bug: unable to decode CustomEmailSender_SignUp encrypted code, got InvalidCiphertextException about localstack HOT 6 CLOSED

I didn't generate the ciphertext, localstack did when it sends out the CustomEmailSender_SignUp trigger. You will have to setup a cognito user pool and then sign up a user using email address to trigger the event. I have tried kms decrypt command, see my ticket description, and it did not work. The only way for me to decrypt is locally with aws_encryption_sdk. So I feel it is localstack's bug somewhere....

from localstack.

>>> import base64
>>> import aws_encryption_sdk
>>> from aws_encryption_sdk.identifiers import CommitmentPolicy
>>> code = "AgV49DDIa0gmpF8ptVztr4W3tBIj40JM74jHpqBgszd+M04AXwABABVhd3MtY3J5cHRvLXB1YmxpYy1rZXkAREFnZ1p0REJ1SmpmUENRVjZieXpncjFLcm85cVAwV0RXQUptaDVEeG5Zb1NKMjNNcTRmMHFTTjVmQTJyalRsVno0Zz09AAEAB2F3cy1rbXMAS2Fybjphd3M6a21zOnVzLWVhc3QtMTowMDAwMDAwMDAwMDA6a2V5LzAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMQB0MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAxhXj8VVMS4crQ0L5paAbfKyr8brLnTVr4nDgEMZyS6SMcSffyHaLtd+AMq8q+IaZmXv3GOPmpm83WwpxtR7xeWyU7wEvYmdU93lUwnc9Rl4ACAAAQAHnzBnp4qzttuCBlvMngrINOCWqu4xj7/cuTlRvjitKd5WBEZAAQnV+FQ5DhNnwAr/////8AAAABAAAAAAAAAAAAAAABAAAABnrRUG8pwekPB+5tdS2Ez480PmaFECIAZzBlAjAJYWdGe/IOrUOoLY+swDhaEIdlu25kEH2MdR/Qf8gt0OabAYjmsV4n5JVBTSf4MsoCMQD1UcVGfR31O/582Iv86fNfKS55l/LIFobUOxoj+2itcmHsWf74ZYdww2pECq+H7ck="
>>> code_bytes = base64.b64decode(code)
>>> kms_key_provider = aws_encryption_sdk.StrictAwsKmsMasterKeyProvider(key_ids=["arn:aws:kms:us-east-1:000000000000:key/00000000-0000-0000-0000-000000000001"])
>>> client = aws_encryption_sdk.EncryptionSDKClient(commitment_policy=CommitmentPolicy.FORBID_ENCRYPT_ALLOW_DECRYPT)
>>> decrypt, header = client.decrypt(source=code_bytes, key_provider=kms_key_provider)
>>> decrypt
b'775115'

If I use aws_encryption_sdk to decode locally, then the code decrypts just fine. But if I use boto3 and send it to localstack to decrypt, then it fails!!!

from localstack.

I am also not sure why the client id of "CustomEmailSender_SignUp" event is "CLIENT_ID_NOT_APPLICABLE"
when sign up is performed, a client id is specified. other trigger event seems to have client_id value in them.

from localstack.

Hi @vt-rcheng, thanks for reporting the issue. Could you give us a few more details on how you generate the ciphertext in input? Have you tried to provide the key id to the awslocal kms decrypt command? Thank you 🙏

from localstack.

Hi @vt-rcheng, I've been investigating the issue a bit. According to the official AWS docs, the AWS KMS Decrypt operation cannot decrypt the encrypted message the AWS Encryption SDK returns.
I was also able to verify this behavior in one of our test ran against AWS.

We released a small set of parity fixes in our latest Docker image, based on what you reported. In particular:

• the ClientId in the event is now correctly reported;
• the event now also contains a bunch of data (e.g., user attributes) that were absent before.
  Please let us know if you find any other issues 🙏

from localstack.

Hello 👋! It looks like this issue hasn’t been active in longer than two weeks. We encourage you to check if this is still an issue in the latest release. In the absence of more information, we will be closing this issue soon. If you find that this is still a problem, please feel free to provide a comment or upvote with a reaction on the initial post to prevent automatic closure. If the issue is already closed, please feel free to open a new one.

from localstack.