return Error{
		Code:    http.StatusInternalServerError,
		APICode: "kms:KeyListingFailed",
		Err:     "failed to list keys at the KMS",
		Cause:   err,
	}
}

func errKeyGenerationFailed(err error) Error {
	return Error{
		Code:    http.StatusInternalServerError,
		APICode: "kms:KeyGenerationFailed",
		Err:     "failed to generate data key with KMS key",
		Cause:   err,
	}
}

	if err != nil {
		if errors.Is(err, kes.ErrKeyNotFound) {
			return DEK{}, ErrKeyNotFound
		}
		if errors.Is(err, kes.ErrNotAllowed) {
			return DEK{}, ErrPermission
		}
		return DEK{}, errKeyGenerationFailed(err)
	}
	return DEK{
		KeyID:      name,
		Plaintext:  dek.Plaintext,
		Ciphertext: dek.Ciphertext,
	}, nil
}

// ImportKey imports a cryptographic key into the KMS.

	})
	if err != nil {
		if errors.Is(err, kms.ErrKeyNotFound) {
			return DEK{}, ErrKeyNotFound
		}
		if errors.Is(err, kms.ErrPermission) {
			return DEK{}, ErrPermission
		}
		return DEK{}, errKeyGenerationFailed(err)
	}

	return DEK{
		KeyID:      name,
		Version:    resp.Version,
		Plaintext:  resp.Plaintext,
		Ciphertext: resp.Ciphertext,
	}, nil
}