Decrypt KMS encrypted S3 objects from SES in Java - kotlin

Question

I am using an SES receipt rule to store KMS encrypted emails in S3 and looking at decrypting in a SpringBoot/Kotlin application. The only way I could achieve this using the AWS Java SDK v2 was decrypting myself using the BouncyCastle crypto lib. If I downgrade to AWS Java SDK v1 I can easily decrypt using AmazonS3EncryptionClient without worrying about the crypto operations but its deprecated.
What is the preferred way to read these KMS encrypted S3 objects from SES using the latest AWS Java SDK?
Below are my various attempts:
AWS SDKv1 - works perfectly but deprecated
val provider = KMSEncryptionMaterialsProvider(kmsArn)
val s3EncryptionClient = AmazonS3EncryptionClient.encryptionBuilder()
.withEncryptionMaterials(provider)
.withCryptoConfiguration(CryptoConfiguration()
.withCryptoMode(CryptoMode.AuthenticatedEncryption)
.withAwsKmsRegion(Region.getRegion(Regions.US_WEST_2)))
.build()
println(s3EncryptionClient.getObjectAsString(bucket, key))
AWS SDKv1 (V2) - fails on the EncryptionContext validation?
val provider = KMSEncryptionMaterialsProvider(kmsArn)
val s3EncryptionClient = AmazonS3EncryptionClientV2Builder.standard()
.withRegion(Regions.US_WEST_2)
.withCryptoConfiguration(CryptoConfigurationV2()
.withCryptoMode(CryptoMode.AuthenticatedEncryption)
.withAwsKmsRegion(com.amazonaws.regions.Region.getRegion(Regions.US_WEST_2)))
.withEncryptionMaterialsProvider(kmsProvider)
.build()
val result = s3EncryptionClient.getObject(bucket, key)
println(String(result.objectContent.readAllBytes()))
AWS SDKv2 + BouncyCastle - works perfectly but I have to do all the decryption myself
fun getAsDecryptedString(bucket: String, key: String): String {
Security.addProvider(BouncyCastleProvider())
val headObjectResponse = s3AsyncClient.headObject(
HeadObjectRequest.builder().bucket(bucket).key(key).build()
).get()
val metadata = headObjectResponse.metadata()
val kmsKeyBase64 = metadata["x-amz-key-v2"]
val iv = metadata["x-amz-iv"]
val algo = checkNotNull(metadata["x-amz-cek-alg"]) { "x-amz-cek-alg metadata is required" }
val encryptionContext = objectMapper.readValue(metadata["x-amz-matdesc"], typeRef)
val kmsKey = SdkBytes.fromByteArray(Base64.getDecoder().decode(kmsKeyBase64))
val kmsDecryptResult = kmsClient.decrypt(
DecryptRequest.builder()
.ciphertextBlob(kmsKey)
.encryptionContext(encryptionContext)
.build()
)
val request = GetObjectRequest.builder().bucket(bucket).key(key).build()
val getObjectResponse = s3AsyncClient.getObject(request, AsyncResponseTransformer.toBytes()).get()
val keyBytes = kmsDecryptResult.plaintext().asByteArray()
val bytesToDecrypt = getObjectResponse.asByteArray()
val ivBytes = Base64.getDecoder().decode(iv)
return decryptWithAES(keyBytes, bytesToDecrypt, ivBytes, algo)
}
private fun decryptWithAES(keyBytes: ByteArray, bytesToDecrypt: ByteArray, ivBytes: ByteArray, algo: String): String {
val secretKey = SecretKeySpec(keyBytes, "AES")
val iv = IvParameterSpec(ivBytes)
synchronized(Cipher::class.java) {
val cipher = Cipher.getInstance(algo, "BC")
cipher.init(Cipher.DECRYPT_MODE, secretKey, iv)
val plainText = ByteArray(cipher.getOutputSize(bytesToDecrypt.size))
var ptLength = cipher.update(bytesToDecrypt, 0, bytesToDecrypt.size, plainText, 0)
ptLength += cipher.doFinal(plainText, ptLength)
val decryptedString = String(plainText)
return decryptedString.trim { it <= ' ' }
}
}