Preferential order of decryption

Hi amazing crypto heroes of AWS!

We are using the library to encrypt our sensitive settings in our project (passwords, API keys etc). We encrypt with two keys, one is a "development-key" and the other is the "production-key". When we decrypt in production, we would like the SDK to not use the development key, however it tries both and always fails the decrypt on the development key. I know we can set up a KmsKeyProvider to only have the ARN of the production key, but that would make our code a lot messier (having to pass it from a dynamic environment variable etc).

Is there a way to set the order of which keys will be used to decrypt when encrypting? Such to say when we encrypt we will use keys "production-key" and then "development-key". During decryption the SDK will try the first and only if it fails will go onto the second. The failure of trying to use the development key in production is taking IO and impacting our Lambda cold start times.

I feel like this feature should already be supported and maybe I am just not able to figure it out. I see that the SDK gives preferences to keys that are in the same region, but both keys are in the same region in my case 🤕

Any insight or help would be greatly appreciated!

Stay awesome and stay safe,
Mo Kamioner

まず KmsKeyProvider と、同一リージョンを優先する動作を含む、SDK の既存のキー選択および復号動作を確認します。明示的な本番キー優先の順序が暗号化および復号とどのように連携すべきかを定義し、報告された 2 キーのシナリオと Lambda のコールドスタートへの影響を使って動作を検証します。

索引モデルが issue の本文から書いたものです。