Merge pull request #77 from aws/asmarp/sync-v3-v4

Sync `dev` and `v4sdk-development`

Author: philasmar

CHANGELOG.md

@@ -1,3 +1,8 @@
+## Release 2024-01-23
+
+### Amazon.Extensions.S3.Encryption (2.2.1)
+* Improve exception message when instruction file is not found.
+
 ## Release 2024-10-24
 
 ### Amazon.Extensions.S3.Encryption (3.0.0-preview.3)

src/Amazon.Extensions.S3.Encryption.csproj

@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
     <PropertyGroup>
         <TargetFrameworks>net472;netstandard2.0;netcoreapp3.1;net8.0</TargetFrameworks>

src/Internal/SetupDecryptionHandler.cs

@@ -176,6 +176,12 @@ protected async System.Threading.Tasks.Task PostInvokeAsync(IExecutionContext ex
         /// <exception cref="AmazonServiceException">Exception thrown if GetObjectResponse decryption fails</exception>
         protected async System.Threading.Tasks.Task DecryptObjectAsync(byte[] decryptedEnvelopeKeyKMS, GetObjectResponse getObjectResponse)
         {
+            /*
+            * Per inputs from Crypto Tools team, the behavior to return plaintext violates the security guarantees of the library.
+            * A threat actor with write access to S3 can replace an encrypted object with a plaintext object, and the GetObject operation succeeds. 
+            * This violates the integrity guarantee, i.e. that the original plaintext has not replaced with a different plaintext. 
+            * Therefore, plaintext objects must be handled outside of the security boundary of the S3EC.
+            */
             if (EncryptionUtils.IsEncryptionInfoInMetadata(getObjectResponse))
             {
                 DecryptObjectUsingMetadata(getObjectResponse, decryptedEnvelopeKeyKMS);
@@ -197,6 +203,11 @@ protected async System.Threading.Tasks.Task DecryptObjectAsync(byte[] decryptedE
                         var instructionFileRequest = EncryptionUtils.GetInstructionFileRequest(getObjectResponse, EncryptionUtils.EncryptionInstructionFileSuffix);
                         instructionFileResponse = await GetInstructionFileAsync(instructionFileRequest).ConfigureAwait(false);
                     }
+                    catch (AmazonS3Exception amazonS3ExceptionInner) when (amazonS3ExceptionInner.ErrorCode == EncryptionUtils.NoSuchKey)
+                    {
+                        throw new AmazonServiceException($"Exception encountered while fetching Instruction File. Ensure the object you are" +
+                            $" attempting to decrypt has been encrypted using the S3 Encryption Client.", amazonS3ExceptionInner);
+                    }
                     catch (AmazonServiceException ace)
                     {
                          throw new AmazonServiceException($"Unable to decrypt data for object {getObjectResponse.Key} in bucket {getObjectResponse.BucketName}", ace);
@@ -307,6 +318,12 @@ protected void PostInvokeSynchronous(IExecutionContext executionContext, byte[]
         /// <exception cref="AmazonServiceException">Exception thrown if GetObjectResponse decryption fails</exception>
         protected void DecryptObject(byte[] decryptedEnvelopeKeyKMS, GetObjectResponse getObjectResponse)
         {
+            /*
+            * Per inputs from Crypto Tools team, the behavior to return plaintext violates the security guarantees of the library.
+            * A threat actor with write access to S3 can replace an encrypted object with a plaintext object, and the GetObject operation succeeds. 
+            * This violates the integrity guarantee, i.e. that the original plaintext has not replaced with a different plaintext. 
+            * Therefore, plaintext objects must be handled outside of the security boundary of the S3EC.
+            */
             if (EncryptionUtils.IsEncryptionInfoInMetadata(getObjectResponse))
             {
                 DecryptObjectUsingMetadata(getObjectResponse, decryptedEnvelopeKeyKMS);
@@ -328,6 +345,11 @@ protected void DecryptObject(byte[] decryptedEnvelopeKeyKMS, GetObjectResponse g
                         var instructionFileRequest = EncryptionUtils.GetInstructionFileRequest(getObjectResponse, EncryptionUtils.EncryptionInstructionFileSuffix);
                         instructionFileResponse = GetInstructionFile(instructionFileRequest);
                     }
+                    catch (AmazonS3Exception amazonS3ExceptionInner) when (amazonS3ExceptionInner.ErrorCode == EncryptionUtils.NoSuchKey)
+                    {
+                        throw new AmazonServiceException($"Exception encountered while fetching Instruction File. Ensure the object you are" +
+                            $" attempting to decrypt has been encrypted using the S3 Encryption Client.", amazonS3ExceptionInner);
+                    }
                     catch (AmazonServiceException ace)
                     {
                         throw new AmazonServiceException($"Unable to decrypt data for object {getObjectResponse.Key} in bucket {getObjectResponse.BucketName}", ace);