{"record":{"id":"12dbc7b086a143c5","repo":"argoproj/argo-workflows","slug":"encryptopts-kmskeyid-and-encryptopts-ssecpassword","errorCode":null,"errorMessage":"EncryptOpts.KmsKeyId and EncryptOpts.SSECPassword cannot be set together","messagePattern":"EncryptOpts\\.KmsKeyId and EncryptOpts\\.SSECPassword cannot be set together","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"workflow/artifacts/s3/s3.go","lineNumber":525,"sourceCode":"\tswitch s3cli.AddressingStyle {\n\tcase PathStyle:\n\t\tbucketLookupType = minio.BucketLookupPath\n\tcase VirtualHostedStyle:\n\t\tbucketLookupType = minio.BucketLookupDNS\n\tdefault:\n\t\tbucketLookupType = minio.BucketLookupAuto\n\t}\n\tminioOpts := &minio.Options{Creds: credentials, Secure: s3cli.Secure, Transport: opts.Transport, Region: s3cli.Region, BucketLookup: bucketLookupType}\n\tminioClient, err = minio.New(s3cli.Endpoint, minioOpts)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif opts.Trace {\n\t\tminioClient.TraceOn(os.Stderr)\n\t}\n\n\tif opts.EncryptOpts.KmsKeyID != \"\" && opts.EncryptOpts.ServerSideCustomerKey != \"\" {\n\t\treturn nil, fmt.Errorf(\"EncryptOpts.KmsKeyId and EncryptOpts.SSECPassword cannot be set together\")\n\t}\n\n\tif opts.EncryptOpts.ServerSideCustomerKey != \"\" && !opts.Secure {\n\t\treturn nil, fmt.Errorf(\"secure must be set if EncryptOpts.SSECPassword is set\")\n\t}\n\n\ts3cli.ctx = ctx\n\ts3cli.minioClient = minioClient\n\n\treturn &s3cli, nil\n}\n\n// Gets number of threads for S3 upload from env var. Default if not set: 4.\nfunc (s *s3client) getFromEnvS3UploadNbThreads() int {\n\t// Minio default threads: https://github.com/minio/minio-go/blob/v7.0.98/constants.go#L58\n\tconst defaultThreads = 4\n\n\tnbThreadsStr := os.Getenv(common.EnvVarS3UploadThreads)","sourceCodeStart":507,"sourceCodeEnd":543,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/workflow/artifacts/s3/s3.go#L507-L543","documentation":"NewClient rejects S3 encryption options that specify both a KMS key ID (SSE-KMS) and an SSEC password (SSE-C), because an object cannot be encrypted with both mechanisms at once. This is a client-construction validation error and is not retriable.","triggerScenarios":"The artifact's S3 encryptionOptions set both kmsKeyId and ssecPassword (via artifact repository config or per-artifact encryptionOptions), then NewClient is invoked.","commonSituations":"Copying an example config that had one option and adding the other; templating both fields from values files where both secrets happen to be populated; merging operator and user config each contributing a different option.","solutions":["Remove either kmsKeyId or ssecPassword from encryptionOptions, keeping only the mechanism you want","If you need SSE-KMS, delete the ssecPassword/encryptionKey setting; if SSE-C, drop kmsKeyId and kmsEncryptionContext","Re-check rendered controller ConfigMap / artifact spec to confirm only one option remains"],"exampleFix":"// before\nencryptionOptions:\n  kmsKeyId: alias/aws/s3\n  ssecPasswordSecret: {name: my-secret, key: password}\n// after\nencryptionOptions:\n  kmsKeyId: alias/aws/s3","handlingStrategy":"validation","validationCode":"func validateEncOpts(o s3.EncryptOpts) error {\n  if o.KmsKeyID != \"\" && o.ServerSideCustomerKey != \"\" {\n    return errors.New(\"set only one of kmsKeyId or ssecPassword\")\n  }\n  return nil\n}","typeGuard":"func hasConflictingEncOpts(o s3.EncryptOpts) bool {\n  return o.KmsKeyID != \"\" && o.ServerSideCustomerKey != \"\"\n}","tryCatchPattern":"if _, err := s3.NewClient(ctx, opts); err != nil && strings.Contains(err.Error(), \"cannot be set together\") {\n  // strip one of the encryption options and rebuild\n}","preventionTips":["Keep only one encryption mechanism in encryptionOptions","Lint rendered controller ConfigMap for stray kms/ssec fields","Document which mechanism your org uses and template accordingly"],"tags":["s3","encryption","configuration","validation"],"backgroundTag":"conflicting-encryption-options","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}