KMSMasterKeyProvider with 2 keys from same region

[achdc-1192]

Hi,
I'm trying encryptionsdk with 2 KMS keys from same region. For encrypt I'm using key1 from same region and for decrypt I'm using key2 from same region. The decrypt always works and uses key1. Shouldn't the decrypt operation fail in this case? I'm confused as to why this works like this. See the code below:

import aws_encryption_sdk

key-arn-A = "arn:aws:kms:us-west-2:<account-id>:key/key-id-1"
key-arn-B = "arn:aws:kms:us-west-2:<account-id>:key/key-id-2"

master_key_provider = aws_encryption_sdk.KMSMasterKeyProvider()
master_key_provider.add_master_key(key-arn-A)


# Encrypt the plaintext source data.
ciphertext, encryptor_header = aws_encryption_sdk.encrypt(
    source=source_plaintext,
    key_provider=master_key_provider
)
print("encryption header is",encryptor_header)
#print('Ciphertext: ', ciphertext)


keyprovider2 = aws_encryption_sdk.KMSMasterKeyProvider()
keyprovider2.add_master_key(key-arn-B)
# Decrypt the ciphertext.
cycled_plaintext, decrypted_header = aws_encryption_sdk.decrypt(
    source=ciphertext,
    key_provider=keyprovider2
)
print("-------------------------------------------------------")

print("encryption header is",decrypted_header)

[mattsb42-aws]

Hi @anurag1192,

What you've run into is a behavior of the AWS KMS master key provider that might not be immediately obvious. While it will only use the specified AWS KMS CMK on encrypt, on decrypt it will attempt to decrypt any data key that was encrypted under an AWS KMS CMK.

Since both master key provider instances in your example are using the same credentials, and thus the same permissions, keyprovider2 can decrypt using both CMKs, and when it encounters the encrypted data key that was encrypted under CMK A, it attempts to decrypt it, even though you did not configure the master key provider to use that CMK on encrypt.

If you want to only ever interact with a single CMK, you can use the AWS KMS master key, which only uses one CMK on both encrypt and decrypt.

We'll soon be launching Python support for keyrings, our new configuration primitive that is simpler to configure and extend. With the AWS KMS keyring, we actually split this auto-discovery behavior out into a separate kind of keyring; you can configure an AWS KMS keyring to either use specific CMKs or to try any CMK, but not both, and you have to explicitly choose which one you want. You can see the relationship laid out in this example (#255) that shows how to replicate the behavior of the AWS KMS master key provider using keyrings.

[achdc-1192]

Hi @mattsb42-aws ,

That answers the question. I've few more doubts, you mentioned:

If you want to only ever interact with a single CMK, you can use the AWS KMS master key, which only uses one CMK on both encrypt and decrypt.

• Does this mean use the following : master_key_provide = KMSMasterKey(key_id="key-2") or use kms.encrypt and kms.decrypt ?

Based on the description, keyprovider2 attempts to decrypt it, even though you did not configure the master key provider to use that CMK on encrypt.

I'm guessing this is the same for cross account kms keys and cross region kms keys given the same user credentials have correct permissions.
Like if master_key_provider uses kms key from Account A and keyprovider2 uses kms key from account B (this key is not configured in master_key_provider) then keyprovider will decrypt it since the user credentials have permissions?
Am I correct ?

[mattsb42-aws]

Does this mean use the following : master_key_provide = KMSMasterKey(key_id="key-2") or use kms.encrypt and kms.decrypt ?

Good point; names are hard! :) I meant using the KMSMasterKey class.

I'm guessing this is the same for cross account kms keys and cross region kms keys given the same user credentials have correct permissions.
Like if master_key_provider uses kms key from Account A and keyprovider2 uses kms key from account B (this key is not configured in master_key_provider) then keyprovider will decrypt it since the user credentials have permissions?
Am I correct ?

Correct. KMSMasterKeyProvider attempts to decrypt any KMS-encrypted data key that it finds, so even if the decrypting principal does not have permissions to decrypt, it will still try and fail.

This is one area where keyrings will give you much more (and simpler) control over client behavior. If you want to control decrypt behavior based on region, you will be able to use client suppliers to control that behavior[1]. If you want to control decrypt behavior based on account, you will be able to make a keyring similar to the one I sketched out here[2].

[1] https://github.com/aws/aws-encryption-sdk-python/blob/master/examples/src/keyring/aws_kms/discovery_decrypt_with_preferred_regions.py
[2] #226 (comment)

[achdc-1192]

Thanks @mattsb42-aws for the answer. I'll take a look at keyrings. I'll close this issue.