ARSN-503: Update AWS KMS error render

Always return aws error code as is prefixed with KMS

For some error return the same error code and message
For others hide potentially sensitive message

Author: BourgoisMickael

lib/network/utils.ts

@@ -1,4 +1,5 @@
-import { errorInstances } from '../errors';
+import type { AWSError } from 'aws-sdk';
+import { ArsenalError, errorInstances } from '../errors';
 
 /**
  * Normalize errors according to arsenal definitions with a custom prefix
@@ -28,6 +29,61 @@ export function arsenalErrorKMIP(err: string | Error) {
     return _normalizeArsenalError(err, 'KMIP:');
 }
 
-export function arsenalErrorAWSKMS(err: string | Error) {
+// List of AWS KMS errors that are specific to KMS and where the error
+// can be returned to the user as is with a specific status code.
+// Avoid any error that might leak sensitive information such as hostnames
+// or ip addresses from network related errors.
+// KeyId is not considered sensitive.
+// Reference: https://docs.aws.amazon.com/kms/latest/APIReference/CommonErrors.html
+// See specific actions like CreateKey, Encrypt, Decrypt, etc. for more details.
+// Other errors not listed will return only the same error code but http status 500
+// and message will be generic and details will be in logs only.
+const allowedKmsErrors = {
+    'AccessDeniedException': 400,
+    'AlreadyExistsException': 400,
+    'DisabledException': 400,
+    'IncorrectKeyException': 400,
+    'InvalidAliasNameException': 400,
+    'InvalidArnException': 400,
+    'InvalidCiphertextException': 400,
+    'InvalidGrantTokenException': 400,
+    'InvalidKeyUsageException': 400,
+    'KMSInternalException': 500,
+    'KMSInvalidStateException': 400,
+    'KeyUnavailableException': 500,
+    'LimitExceededException': 400,
+    'MalformedPolicyDocumentException': 400,
+    'NotFoundException': 400,
+    'TagException': 400,
+    'UnsupportedOperationException': 400,
+};
+
+const allowedKmsErrorCodes = Object.keys(allowedKmsErrors);
+
+function isAWSError(err: string | Error | AWSError): err is AWSError {
+    return (err as AWSError).code !== undefined
+        && (err as AWSError).retryable !== undefined;
+}
+
+export function arsenalErrorAWSKMS(err: string | Error | AWSError) {
+    if (isAWSError(err)) {
+        if (allowedKmsErrorCodes.includes(err.code)) {
+            return ArsenalError.unflatten({
+                is_arsenal_error: true,
+                type: `KMS.${err.code}`, // aws s3 prefix kms errors with KMS.
+                code: allowedKmsErrors[err.code],
+                description: err.message,
+                stack: err.stack,
+            });
+        } else {
+            return ArsenalError.unflatten({
+                is_arsenal_error: true,
+                type: `KMS.${err.code}`, // aws s3 prefix kms errors with KMS.
+                code: 500,
+                description: `unexpected AWS_KMS error`,
+                stack: err.stack,
+            });
+        }
+    }
     return _normalizeArsenalError(err, 'AWS_KMS:');
 }