{"record":{"id":"15283a79a876ef2b","repo":"gravitational/teleport","slug":"aws-kms-support-requires-a-license-with-the-hsm-fe","errorCode":null,"errorMessage":"AWS KMS support requires a license with the HSM feature enabled: %w","messagePattern":"AWS KMS support requires a license with the HSM feature enabled: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"lib/auth/auth.go","lineNumber":294,"sourceCode":"\tif cfg.KeyStore == nil {\n\t\tkeystoreOpts := &keystore.Options{\n\t\t\tHostUUID:             cfg.HostUUID,\n\t\t\tClusterName:          cfg.ClusterName,\n\t\t\tAuthPreferenceGetter: cfg.ClusterConfiguration,\n\t\t\tFIPS:                 cfg.FIPS,\n\t\t\tClock:                cfg.Clock,\n\t\t}\n\t\tif cfg.KeyStoreConfig.PKCS11 != (servicecfg.PKCS11Config{}) {\n\t\t\tif !cfg.Modules.Features().GetEntitlement(entitlements.HSM).Enabled {\n\t\t\t\treturn nil, fmt.Errorf(\"PKCS11 HSM support requires a license with the HSM feature enabled: %w\", ErrRequiresEnterprise)\n\t\t\t}\n\t\t} else if cfg.KeyStoreConfig.GCPKMS != (servicecfg.GCPKMSConfig{}) {\n\t\t\tif !cfg.Modules.Features().GetEntitlement(entitlements.HSM).Enabled {\n\t\t\t\treturn nil, fmt.Errorf(\"GCP KMS support requires a license with the HSM feature enabled: %w\", ErrRequiresEnterprise)\n\t\t\t}\n\t\t} else if cfg.KeyStoreConfig.AWSKMS != nil {\n\t\t\tif !cfg.Modules.Features().GetEntitlement(entitlements.HSM).Enabled {\n\t\t\t\treturn nil, fmt.Errorf(\"AWS KMS support requires a license with the HSM feature enabled: %w\", ErrRequiresEnterprise)\n\t\t\t}\n\t\t}\n\t\tcfg.KeyStore, err = keystore.NewManager(context.Background(), &cfg.KeyStoreConfig, keystoreOpts)\n\t\tif err != nil {\n\t\t\treturn nil, trace.Wrap(err)\n\t\t}\n\t}\n\tif cfg.RecordingEncryption == nil {\n\t\tlocalRecordingEncryption, err := local.NewRecordingEncryptionService(cfg.Backend)\n\t\tif err != nil {\n\t\t\treturn nil, trace.Wrap(err)\n\t\t}\n\n\t\trecordingEncryptionManager, err := recordingencryption.NewManager(closeCtx, recordingencryption.ManagerConfig{\n\t\t\tBackend:                       localRecordingEncryption,\n\t\t\tCache:                         localRecordingEncryption,\n\t\t\tClusterConfig:                 cfg.ClusterConfiguration,\n\t\t\tKeyStore:                      cfg.KeyStore,","sourceCodeStart":276,"sourceCodeEnd":312,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/auth/auth.go#L276-L312","documentation":"The third branch of the same startup gate: when cfg.KeyStoreConfig.AWSKMS is set, NewServer requires the HSM entitlement. AWS KMS-backed CA keys are Enterprise-only; without the entitlement the auth server refuses to start, wrapping ErrRequiresEnterprise.","triggerScenarios":"Starting the auth service with an AWS KMS key store configured (aws_kms section with key IDs/ARNs) while Features().GetEntitlement(entitlements.HSM).Enabled is false on the loaded license.","commonSituations":"Copying an Enterprise HA config (AWS KMS CA keys) into an OSS or non-HSM-licensed cluster; license expiry causing entitlements to reset; region/account mismatch causing the license loader to skip the file.","solutions":["Load an Enterprise license with the HSM entitlement enabled before enabling AWS KMS.","Remove the aws_kms block from key_store configuration if KMS-backed keys are not licensed.","Check the auth server logs for license-loading messages to confirm which entitlements the loaded license grants."],"exampleFix":"// before (auth_service config)\nkey_store: { aws_kms: { aws_key_id_list: [\"arn:aws:kms:...\"] } }\n// after\nkey_store: {} // or obtain HSM-entitled Enterprise license and keep the config","handlingStrategy":"validation","validationCode":"if cfg.KeyStoreConfig.AWSKMS != nil &&\n\t!cfg.Modules.Features().GetEntitlement(entitlements.HSM).Enabled {\n\treturn errors.New(\"AWS KMS key store configured but license lacks HSM entitlement\")\n}","typeGuard":null,"tryCatchPattern":"srv, err := auth.NewServer(...)\nif err != nil {\n\tif strings.Contains(err.Error(), \"AWS KMS support requires a license\") {\n\t\t// strip aws_kms from key_store or upgrade to HSM-entitled Enterprise license\n\t}\n}","preventionTips":["Verify HSM entitlement with a dry-run feature check before enabling aws_kms.","Alert on license expiry ahead of time in Enterprise deployments.","Document that all KMS/HSM key stores (PKCS11, GCP KMS, AWS KMS) require the same entitlement."],"tags":["licensing","hsm","aws-kms","startup"],"backgroundTag":"enterprise-feature-license-required","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}