message: Check AWS KMS call error before checking response.
diff: @@ -83,11 +83,11 @@ func (a *AWSAEAD) Decrypt(ciphertext, additionalData []byte) ([]byte, error) {
  }
  }
  resp, err := a.kms.Decrypt(req)
  - if strings.Compare(*resp.KeyId, a.keyURI) != 0 {
  - return nil, errors.New("decryption failed: wrong key id")
  - }
  if err != nil {
  return nil, err
  }
  + if strings.Compare(*resp.KeyId, a.keyURI) != 0 {
  + return nil, errors.New("decryption failed: wrong key id")
  + }
  return resp.Plaintext, nil
  }
  