Better error messaging when no keyring is found.

[seebees]

Currently if no configured keyring is found to unwrap any of the encrypted data keys,
the CMM will throw an unencryptedDataKey has not been set error.
While this error is accurate, it is unhelpful.

[davidyell]

I was Googling for this error and ended up here. The message still doesn't tell me how to fix the error or provide a link for me to learn more.

[seebees]

Thanks, that’s a good call out.
The most common case in which we saw this error was where the principle that is trying to decrypt does not have access to decrypt on any of the configured CMKs. The fix ( #212 ) is to bubble up errors directly from KMS to provide the caller with more context.

If you are getting this “Unable to decrypt data key and one or more KMS CMKs had an error.” message in the latest version when trying to decrypt, let's reopen this and figure out what is going on.

If you are not using KMS or are trying to build your own keyring can we open a new issue? Please include a description of what you’re calling and the error you’re seeing.

[davidyell]

Unfortunately I don't have the code to hand, but as I recall I was using the Node.js AWS SDK. Following along with the decrypt example given here.

Although I am a beginner, so might have just been a code error on my part.

[seebees]

@davidyell I opened #305 as a tracker for this generally.
If you have the code handy and can reproduce the specific case you are talking about please put it there.

[RalphBragg]

Likewise an example end to end with associated necessary KMS policies would be really handy. I've tried following the example and i'm stuck at the same location as @davidyell.

[bardock]

I was using the same example that followed @davidyell.
To avoid this error you must use the key ARN, not the alias, as was noted here:
https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/js-examples.html

To specify a CMK for a decryption keyring in the AWS Encryption SDK for JavaScript, you must use the key ARN. Otherwise, the CMK is not recognized

[RalphBragg]

Hi @bardock - yeah i'm using the ARN's not the alias and this error is still being thrown.
-- Update: Key Properties was the cause of my issue. +1 for better error messaging would be grand!

[seebees]

@RalphBragg What specific key properties was the issue?

@bardock so you were getting this error when using something like alias/myAlias?

I also see that the raw keyrings can leak this error as well
https://github.com/aws/aws-encryption-sdk-javascript/blob/master/modules/raw-keyring/src/raw_keyring_decorators.ts#L61

[bardock]

@RalphBragg What specific key properties was the issue?

@bardock so you were getting this error when using something like alias/myAlias?

I also see that the raw keyrings can leak this error as well
https://github.com/aws/aws-encryption-sdk-javascript/blob/master/modules/raw-keyring/src/raw_keyring_decorators.ts#L61

Yes. This example uses an alias for the generator key, but it works just because it also adds the same CMK as an alternate key.