minimal reproducible example to this issue
and we can go from there.

[motica1]

@texastony Thanks for your response. I am sure that my application has the permissions and here is the result of the validation you suggested to confirm. Please look at experiment() method in my below code whose output i have pasted here.

poc-demo-app  | Running Experiment
poc-demo-app  | ------
poc-demo-app  | response.keyId = arn:aws:kms:us-east-1:<>:key/44b655f0-41cf-4bc2-xxxx-eff7f80b77a8
poc-demo-app  | ------
poc-demo-app  | decryptResponse.keyId = arn:aws:kms:us-east-1:<>:key/44b655f0-41cf-4bc2-xxxx-eff7f80b77a8
poc-demo-app  | decryptResponse = DecryptResponse(KeyId=arn:aws:kms:us-east-1:<>:key/44b655f0-41cf-4bc2-xxxx-eff7f80b77a8, Plaintext=*** Sensitive Data Redacted ***, EncryptionAlgorithm=SYMMETRIC_DEFAULT)
poc-demo-app  | ------

Here's the code that i am running, I have service that calls encryptNew()

public class PocDemoAppUtils {
  static final TableSchema<DetailsTableBean> tableSchema =
      TableSchema.fromBean(DetailsTableBean.class);
  static final String unsignAttrPrefix = ":";
  private static Map<String, DynamoDbEnhancedTableEncryptionConfig> tableConfigs = new HashMap<>();

  private static String cmkArn = "arn:aws:kms:us-east-1:<>:alias/pii-service-sse-key";
  

  private static IKeyring getKeyring() {
    // 1. Create a Keyring. This Keyring will be responsible for protecting the data keys that
    // protect your data.
    //    For this example, we will create a AWS KMS Keyring with the AWS KMS Key we want to use.
    //    We will use the `CreateMrkMultiKeyring` method to create this keyring,
    //    as it will correctly handle both single region and Multi-Region KMS Keys.
    final MaterialProviders matProv =
        MaterialProviders.builder()
            .MaterialProvidersConfig(MaterialProvidersConfig.builder().build())
            .build();
    final CreateAwsKmsMrkMultiKeyringInput keyringInput =
        CreateAwsKmsMrkMultiKeyringInput.builder().generator(cmkArn).build();
    return matProv.CreateAwsKmsMrkMultiKeyring(keyringInput);
  }

  public static String encryptNew(CreateIdentityRequest body) {
    String identityId = UUID.randomUUID().toString();

    tableConfigs.put(
        "pii-data-model-experiments",
        DynamoDbEnhancedTableEncryptionConfig.builder()
            .logicalTableName("pii-data-model-experiments")
            .keyring(getKeyring())
            .allowedUnsignedAttributePrefix(unsignAttrPrefix)
            .schemaOnEncrypt(tableSchema)
            .algorithmSuiteId(
                DBEAlgorithmSuiteId
                    .ALG_AES_256_GCM_HKDF_SHA512_COMMIT_KEY_ECDSA_P384_SYMSIG_HMAC_SHA384)
            .build());
    final DynamoDbEncryptionInterceptor encryptionInterceptor =
        DynamoDbEnhancedClientEncryption.CreateDynamoDbEncryptionInterceptor(
            CreateDynamoDbEncryptionInterceptorInput.builder()
                .tableEncryptionConfigs(tableConfigs)
                .build());

    final DynamoDbClient ddb =
        DynamoDbClient.builder()
            .region(Region.US_WEST_2)
            .overrideConfiguration(
                ClientOverrideConfiguration.builder()
                    .addExecutionInterceptor(encryptionInterceptor)
                    .build())
            .build();

    final DynamoDbEnhancedClient enhancedClient =
        DynamoDbEnhancedClient.builder().dynamoDbClient(ddb).build();
    final DynamoDbTable<DetailsTableBean> table =
        enhancedClient.table("pii-data-model-experiments", tableSchema);

    final DetailsTableBean bean = new DetailsTableBean();
    bean.setIdentityId(identityId);
    bean.setVersion("v1");

    System.out.println("------");
    System.out.println(bean);
    System.out.println("------");

    table.putItem(bean);

    experiment();
    final Key key = Key.builder().partitionValue(identityId).sortValue("v1").build();

    final DetailsTableBean result =
        table.getItem((GetItemEnhancedRequest.Builder requestBuilder) -> requestBuilder.key(key));

    System.out.println(result);
    return identityId;
  }

  private static void experiment() {
    System.out.println("Running Experiment");
    System.out.println("------");

    KmsClient kms = KmsClient.builder().region(Region.US_EAST_1).build();
    GenerateDataKeyResponse response =
        kms.generateDataKey(
            GenerateDataKeyRequest.builder().keyId(cmkArn).keySpec(DataKeySpec.AES_256).build());
    System.out.println("response.keyId = " + response.keyId());
    System.out.println("------");

    DecryptResponse decryptResponse =
        kms.decrypt(DecryptRequest.builder().ciphertextBlob(response.ciphertextBlob()).build());
    System.out.println("decryptResponse.keyId = " + decryptResponse.keyId());
    System.out.println("decryptResponse = " + decryptResponse);

    System.out.println("------");
  }
}

@DynamoDbBean
public final class DetailsTableBean {
  @DynamoDbPartitionKey
  @DynamoDbAttribute(value = "IdentityId")
  public String getIdentityId() {
    return IdentityId;
  }

  public void setIdentityId(String IdentityId) {
    this.IdentityId = IdentityId;
  }

  @DynamoDbSortKey
  @DynamoDbAttribute(value = "Version")
  public String getVersion() {
    return Version;
  }

  public void setVersion(String version) {
    this.Version = version;
  }
}

[texastony]

@motica1
Thanks for the MRE.
I noticed the application uses a KMS Alias.
KMS Aliases can be switched from one KMS Key to another.

For this reason, our Crypto Tools libraries only allow Aliases for Encryption, not decryption.

Hence, the keyring in the above example was able to encrypt the record,
but not decrypt the record.

This subtly is mentioned in our public documentation:

• To encrypt with an AWS KMS keyring, you can use a key ID, key ARN, alias name, or alias ARN to encrypt data.
• To decrypt with an AWS KMS keyring, you must use a key ARN to identify AWS KMS keys. For details, see Selecting wrapping keys.

It may be better for us to document this in our examples or JavaDocs.

I posted a draft PR that modifies your MRE to demonstrate this.
Here is a link to the log lines from the tests.

If you cannot use the KMS Key ID (not an Alias) at Decrypt time,
maybe a Discovery Keyring will fit your application’s purpose.

Let us know if you have any other questions or if we can close this issue.

Much Obliged,
AWS Crypto Tools

[motica1]

thank you for pointing this out! Using the alias as keyid was supported by the previous version of DDB encryption client and i assumed that it would still be supported, my bad. Also the example should clarify that alias arn can't be used as key identifier for decryption in the enhanced ddb client, because it wasn't explicitly clear to me so glad you're planning to add it to the example.