{"record":{"id":"0ab736113cd1217c","repo":"benbjohnson/litestream","slug":"s3-cannot-use-both-sse-customer-key-and-sse-kms-k","errorCode":null,"errorMessage":"s3: cannot use both sse-customer-key and sse-kms-key-id; they are mutually exclusive","messagePattern":"s3: cannot use both sse-customer-key and sse-kms-key-id; they are mutually exclusive","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"s3/replica_client.go","lineNumber":531,"sourceCode":"\t\t\t// Add scheme if not present\n\t\t\tif !strings.HasPrefix(endpoint, \"http://\") && !strings.HasPrefix(endpoint, \"https://\") {\n\t\t\t\tendpoint = \"https://\" + endpoint\n\t\t\t}\n\n\t\t\to.BaseEndpoint = aws.String(endpoint)\n\t\t\t// For MinIO and other S3-compatible services\n\t\t\tif strings.HasPrefix(endpoint, \"http://\") {\n\t\t\t\to.EndpointOptions.DisableHTTPS = true\n\t\t\t}\n\t\t})\n\t}\n}\n\n// validateSSEConfig validates server-side encryption configuration.\nfunc (c *ReplicaClient) validateSSEConfig() error {\n\t// Check mutual exclusivity: SSE-C and SSE-KMS cannot both be set\n\tif c.SSECustomerKey != \"\" && c.SSEKMSKeyID != \"\" {\n\t\treturn fmt.Errorf(\"s3: cannot use both sse-customer-key and sse-kms-key-id; they are mutually exclusive\")\n\t}\n\n\t// Validate SSE-C configuration\n\tif c.SSECustomerKey != \"\" {\n\t\t// Algorithm must be AES256 (or default to it)\n\t\tif c.SSECustomerAlgorithm == \"\" {\n\t\t\tc.SSECustomerAlgorithm = \"AES256\"\n\t\t} else if c.SSECustomerAlgorithm != \"AES256\" {\n\t\t\treturn fmt.Errorf(\"s3: sse-customer-algorithm must be AES256, got %q\", c.SSECustomerAlgorithm)\n\t\t}\n\n\t\t// Validate key is valid base64 and correct length (256 bits = 32 bytes)\n\t\tkeyBytes, err := base64.StdEncoding.DecodeString(c.SSECustomerKey)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"s3: sse-customer-key must be valid base64: %w\", err)\n\t\t}\n\t\tif len(keyBytes) != 32 {\n\t\t\treturn fmt.Errorf(\"s3: sse-customer-key must be 256-bit (32 bytes) when decoded, got %d bytes\", len(keyBytes))","sourceCodeStart":513,"sourceCodeEnd":549,"githubUrl":"https://github.com/benbjohnson/litestream/blob/4ed7a308f6271ebfd2b0a6e4b70b03011a37e4a3/s3/replica_client.go#L513-L549","documentation":"SSE validation guard in Init: both sse-customer-key (SSE-C) and sse-kms-key-id (SSE-KMS) were configured. S3 allows only one server-side encryption mode per object, so Litestream rejects the combination upfront rather than failing every request later.","triggerScenarios":"Thrown at s3/replica_client.go:531 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Keep only one encryption mode: SSE-C key or SSE-KMS key id"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4ed7a308f6271ebfd2b0a6e4b70b03011a37e4a3","analyzedAt":"2026-09-06T18:29:25.564Z","contentChangedAt":"2026-09-06T18:29:25.564Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}