docs: private static SecretKey cek(byte[] cekSecured, String keyWrapAlgo,
                                   EncryptionMaterials materials, Provider securityProvider,
                                   ContentCryptoScheme contentCryptoScheme, AWSKMS kms) {
          if (isKMSKeyWrapped(keyWrapAlgo))
              return cekByKMS(cekSecured, keyWrapAlgo, materials, contentCryptoScheme, kms);
          Key kek;
          if (materials.getKeyPair() != null) {
              // Do envelope decryption with private key from key pair
              kek = materials.getKeyPair().getPrivate();
              if (kek == null) {
                  throw new SdkClientException("Key encrypting key not available");
              }
          } else {
              // Do envelope decryption with symmetric key
              kek = materials.getSymmetricKey();
              if (kek == null) {
                  throw new SdkClientException("Key encrypting key not available");
              }
          }
  
          try {
              if (keyWrapAlgo != null) {
                  // Key wrapping specified
                  Cipher cipher = securityProvider == null ? Cipher
                      .getInstance(keyWrapAlgo) : Cipher.getInstance(
                      keyWrapAlgo, securityProvider);
                  cipher.init(Cipher.UNWRAP_MODE, kek);
                  return (SecretKey) cipher.unwrap(cekSecured, keyWrapAlgo,
                                                   Cipher.SECRET_KEY);
              }
              // fall back to the Encryption Only (EO) key decrypting method
              Cipher cipher;
              if (securityProvider != null) {
                  cipher = Cipher.getInstance(kek.getAlgorithm(),
                                              securityProvider);
              } else {
                  cipher = Cipher.getInstance(kek.getAlgorithm());
              }
              cipher.init(Cipher.DECRYPT_MODE, kek);
              byte[] decryptedSymmetricKeyBytes = cipher.doFinal(cekSecured);
              return new SecretKeySpec(decryptedSymmetricKeyBytes,
                                       JceEncryptionConstants.SYMMETRIC_KEY_ALGORITHM);
          } catch (Exception e) {
              throw failure(e, "Unable to decrypt symmetric key from object metadata");
          }
      }