return Error{
		Code:    http.StatusInternalServerError,
		APICode: "kms:KeyGenerationFailed",
		Err:     "failed to generate data key with KMS key",
		Cause:   err,
	}
}

func errDecryptionFailed(err error) Error {
	return Error{
		Code:    http.StatusInternalServerError,
		APICode: "kms:DecryptionFailed",
		Err:     "failed to decrypt ciphertext with KMS key",
		Cause:   err,
	}

			return nil, ErrKeyNotFound
		}
		if errors.Is(err, kes.ErrDecrypt) {
			return nil, ErrDecrypt
		}
		if errors.Is(err, kes.ErrNotAllowed) {
			return nil, ErrPermission
		}
		return nil, errDecryptionFailed(err)
	}
	return plaintext, nil
}

// MAC generates the checksum of the given req.Message using the key
// with the req.Name at the KMS.

	})
	if err != nil {
		if errors.Is(err, kms.ErrKeyNotFound) {
			return nil, ErrKeyNotFound
		}
		if errors.Is(err, kms.ErrPermission) {
			return nil, ErrPermission
		}
		return nil, errDecryptionFailed(err)
	}
	return resp.Plaintext, nil
}

// MAC generates the checksum of the given req.Message using the key
// with the req.Name at the KMS.