AWS KMS加密正常，解密时提示配置的密钥环无法解密数据密钥

问题描述 #

使用AWS KMS加密数据过程无异常，但解密时触发以下错误：

No Configured Keyring was able to decrypt the Data Key. The list of encountered Exceptions is available via list

相关Java代码 #

String keyArn = "你的AWS KMS密钥ARN";
String plaintext = "要加密的文本";

final AwsCrypto crypto = AwsCrypto.builder()
        .withCommitmentPolicy(CommitmentPolicy.RequireEncryptRequireDecrypt)
        .build();    
final MaterialProviders materialProviders = MaterialProviders.builder()
        .MaterialProvidersConfig(MaterialProvidersConfig.builder().build())
        .build();
final CreateAwsKmsMultiKeyringInput keyringInput = 
        CreateAwsKmsMultiKeyringInput.builder().generator(keyArn).build();
final IKeyring kmsKeyring = materialProviders.CreateAwsKmsMultiKeyring(keyringInput);

// 加密数据
final CryptoResult<byte[], ?> encryptResult = crypto.encryptData(kmsKeyring, plaintext.getBytes(StandardCharsets.UTF_8));
final byte[] ciphertext = encryptResult.getResult();
String base64Ciphertext = Base64.getEncoder().encodeToString(ciphertext);
System.out.println(base64Ciphertext);

// 解密数据
final CryptoResult<byte[], ?> decryptResult = 
        crypto.decryptData(
                kmsKeyring, 
                ciphertext
                );

assert Arrays.equals(decryptResult.getResult(), plaintext.getBytes(StandardCharsets.UTF_8));
System.out.println("解密后: " + new String(decryptResult.getResult(), StandardCharsets.UTF_8));

完整错误栈 #

Exception in thread "main" software.amazon.cryptography.materialproviders.model.CollectionOfErrors: No Configured Keyring was able to decrypt the Data Key. The list of encountered Exceptions is available via `list`.
    at software.amazon.cryptography.materialproviders.model.CollectionOfErrors$BuilderImpl.build(CollectionOfErrors.java:136)
    at software.amazon.cryptography.materialproviders.ToNative.Error(ToNative.java:129)
    at software.amazon.cryptography.materialproviders.ToNative.Error(ToNative.java:232)
    at software.amazon.cryptography.materialproviders.CryptographicMaterialsManager.DecryptMaterials(CryptographicMaterialsManager.java:48)
    at com.amazonaws.encryptionsdk.CMMHandler.decryptMaterials(CMMHandler.java:100)
    at com.amazonaws.encryptionsdk.internal.DecryptionHandler.readHeaderFields(DecryptionHandler.java:796)
    at com.amazonaws.encryptionsdk.internal.DecryptionHandler.<init>(DecryptionHandler.java:143)
    at com.amazonaws.encryptionsdk.internal.DecryptionHandler.create(DecryptionHandler.java:465)
    at com.amazonaws.encryptionsdk.AwsCrypto.decryptData(AwsCrypto.java:822)
    at com.amazonaws.encryptionsdk.AwsCrypto.decryptData(AwsCrypto.java:768)
    at com.amazonaws.encryptionsdk.AwsCrypto.decryptData(AwsCrypto.java:759)
    at com.amazonaws.encryptionsdk.AwsCrypto.decryptData(AwsCrypto.java:734)
    at com.amazonaws.encryptionsdk.keyrings.StringExample.main(StringExample.java:67)

排查与解决方法 #

• 检查IAM权限：确认执行解密操作的IAM实体（用户/角色）拥有目标KMS密钥的kms:Decrypt权限，密钥策略中需包含对应权限声明。
• 调整密钥环配置：单密钥场景下，建议改用AwsKmsKeyring替代AwsKmsMultiKeyring，简化配置避免多密钥环的匹配问题，示例代码：

  final CreateAwsKmsKeyringInput keyringInput = 
          CreateAwsKmsKeyringInput.builder().keyArn(keyArn).build();
  final IKeyring kmsKeyring = materialProviders.CreateAwsKmsKeyring(keyringInput);
  

• 验证密钥一致性：确保解密使用的KMS密钥ARN与加密时完全一致，包括区域、密钥ID等信息，避免误用其他密钥。
• 查看详细异常：调用decryptResult.list()获取每个密钥环失败的具体异常信息，精准定位问题（如密钥不存在、权限拒绝等）。
• 检查SDK版本：确认AWS Encryption SDK与Material Providers组件版本兼容，建议使用官方推荐的配套版本。

内容的提问来源于stack exchange，提问作者S2T