JuliusBrussee/caveman · error

kms: probe encrypt: %w

Error message

kms: probe encrypt: %w

What it means

Probe generates 32 random bytes, Encrypts them, Decrypts the result, and compares; any failure in the Encrypt stage is wrapped as 'kms: probe encrypt: %w'. The underlying cause is whatever Encrypt or the HTTP call returned: plaintext checks pass (32 bytes), so realistic causes are auth failure, network errors, HTTP non-200, or an invalid encrypt response from the key manager.

Source

Thrown at shared/platform/kms/kms.go:324

	if !runtimeenv.IsProduction() {
		return nil
	}
	client, err := FromPayloadEnvironment()
	if err != nil {
		return err
	}
	return client.Probe(ctx)
}

// Probe verifies live key access without persisting tenant data.
func (c *Client) Probe(ctx context.Context) error {
	plaintext := make([]byte, 32)
	if _, err := rand.Read(plaintext); err != nil {
		return fmt.Errorf("kms: generate probe: %w", err)
	}
	envelope, err := c.Encrypt(ctx, plaintext)
	if err != nil {
		return fmt.Errorf("kms: probe encrypt: %w", err)
	}
	decrypted, err := c.Decrypt(ctx, envelope)
	if err != nil {
		return fmt.Errorf("kms: probe decrypt: %w", err)
	}
	if !bytes.Equal(decrypted, plaintext) {
		return errors.New("kms: probe plaintext mismatch")
	}
	return nil
}

func validateLocation(region, keyID string) error {
	if !regionPattern.MatchString(region) {
		return errors.New("kms: invalid Scaleway region")
	}
	if !keyIDPattern.MatchString(keyID) {
		return errors.New("kms: invalid Scaleway key ID")
	}

View on GitHub (pinned to 27d5a3981a)

Solutions

1. Read the wrapped error: 'returned HTTP 401/403' means token, 'HTTP 404' means region/keyID, 'request failed' means network
2. Verify the auth token and that it belongs to a project with access to the key
3. Confirm region and key ID match a live key in the Scaleway console
4. Allow egress to the key-manager API endpoint from the runtime environment

Example fix

// before
cfg := kms.Config{Provider: kms.ProviderScaleway, Region: "fr-par", KeyID: "deleted-key", Token: staleToken}

// after
cfg := kms.Config{Provider: kms.ProviderScaleway, Region: "fr-par", KeyID: liveKeyID, Token: currentToken}

if err := client.Probe(ctx); err != nil { /* inspect wrapped cause before retrying */ }

if err := client.Probe(ctx); err != nil {
	if strings.Contains(err.Error(), "probe encrypt") {
		log.Printf("KMS encrypt path unhealthy: %v", err)
	}
	return err
}

When it happens

Trigger: Running Probe at startup with an invalid/expired Scaleway auth token (surfaces as HTTP error from the call path); wrong region or key ID in config reaching the API; network egress blocked from the deployment; the key being disabled or deleted server-side.

Common situations: CI or local dev without KMS credentials; token rotated but the deployed secret not updated; firewall/proxy blocking api.scaleway.com; key deleted in console while config still references it.

Related errors

• kms: probe decrypt: %w
• production KMS configuration: %w
• kms: unsupported provider %q
• kms: plaintext exceeds %d bytes
• kms: decode envelope: %w

AI-assisted analysis of JuliusBrussee/caveman@27d5a3981a (2026-08-15). Data as JSON: /api/errors/dd45c364a33ffdf3. Report an issue: GitHub.