使用無效字母佇列擷取加密的事件錯誤

如果您在事件匯流排上設定 客戶受管金鑰 加密，建議您為該事件匯流排指定無效字母佇列 (DLQ)。 EventBridge 如果在事件匯流排上處理事件時遇到無法擷取的錯誤，則會將自訂事件和夥伴事件傳送至此 DLQ。無法擷取的錯誤是指需要使用者動作才能解決基礎問題 (例如指定的停用或遺失) 客戶受管金鑰 的錯誤。

• 如果在事件匯流排上處理事件時 EventBridge 發生無法擷取的加密或解密錯誤，則會將事件傳送至事件匯流排的 DLQ (如果已指定)。

• 如果嘗試將事件傳送至目標時 EventBridge 發生無法擷取的加密或解密錯誤，則會將事件傳送至目標的 DLQ (如果有指定的話)。

如需詳細資訊，包括使用 DLQ 時的考量事項，以及設定權限的指示，請參閱使用無效字母佇列來處理未傳遞的事件。

解密無效字母 EventBridge 佇列中的事件

解決造成無法擷取錯誤的基本問題之後，您就可以處理傳送至事件匯流排或目標 DLQ 的事件。對於加密的事件，您必須先解密事件才能處理事件。

下列範例示範如何解密 EventBridge 已傳遞至事件匯流排或目標 DLQ 的事件。

// You will receive an encrypted event in the following json format.
        // ```
        //   {
        //     "version": "0", 
        //     "id": "053afa53-cdd7-285b-e754-b0dfd0ac0bfb",  // New event id not the same as the original one
        //     "account": "123456789012",  
        //     "time": "2020-02-10T10:22:00Z",  
        //     "resources": [ ],
        //     "region": "us-east-1",
        //     "source": "aws.events",
        //     "detail-type": "Encrypted Events",
        //     "detail": { 
        //       "event-bus-arn": "arn:aws:events:region:account:event-bus/bus-name", 
        //       "rule-arn": "arn:aws:events:region:account:event-bus/bus-name/rule-name", 
        //       "kms-key-arn": "arn:aws:kms:region:account:key/key-arn", 
        //       "encrypted-payload": "AgR4qiru/XNwTUyCgRHqP7rbbHn/xpmVeVeRIAd12TDYYVwAawABABRhd3M6ZXZlbnRzOmV2ZW50LWJ1cwB
        //                             RYXJuOmF3czpldmVudHM6dXMtZWFzdC0xOjE0NjY4NjkwNDY3MzpldmVudC1idXMvY21rbXMtZ2EtY3Jvc3
        //                             MtYWNjb3VudC1zb3VyY2UtYnVzAAEAB2F3cy1rbXMAS2Fybjphd3M6a21zOnVzLWVhc3QtMToxNDY2ODY5"
        //     }
        //   }
        // ```
 
        // Construct an AwsCrypto object with the encryption algorithm `ALG_AES_256_GCM_HKDF_SHA512_COMMIT_KEY` which 
        // is used by EventBridge for encryption operation. This object is an entry point for decryption operation. 
        // It can later use decryptData(MasterKeyProvider, byte[]) method to decrypt data.
        final AwsCrypto crypto = AwsCrypto.builder()
                .withEncryptionAlgorithm(CryptoAlgorithm.ALG_AES_256_GCM_HKDF_SHA512_COMMIT_KEY)
                .build();
 
        // Construct AWS KMS master key provider with AWS KMS Client Supplier and AWS KMS Key ARN. The KMS Client Supplier can 
        // implement a RegionalClientSupplier interface. The AWS KMS Key ARN can be fetched from kms-key-arn property in 
        // encrypted event json detail.
        final KmsMasterKeyProvider kmsMasterKeyProvider = KmsMasterKeyProvider.builder()
                .customRegionalClientSupplier(...)
                .buildStrict(KMS_KEY_ARN);
 
        // The string of encrypted-payload is base64 encoded. Decode it into byte array, so it can be furthur 
        // decrypted. The encrypted payload can be fetched from encrypted-payload field in encrypted event json detail.
        byte[] encryptedByteArray = Base64.getDecoder().decode(ENCRYPTED_PAYLOAD);
 
        // The decryption operation. It retrieves the encryption context and encrypted data key from the cipher 
        // text headers, which is parsed from byte array encrypted data. Then it decrypts the data key, and 
        // uses it to finally decrypt event payload. This encryption/decryption strategy is called envelope 
        // encryption, https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#enveloping
        final CryptoResult<byte[], KmsMasterKey> decryptResult = crypto.decryptData(kmsMasterKeyProvider, encryptedByteArray);
 
        final byte[] decryptedByteArray = decryptResult.getResult();
    
        // Decode the event json plaintext from byte array into string with UTF_8 standard.
        String eventJson = new String(decryptedByteArray, StandardCharsets.UTF_8);