Skip to content

Must use either different key or iv for GCM encryption error when used with S3 SDK >= 2.43.0 #510

Closed
Closed
Must use either different key or iv for GCM encryption error when used with S3 SDK >= 2.43.0#510
Labels
pending_releaseFix/Feature is merged, but not pushed to Maven

Description

@emirmx
emirmx
opened on May 4, 2026

Problem:

I am testing with encryption client version 4.0.1 and S3 SDK version 2.43.0.
Receiving Must use either different key or iv for GCM encryption error when trying to store in a different region than the bucket's region with the help of crossRegionAccessEnabled(true) setting.

The following code is enough to trigger the issue. Assuming some-bucket is stored in eu-west-1, when AWS_REGION set to us-east-1 the mentioned error occurs. OTOH, if the region is set to the region of the bucket, i.e. eu-west-1 in this case, no error occurs.

import software.amazon.awssdk.core.sync.RequestBody;
import software.amazon.awssdk.services.s3.model.PutObjectRequest;
import software.amazon.encryption.s3.S3EncryptionClient;
import software.amazon.encryption.s3.materials.AesKeyring;

import javax.crypto.spec.SecretKeySpec;

public class Main {
  public static void main(String[] args) {
    var aesKey = new SecretKeySpec(new byte[32], "AES");
    var keyRing = AesKeyring.builder().wrappingKey(aesKey).build();

    try (var s3 = S3EncryptionClient.builderV4().crossRegionAccessEnabled(true).keyring(keyRing).build()) {
      final var request = PutObjectRequest.builder().bucket("some-bucket").key("some-key").build();
      s3.putObject(request, RequestBody.fromBytes("test".getBytes()));
    }
  }
}

Here is the full stack trace from my experiments:

software.amazon.encryption.s3.S3EncryptionClientException: software.amazon.awssdk.core.exception.SdkClientException: Unable to execute HTTP request: Encountered fatal error in publisher (SDK Attempt Count: 1)
    at software.amazon.encryption.s3.S3EncryptionClient.putObject (S3EncryptionClient.java:417)
    at acme.demo.use.s3.Main.main (Main.java:17)
    at org.codehaus.mojo.exec.ExecJavaMojo$1.run (ExecJavaMojo.java:279)
    at java.lang.Thread.run (Thread.java:1583)
Caused by: software.amazon.awssdk.core.exception.SdkClientException: Unable to execute HTTP request: Encountered fatal error in publisher (SDK Attempt Count: 1)
    at software.amazon.awssdk.core.exception.SdkClientException$BuilderImpl.build (SdkClientException.java:130)
    at software.amazon.awssdk.core.exception.SdkClientException$BuilderImpl.build (SdkClientException.java:95)
    at software.amazon.awssdk.core.internal.http.pipeline.stages.utils.RetryableStageHelper.retryPolicyDisallowedRetryException (RetryableStageHelper.java:180)
    at software.amazon.awssdk.core.internal.http.pipeline.stages.AsyncRetryableStage$RetryingExecutor.maybeAttemptExecute (AsyncRetryableStage.java:149)
    at software.amazon.awssdk.core.internal.http.pipeline.stages.AsyncRetryableStage$RetryingExecutor.maybeRetryExecute (AsyncRetryableStage.java:175)
    at software.amazon.awssdk.core.internal.http.pipeline.stages.AsyncRetryableStage$RetryingExecutor.lambda$attemptExecute$1 (AsyncRetryableStage.java:123)
    at java.util.concurrent.CompletableFuture.uniWhenComplete (CompletableFuture.java:863)
    at java.util.concurrent.CompletableFuture$UniWhenComplete.tryFire (CompletableFuture.java:841)
    at java.util.concurrent.CompletableFuture.postComplete (CompletableFuture.java:510)
    at java.util.concurrent.CompletableFuture.completeExceptionally (CompletableFuture.java:2194)
    at software.amazon.awssdk.utils.CompletableFutureUtils.lambda$forwardExceptionTo$0 (CompletableFutureUtils.java:78)
    at java.util.concurrent.CompletableFuture.uniWhenComplete (CompletableFuture.java:863)
    at java.util.concurrent.CompletableFuture$UniWhenComplete.tryFire (CompletableFuture.java:841)
    at java.util.concurrent.CompletableFuture.postComplete (CompletableFuture.java:510)
    at java.util.concurrent.CompletableFuture.completeExceptionally (CompletableFuture.java:2194)
    at software.amazon.awssdk.core.internal.http.pipeline.stages.MakeAsyncHttpRequestStage.lambda$execute$0 (MakeAsyncHttpRequestStage.java:111)
    at java.util.concurrent.CompletableFuture.uniWhenComplete (CompletableFuture.java:863)
    at java.util.concurrent.CompletableFuture$UniWhenComplete.tryFire (CompletableFuture.java:841)
    at java.util.concurrent.CompletableFuture.postComplete (CompletableFuture.java:510)
    at java.util.concurrent.CompletableFuture.completeExceptionally (CompletableFuture.java:2194)
    at software.amazon.awssdk.core.internal.http.pipeline.stages.MakeAsyncHttpRequestStage.completeResponseFuture (MakeAsyncHttpRequestStage.java:266)
    at software.amazon.awssdk.core.internal.http.pipeline.stages.MakeAsyncHttpRequestStage.lambda$executeHttpRequest$3 (MakeAsyncHttpRequestStage.java:171)
    at java.util.concurrent.CompletableFuture.uniHandle (CompletableFuture.java:934)
    at java.util.concurrent.CompletableFuture$UniHandle.tryFire (CompletableFuture.java:911)
    at java.util.concurrent.CompletableFuture$Completion.run (CompletableFuture.java:482)
    at java.util.concurrent.ThreadPoolExecutor.runWorker (ThreadPoolExecutor.java:1144)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run (ThreadPoolExecutor.java:642)
    at java.lang.Thread.run (Thread.java:1583)
Caused by: java.lang.IllegalStateException: Encountered fatal error in publisher
    at software.amazon.awssdk.utils.async.SimplePublisher.panicAndDie (SimplePublisher.java:339)
    at software.amazon.awssdk.utils.async.SimplePublisher.processEventQueue (SimplePublisher.java:228)
    at software.amazon.awssdk.utils.async.SimplePublisher.access$1300 (SimplePublisher.java:58)
    at software.amazon.awssdk.utils.async.SimplePublisher$SubscriptionImpl.request (SimplePublisher.java:379)
    at software.amazon.awssdk.utils.async.AddingTrailingDataSubscriber$1.request (AddingTrailingDataSubscriber.java:95)
    at software.amazon.awssdk.utils.async.BaseSubscriberAdapter.ensureUpstreamDemandExists (BaseSubscriberAdapter.java:301)
    at software.amazon.awssdk.utils.async.BaseSubscriberAdapter.handleUpstreamDemandState (BaseSubscriberAdapter.java:230)
    at software.amazon.awssdk.utils.async.BaseSubscriberAdapter.handleStateUpdate (BaseSubscriberAdapter.java:180)
    at software.amazon.awssdk.utils.async.BaseSubscriberAdapter$1.request (BaseSubscriberAdapter.java:109)
    at software.amazon.awssdk.http.nio.netty.internal.nrs.HandlerSubscriber.maybeRequestMore (HandlerSubscriber.java:303)
    at software.amazon.awssdk.http.nio.netty.internal.nrs.HandlerSubscriber.maybeStart (HandlerSubscriber.java:238)
    at software.amazon.awssdk.http.nio.netty.internal.nrs.HandlerSubscriber.provideSubscription (HandlerSubscriber.java:225)
    at software.amazon.awssdk.http.nio.netty.internal.nrs.HandlerSubscriber.access$000 (HandlerSubscriber.java:41)
    at software.amazon.awssdk.http.nio.netty.internal.nrs.HandlerSubscriber$1.run (HandlerSubscriber.java:213)
    at io.netty.util.concurrent.AbstractEventExecutor.runTask (AbstractEventExecutor.java:173)
    at io.netty.util.concurrent.AbstractEventExecutor.safeExecute (AbstractEventExecutor.java:166)
    at io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks (SingleThreadEventExecutor.java:472)
    at io.netty.channel.nio.NioEventLoop.run (NioEventLoop.java:569)
    at io.netty.util.concurrent.SingleThreadEventExecutor$4.run (SingleThreadEventExecutor.java:998)
    at io.netty.util.internal.ThreadExecutorMap$2.run (ThreadExecutorMap.java:74)
    at java.lang.Thread.run (Thread.java:1583)
Caused by: java.lang.IllegalStateException: Must use either different key or  iv for GCM encryption
    at com.sun.crypto.provider.GaloisCounterMode.checkReInit (GaloisCounterMode.java:340)
    at com.sun.crypto.provider.GaloisCounterMode$GCMEncrypt.doUpdate (GaloisCounterMode.java:1117)
    at com.sun.crypto.provider.GaloisCounterMode.engineUpdate (GaloisCounterMode.java:349)
    at javax.crypto.Cipher.update (Cipher.java:1908)
    at software.amazon.encryption.s3.internal.CipherSubscriber.onNext (CipherSubscriber.java:56)
    at software.amazon.encryption.s3.internal.CipherSubscriber.onNext (CipherSubscriber.java:19)
    at software.amazon.awssdk.utils.async.SimplePublisher.doProcessQueue (SimplePublisher.java:269)
    at software.amazon.awssdk.utils.async.SimplePublisher.processEventQueue (SimplePublisher.java:226)
    at software.amazon.awssdk.utils.async.SimplePublisher.access$1300 (SimplePublisher.java:58)
    at software.amazon.awssdk.utils.async.SimplePublisher$SubscriptionImpl.request (SimplePublisher.java:379)
    at software.amazon.awssdk.utils.async.AddingTrailingDataSubscriber$1.request (AddingTrailingDataSubscriber.java:95)
    at software.amazon.awssdk.utils.async.BaseSubscriberAdapter.ensureUpstreamDemandExists (BaseSubscriberAdapter.java:301)
    at software.amazon.awssdk.utils.async.BaseSubscriberAdapter.handleUpstreamDemandState (BaseSubscriberAdapter.java:230)
    at software.amazon.awssdk.utils.async.BaseSubscriberAdapter.handleStateUpdate (BaseSubscriberAdapter.java:180)
    at software.amazon.awssdk.utils.async.BaseSubscriberAdapter$1.request (BaseSubscriberAdapter.java:109)
    at software.amazon.awssdk.http.nio.netty.internal.nrs.HandlerSubscriber.maybeRequestMore (HandlerSubscriber.java:303)
    at software.amazon.awssdk.http.nio.netty.internal.nrs.HandlerSubscriber.maybeStart (HandlerSubscriber.java:238)
    at software.amazon.awssdk.http.nio.netty.internal.nrs.HandlerSubscriber.provideSubscription (HandlerSubscriber.java:225)
    at software.amazon.awssdk.http.nio.netty.internal.nrs.HandlerSubscriber.access$000 (HandlerSubscriber.java:41)
    at software.amazon.awssdk.http.nio.netty.internal.nrs.HandlerSubscriber$1.run (HandlerSubscriber.java:213)
    at io.netty.util.concurrent.AbstractEventExecutor.runTask (AbstractEventExecutor.java:173)
    at io.netty.util.concurrent.AbstractEventExecutor.safeExecute (AbstractEventExecutor.java:166)
    at io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks (SingleThreadEventExecutor.java:472)
    at io.netty.channel.nio.NioEventLoop.run (NioEventLoop.java:569)
    at io.netty.util.concurrent.SingleThreadEventExecutor$4.run (SingleThreadEventExecutor.java:998)
    at io.netty.util.internal.ThreadExecutorMap$2.run (ThreadExecutorMap.java:74)
    at java.lang.Thread.run (Thread.java:1583)

Activity

  1. rishav-karanjit commented on May 21, 2026

    @rishav-karanjit
    rishav-karanjit
    on May 21, 2026
    Member

    Hello, thank you for the GitHub issue. This is a known limitation of the S3 Encryption Client when used with crossRegionAccessEnabled(true). The encryption client's request body is single-use by design — GCM encryption produces a unique cipher text stream tied to a specific key and IV, and the cryptographic provider correctly rejects any attempt to reuse that combination. We will improve the error message in future releases so this failure is immediately clear rather than surfacing as a low-level GCM error. We are also evaluating if it's viable to safely support this use case. Thank you.

  2. rishav-karanjit
    added
    pending_releaseFix/Feature is merged, but not pushed to Maven
    on May 21, 2026

  3. emirmx commented on May 27, 2026

    @emirmx
    emirmx
    on May 27, 2026
    Author

    Hello, thank you for the GitHub issue. This is a known limitation of the S3 Encryption Client when used with ...

    Thanks for the response. You mentioned that this is a known limitation which suggests it is something fundamental. But it seems, this is introduced in recent versions.

  4. rishav-karanjit commented on May 27, 2026

    @rishav-karanjit
    rishav-karanjit
    on May 27, 2026
    Member

    Hi, yes we are aware of this. There appears to be a change in the AWS SDK for Java v2's retry/redirect behavior when crossRegionAccessEnabled is used in newer versions, which surfaces this limitation. We'd recommend reaching out to aws/aws-sdk-java-v2 for more details on that change.

  5. emirmx commented on Jul 1, 2026

    @emirmx
    emirmx
    on Jul 1, 2026
    Author

    With recent versions of s3 SDK (~2.46.17), we do not see this error any more.

  6. lucasmcdonald3 commented on Aug 31, 2026

    @lucasmcdonald3
    lucasmcdonald3
    on Aug 31, 2026
    Contributor

    Hi @emirmx --

    We improved the error message in v4.0.2. Please upgrade to this version to get the change.

  7. lucasmcdonald3
    closed this as completedon Aug 31, 2026

  8. emirmx commented on Sep 3, 2026

    @emirmx
    emirmx
    on Sep 3, 2026
    Author

    Thanks @lucasmcdonald3 . Just a small note, we do not see this error with newer versions of S3 SDK.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    pending_releaseFix/Feature is merged, but not pushed to Maven

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions