Preferential order of decryption

Hi amazing crypto heroes of AWS!

We are using the library to encrypt our sensitive settings in our project (passwords, API keys etc). We encrypt with two keys, one is a "development-key" and the other is the "production-key". When we decrypt in production, we would like the SDK to not use the development key, however it tries both and always fails the decrypt on the development key. I know we can set up a KmsKeyProvider to only have the ARN of the production key, but that would make our code a lot messier (having to pass it from a dynamic environment variable etc).

Is there a way to set the order of which keys will be used to decrypt when encrypting? Such to say when we encrypt we will use keys "production-key" and then "development-key". During decryption the SDK will try the first and only if it fails will go onto the second. The failure of trying to use the development key in production is taking IO and impacting our Lambda cold start times.

I feel like this feature should already be supported and maybe I am just not able to figure it out. I see that the SDK gives preferences to keys that are in the same region, but both keys are in the same region in my case 🤕

Any insight or help would be greatly appreciated!

Stay awesome and stay safe,
Mo Kamioner

Commencez par examiner KmsKeyProvider et le comportement existant du SDK en matière de sélection des clés et de déchiffrement, y compris sa préférence pour la même région. Définissez comment un ordre explicite donnant la priorité à la clé de production doit interagir avec le chiffrement et le déchiffrement, puis validez le comportement avec le scénario signalé à deux clés et son impact sur le démarrage à froid de Lambda.

Rédigé par le modèle d'indexation à partir du texte de l'issue.