The ctx parameter was already available from the Cipher method but wasn't being passed to the DynamoDB Put call for new DEK storage.