Environment details

• OS: Linux Debian
• Node.js version: 10.21.0
• npm version: 6.14.3
• @google-cloud/kms version: 2.1.2

Steps to reproduce

1. Ensure the IAM account in question does not have permission to encrypt e.g. no 'Cloud KMS CryptoKey Encrypter/Decrypter' or 'Cloud KMS CryptoKey Encrypter' IAM roles

2. Try encrypting a payload e.g.

await kmsClient.encrypt({
    name: kmsClient.cryptoKeyPath('PROJECT_ID', 'LOCATION', 'KEY_RING', 'KEY'),
    plaintext: 'payload to encrypt'
  }, { timeout: 5000 });

The client hangs hangs indefinitely. For some reason if the plaintext parameter is removed then the invalid permission error is thrown e.g.

await kmsClient.encrypt({
    name: kmsClient.cryptoKeyPath('PROJECT_ID', 'LOCATION', 'KEY_RING', 'KEY')
  }, { timeout: 5000 });

Error:

{ Error: 7 PERMISSION_DENIED: Permission 'cloudkms.cryptoKeyVersions.useToEncrypt' denied on resource 'RESOURCE_PATH' (or it may not exist).

Expected behavior

When the plaintext parameter is included, the client should throw an error similar to that when the plaintext parameter is excluded

Note: This may actually not be related to a missing permission. The client also hangs and never returns a response even when the right IAM roles are present