Use same KMS key, but use a different role to decrypt vs encrypt

Hi,

I have a single KMS key that two different roles have access to. I am trying to encrypt the secret using one role, but then decrypt it using a different role (this constraint is due to some security policies at my company).

KMS Key:
arn:aws:kms:us-east-1:123456789:key/123456

Encrypt Role:
arn:aws:iam::123456789:role/encrypt-role

Decrypt Role:
arn:aws:iam::123456789:role/decrypt-role

My .sops.yaml config looks like:

creation_rules:
    - kms: 'arn:aws:kms:us-east-1:123456789:key/123456+arn:aws:iam::123456789:role/encrypt-role'

The encryption works fine, but it fails to decrypt because the role is persisted to the enc.yaml metadata file.

Example:

super_secret:
    token: ENC[AES256_GCM,data:asdasdasdasdasdas/wM=,iv:asdasdasdasdasdasd=,tag:asdasdasdasdasdasd==,type:str]
sops:
    kms:
    -   arn: arn:aws:kms:us-east-1:123456789:key/123456
        role: arn:aws:iam::123456789:role/encrypt-role
        created_at: '2020-07-14T18:28:18Z'
        enc: stuff
        aws_profile: ""
    gcp_kms: []
    azure_kv: []
    lastmodified: '2020-07-14T18:28:19Z'
    mac: mac-stuff
    pgp: []
    unencrypted_suffix: _unencrypted
    version: 3.5.0

If I manually edit the role to be the decrypt role then decryption works fine.

What I think I am looking forward is to somehow be able to configure a different decryption config... e.g. have .sops.yaml support a decrypt_rules section where we could configure this or provide a way to supply multiple roles that would be attempted in serial until one is able to access the kms key.

This seems like it might of been supported with the key_groups stuff, but I hit two issues. One is that it requires shamir-secret-sharing-threshold >= 2 AND it fails when it can't assume one of the roles.

Start by reviewing the .sops.yaml creation_rules configuration and the key_groups behavior described in the issue. Trace how the encrypt role is persisted in the KMS metadata and how decryption handles role-assumption failures. Done means a documented, tested configuration can use separate encryption and decryption roles without manual metadata edits.