CognitoIdentityCredentials, KMS encrypt and Signature expired

Hello,

ISSUE We are using the AWS SDK in the browser, so we do not have control over the parent system clock. If the parent system clock is off when trying to KSM encrypt data, we receive the following error message:

Error: Signature expired: 20181105T215603Z is now earlier than 20181105T221104Z (20181105T221604Z - 5 min.)

Please note that if the browser’s parent system’s time is correct, then there is no issue.

ATTEMPTS TO FIX

1. I tried setting window.AWS.config.correctClockSkew = true; but this does not seem to fix kms.encrypt().promise() and still fails.
2. I tried setting new KMS({ correctClockSkew: true }) in addition to item 1 above, and it still fails.
3. I even tried manually setting window.AWS.config.systemClockOffset via window.AWS.events.on('retry', (response) => {}) but still get the error. Please note that response.httpResponse.headers[‘date’] does not seem to be set with kms.encrypt error, so I had to extract the datetime value from the actual error message (not fun)…

REPLICATE I setup my system clock 20 minutes in the past and am able to consistently replicate.

CODE

import { CognitoIdentityCredentials } from 'aws-sdk/global';
import KMS from 'aws-sdk/clients/kms';

export function processPurchase({ billing }) {
  return async (dispatch, getState) => {
    // some code here

    try {
      window.AWS.config.correctClockSkew = true;
      window.AWS.config.region = config.awsDefaultRegion;
      window.AWS.config.credentials = new CognitoIdentityCredentials({
        IdentityPoolId: config.awsCognitoIdentityPoolId,
      });

      const kms = new KMS({ correctClockSkew: true });

      encryptedBilling = await kms
        .encrypt({
          KeyId: config.awsKmsKeyId,
          Plaintext: JSON.stringify(verifiedBilling),
        })
        .promise();
    } catch (error) {
      // catch locally
      console.error(error);
    }

    // more code

  }
}

Please advise on next steps or if you need any additional information. Thanks!

[srchase]

Yes, I’ll update this issue when I have more information about the KMS Team getting this change made.

[srchase]

@devourment77

Thanks for submitting this issue.

I am able to reproduce the issue in the browser, as well as in Node. We will update you once we’ve got the right way to get this resolved sorted out.