Hierarchical Keyring: cold-cache stampede — N concurrent decrypts → N DynamoDB/KMS calls

Open
#1,663 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
52/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
aws, node.js, typescript
Domain
backend, security

Research direction

Start at the Node Hierarchical Keyring's getBranchKeyMaterials path and trace how the materials cache handles a cold-cache lookup. Reproduce the issue with concurrent decrypts or encrypts for one branch-key version and verify that one in-flight keystore request is shared, settled entries are removed, and a failed request can be retried.

Written by the indexing model from the issue text.

Description

Security issue notifications

If you discover a potential security issue in the AWS Encryption SDK we ask that you notify AWS Security via our vulnerability reporting page. Please do not create a public GitHub issue.

Problem:

The Node Hierarchical Keyring doesn't de-dupe concurrent branch-key lookups. If I fire a lot of decrypts for the same branch key at once against a cold cache, they all miss the cache together (it's only filled after the keystore call returns), so each one hits the keystore on its own.

So instead of one lookup I get N DynamoDB GetItem + N KMS Decrypt calls. Easy to repro: await Promise.all of ~3000 decrypts for the same key version, and you see ~3000 keystore calls instead of 1. Encrypt has the same problem since it shares the same code path.

Solution:

Add single-flight to getBranchKeyMaterials: on a miss, the first caller starts the keystore fetch and stores the in-flight promise (keyed by cache entry id); everyone else for the same key awaits that promise instead of starting their own. The entry is dropped once it settles, so the materials cache still owns caching and TTL, and a failed request isn't shared — the next call just retries.

Out of scope:

The legacy caching CMM has the same gap but it's a separate path, so I'm not touching it here.

Dominant language
TypeScript
Stars
260
Forks
68
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from aws/aws-encryption-sdk-javascript

All issues in aws/aws-encryption-sdk-javascript

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.