Unable to decrypt any data key

code:

kms_key_provider = aws_encryption_sdk.KMSMasterKeyProvider(key_ids=[
    os.environ["ENCRYPTION_KEY_ARN"]
])


def encrypt(plaintext):
    ciphertext, _ = aws_encryption_sdk.encrypt(
        source=plaintext,
        key_provider=kms_key_provider
    )

    return base64.b64encode(ciphertext)


def decrypt(ciphertext_b64):
    ciphertext = base64.b64decode(ciphertext_b64)

    plaintext, _ = aws_encryption_sdk.decrypt(            
        source=ciphertext,
        key_provider=kms_key_provider,
    )
    return plaintext

FYI, this is using v1.3.2.

I get the following error:

Unable to decrypt any data key

When I print out the ciphertext I can clearly see the correct encryption key arn. So I am not sure whats wrong here.

[mattsb42-aws]

What permissions do you have to the KMS CMK? My initial suspicion is that you have GenerateDataKey permissions but not Decrypt.

If you turn on debug logging, you can see the error that the underlying KMS client gives. That can show you exactly what the KMS response is to your request.

WARNING: Do not post debug logs here or anywhere else public, as they contain the entire request and response header and bodies for any AWS calls. For the KMS calls we use, that will include your plaintext data key.

[mattsb42-aws]

Hmmm, I think I would have to see code and policies to debug any further.

The ciphertext refers to a customer master key that does not exist, does not exist in this region, or you are not allowed to access.

^ This means that you don’t have access to the CMK when you are trying to decrypt. Because of this, I still think that it is a policy issue. One thing you could look for is to make sure that there are not policies (either in IAM or the key policy) that deny access to your principal (user/role) performing decrypt operations with this key (or more generally). Deny policies always take precedent over allow policies.