refactor: look up the HMAC key for each row in the KMS PostgreSQL trigger

CHANGELOG.md

@@ -8,6 +8,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 ### :magic_wand: Added
 - [Federated Authentication Plugin](https://aws.github.io/aws-advanced-wrapper-docs/ruby/using-plugins/federated-auth), which authenticates with Active Directory Federation Services (AD FS), exchanges the resulting SAML assertion for temporary AWS credentials via STS, and connects to the database with an RDS IAM authentication token. Enabled with the `federated_auth` plugin code ([PR #207](https://github.com/aws/aws-advanced-ruby-driver-wrapper/pull/207)).
 
+### :crab: Changed
+- Simplified the KMS Encryption Plugin's PostgreSQL trigger SQL to read the column's HMAC key from `key_storage` for every row. Re-run the trigger SQL from the [documentation](https://aws.github.io/aws-advanced-wrapper-docs/ruby/using-plugins/kms-encryption#postgresql-1) to update existing deployments ([PR #216](https://github.com/aws/aws-advanced-ruby-driver-wrapper/pull/216)).
+
 ## [1.0.1] - 2026-10-07
 
 ### :bug: Fixed

spec/integration/container/kms_encryption_triggers_spec.rb

@@ -84,8 +84,6 @@
     end
   end
 
-  # The trigger caches the column's HMAC key for the length of a transaction. A later transaction on
-  # the same connection must look it up again rather than reading back the expired cache entry.
   shared_examples 'a trigger across transactions on one connection' do
     it 'accepts a valid value in each of several transactions on the same connection' do
       3.times do |i|

spec/integration/host/src/test/resources/sql/kms_encryption_trigger_pg.sql

@@ -13,7 +13,6 @@ DECLARE
   col_name  text := TG_ARGV[0];
   col_value bytea;
   hmac_key  bytea;
-  cache_key text := 'hmac_key.' || TG_TABLE_NAME || '.' || col_name;
   unchanged boolean;
 BEGIN
   -- An UPDATE that leaves the encrypted value as it was is not re-checked; see
@@ -31,20 +30,14 @@ BEGIN
     RETURN NEW;
   END IF;
 
-  -- A setting cached by an earlier transaction reads back as '' rather than being
-  -- undefined, so an empty value is treated as not cached.
-  hmac_key := decode(NULLIF(current_setting(cache_key, true), ''), 'hex');
-  IF hmac_key IS NULL THEN
-    SELECT ks.hmac_key INTO hmac_key
-      FROM encrypt.encryption_metadata em
-      JOIN encrypt.key_storage ks ON em.key_id = ks.id
-     WHERE em.table_name = TG_TABLE_NAME AND em.column_name = col_name;
-
-    IF hmac_key IS NULL THEN
-      RAISE EXCEPTION 'No HMAC key is configured for %.%', TG_TABLE_NAME, col_name;
-    END IF;
+  -- Read the column's current HMAC key from key_storage.
+  SELECT ks.hmac_key INTO hmac_key
+    FROM encrypt.encryption_metadata em
+    JOIN encrypt.key_storage ks ON em.key_id = ks.id
+   WHERE em.table_name = TG_TABLE_NAME AND em.column_name = col_name;
 
-    PERFORM set_config(cache_key, encode(hmac_key, 'hex'), true);
+  IF hmac_key IS NULL THEN
+    RAISE EXCEPTION 'No HMAC key is configured for %.%', TG_TABLE_NAME, col_name;
   END IF;
 
   IF length(col_value) < 65