fix: Improve exception message when instruction file is not found.

Author: ashishdhingra

src/Internal/SetupDecryptionHandler.cs

@@ -180,6 +180,12 @@ protected async System.Threading.Tasks.Task PostInvokeAsync(IExecutionContext ex
         /// <exception cref="AmazonServiceException">Exception thrown if GetObjectResponse decryption fails</exception>
         protected async System.Threading.Tasks.Task DecryptObjectAsync(byte[] decryptedEnvelopeKeyKMS, GetObjectResponse getObjectResponse)
         {
+            /*
+            * Per inputs from Crypto Tools team, the behavior to return plaintext violates the security guarantees of the library.
+            * A threat actor with write access to S3 can replace an encrypted object with a plaintext object, and the GetObject operation succeeds. 
+            * This violates the integrity guarantee, i.e. that the original plaintext has not replaced with a different plaintext. 
+            * Therefore, plaintext objects must be handled outside of the security boundary of the S3EC.
+            */
             if (EncryptionUtils.IsEncryptionInfoInMetadata(getObjectResponse))
             {
                 DecryptObjectUsingMetadata(getObjectResponse, decryptedEnvelopeKeyKMS);
@@ -201,6 +207,11 @@ protected async System.Threading.Tasks.Task DecryptObjectAsync(byte[] decryptedE
                         var instructionFileRequest = EncryptionUtils.GetInstructionFileRequest(getObjectResponse, EncryptionUtils.EncryptionInstructionFileSuffix);
                         instructionFileResponse = await GetInstructionFileAsync(instructionFileRequest).ConfigureAwait(false);
                     }
+                    catch (AmazonS3Exception amazonS3ExceptionInner) when (amazonS3ExceptionInner.ErrorCode == EncryptionUtils.NoSuchKey)
+                    {
+                        throw new AmazonServiceException($"Exception encountered while fetching Instruction File. Ensure the object you are" +
+                            $" attempting to decrypt has been encrypted using the S3 Encryption Client.", amazonS3ExceptionInner);
+                    }
                     catch (AmazonServiceException ace)
                     {
                          throw new AmazonServiceException($"Unable to decrypt data for object {getObjectResponse.Key} in bucket {getObjectResponse.BucketName}", ace);
@@ -352,6 +363,12 @@ protected void PostInvokeSynchronous(IExecutionContext executionContext, byte[]
         /// <exception cref="AmazonServiceException">Exception thrown if GetObjectResponse decryption fails</exception>
         protected void DecryptObject(byte[] decryptedEnvelopeKeyKMS, GetObjectResponse getObjectResponse)
         {
+            /*
+            * Per inputs from Crypto Tools team, the behavior to return plaintext violates the security guarantees of the library.
+            * A threat actor with write access to S3 can replace an encrypted object with a plaintext object, and the GetObject operation succeeds. 
+            * This violates the integrity guarantee, i.e. that the original plaintext has not replaced with a different plaintext. 
+            * Therefore, plaintext objects must be handled outside of the security boundary of the S3EC.
+            */
             if (EncryptionUtils.IsEncryptionInfoInMetadata(getObjectResponse))
             {
                 DecryptObjectUsingMetadata(getObjectResponse, decryptedEnvelopeKeyKMS);
@@ -373,6 +390,11 @@ protected void DecryptObject(byte[] decryptedEnvelopeKeyKMS, GetObjectResponse g
                         var instructionFileRequest = EncryptionUtils.GetInstructionFileRequest(getObjectResponse, EncryptionUtils.EncryptionInstructionFileSuffix);
                         instructionFileResponse = GetInstructionFile(instructionFileRequest);
                     }
+                    catch (AmazonS3Exception amazonS3ExceptionInner) when (amazonS3ExceptionInner.ErrorCode == EncryptionUtils.NoSuchKey)
+                    {
+                        throw new AmazonServiceException($"Exception encountered while fetching Instruction File. Ensure the object you are" +
+                            $" attempting to decrypt has been encrypted using the S3 Encryption Client.", amazonS3ExceptionInner);
+                    }
                     catch (AmazonServiceException ace)
                     {
                         throw new AmazonServiceException($"Unable to decrypt data for object {getObjectResponse.Key} in bucket {getObjectResponse.BucketName}", ace);