I seem to be having an inconsistent issue using aws kms for my secrets provider on a new project that I don't remember hitting in the past. I'll often get an error like:

Previewing update (svc-euw1):
error: constructing secrets manager of type "cloud": secrets (code=InvalidArgument): InvalidCiphertextException:

and retrying the pulumi command several times with nothing changing eventually works. From a little reading it might have something to do with how go-cloud handles chaining SSO auth. Has anyone seen this?

Hi @sticky-kitchen-61063 I haven't seen this before. Are you using the AWS KMS customer managed key with Pulumi? https://www.pulumi.com/docs/administration/security-compliance/customer-managed-keys/aws-kms/ If you've got a reproduction you can share, I'm happy to poke around a bit and see if there's a good workaround

@steep-plastic-74107 There's definitely something funky going on with go-cloud using kms keys with multiple encryption context keys. I create a brand new stack with:

pulumi stack init svc-euw1 \
∙   --secrets-provider "awskms:///arn:aws:kms:us-east-1:000000000000:alias/pulumi-management-admin?region=us-east-1&context_env=svc&context_stack=aws-eks-svc-euw1"
Created stack 'svc-euw1'

and get this in my stack file

secretsprovider: awskms:///arn:aws:kms:us-east-1:000000000000:alias/pulumi-management-admin?region=us-east-1&context_env=svc&context_stack=aws-eks-svc-euw1

when I try to fetch and it sometimes works, in Cloudtrail the encryption context looks like this

"requestParameters": {
        "encryptionContext": {
            "stack": "svc",
            "env": "svc"
        },
        "encryptionAlgorithm": "SYMMETRIC_DEFAULT"
    },

and sometimes it fails with cloudtrail showing both encryption context keys are the same:

"errorCode": "InvalidCiphertextException",
    "requestParameters": {
        "encryptionContext": {
            "stack": "aws-eks-svc-euw1",
            "env": "aws-eks-svc-euw1"
        },
        "encryptionAlgorithm": "SYMMETRIC_DEFAULT"
    },

In both cases, it's incorrectly setting both encryption context keys to one value or the other. This is me trying it over and over until it works:

AWS_PROFILE=my_profile pulumi config set --secret testSecret foo
error: secrets (code=InvalidArgument): InvalidCiphertextException: 
AWS_PROFILE=my_profile pulumi config set --secret testSecret foo
error: secrets (code=InvalidArgument): InvalidCiphertextException: 
AWS_PROFILE=my_profile pulumi config set --secret testSecret foo
error: secrets (code=InvalidArgument): InvalidCiphertextException: 
AWS_PROFILE=my_profile pulumi config set --secret testSecret foo
error: secrets (code=InvalidArgument): InvalidCiphertextException: 
AWS_PROFILE=my_profile pulumi config set --secret testSecret foo
error: secrets (code=InvalidArgument): InvalidCiphertextException: 
AWS_PROFILE=my_profile pulumi config set --secret testSecret foo
error: secrets (code=InvalidArgument): InvalidCiphertextException: 
AWS_PROFILE=my_profile pulumi config set --secret testSecret foo
error: secrets (code=InvalidArgument): InvalidCiphertextException: 
AWS_PROFILE=my_profile pulumi config set --secret testSecret foo
AWS_PROFILE=my_profile pulumi config get testSecret
error: secrets (code=InvalidArgument): InvalidCiphertextException: 
AWS_PROFILE=my_profile pulumi config get testSecret
error: secrets (code=InvalidArgument): InvalidCiphertextException: 
AWS_PROFILE=my_profile pulumi config get testSecret
foo

Yea, that's interesting; it does seem like it's probably a bug then. You're using an environment with the stack that has a different encryption key?

I'm not sure I understand your question. I've been consistently using the same kms key.

I was wondering if you had an esc environment you were using with a different key https://www.pulumi.com/docs/esc/administration/customer-managed-keys/

This is using an s3 state bucket. I'm not using pulumi cloud.

Gotcha, so just passing different contexts to the same key?

With a single encryption context key it works every time as you wold expect:

AWS_PROFILE=my_profile pulumi stack init svc-euw1 \
∙   --secrets-provider "awskms:///arn:aws:kms:us-east-1:000000000000:alias/pulumi-management-admin?region=us-east-1&context_stack=aws-eks-svc-euw1"
Created stack 'svc-euw1'
AWS_PROFILE=my_profile pulumi config set --secret testSecret foo
AWS_PROFILE=my_profile pulumi config set --secret testSecret foo
AWS_PROFILE=my_profile pulumi config set --secret testSecret foo
AWS_PROFILE=my_profile pulumi config set --secret testSecret foo
AWS_PROFILE=my_profile pulumi config get testSecret
foo
AWS_PROFILE=my_profile pulumi config get testSecret
foo
AWS_PROFILE=my_profile pulumi config get testSecret
foo
AWS_PROFILE=my_profile pulumi config get testSecret
foo

Yea, thank you for clarifying!