Java AWS S3 encryption client - Can't decrypt file with V2 client, but V1 client works

Viewed 45

I need to retrieve encrypted files stored in S3 using Java. The files are encrypted by AWS SES using KMS. There is documentation specifically referencing the class AmazonS3EncryptionV2 which can interact with KMS to decrypt files it fetches from S3. I'll link the documentation at the bottom.

I have the KMS key used by SES to encrypt, so I set up the client pretty much exactly according to the examples in the documentation.

AmazonS3EncryptionClientV2Builder.standard()
        .withCryptoConfiguration(new CryptoConfigurationV2(CryptoMode.AuthenticatedEncryption))
        .withEncryptionMaterialsProvider(new KMSEncryptionMaterialsProvider("key id goes here"))
        .withRegion("us-east-1")
        .withKmsClient(AWSKMSClientBuilder.defaultClient())
        .build();

I get an error upon attempting to retrieve one of the files from s3 using this client.

Provided encryption materials do not match information retrieved from the encrypted object

Based on the message, I would assume that the "encryption materials provider" would be at fault here. The thing is, if I switch this code to use AmazonS3EncryptionClient (the deprecated version), this setup works pretty much exactly as is:

AmazonS3EncryptionClientBuilder.standard()
        .withCryptoConfiguration(new CryptoConfiguration(CryptoMode.AuthenticatedEncryption))
        .withEncryptionMaterials(new KMSEncryptionMaterialsProvider("key id goes here"))
        .withRegion("us-east-1")
        .withKmsClient(AWSKMSClientBuilder.defaultClient())
        .build();

The fact that this works with pretty much identical configuration in the outdated client makes me think there is some internal setting in the old client which doesn't match in the new client.

I am not generally familiar with KMS, so I don't have much context for what the possible issues may be here. Or, this error message might be obfuscating some other internal problem (like auth issues with KMS, maybe?). Any guidance that could help me figure out the problem with newer version of the client and get me out of using the deprecated version would be appreciated.

https://docs.aws.amazon.com/kms/latest/developerguide/services-ses.html

https://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/examples-crypto-masterkey.html

0 Answers
Related