-
Notifications
You must be signed in to change notification settings - Fork 123
Description
Specifically timing & encrypt/decrypt success/failure rates when using multiple KMS providers that may be skipped over automatically during each operation.
This will help from an operations standpoint when latency spikes up or debugging if we're seeing increased failures.
Unfortunately I'm not terribly sure how this would look with the DefaultCryptoMaterialsManager
in practice. Callbacks you can register?
As an example, we wrote our own multi-region encryption materials manager and we've tried to add these metrics tagged with the region we're going to. Since we're using a key alias, we can parse the region out of the provider information string easily enough when it's successful (exactly like you do in the KmsMasterKeyProvider
), but getting the region from AwsCryptoException
(for encryption errors) or AWSKMSException
(for data key generation errors) has proven to be a painful parsing exercise :) Having the region easily accessible on each exception would be quite helpful for this purpose.
Thanks!