{"record":{"id":"2f929415610d30b7","repo":"getsops/sops","slug":"cannot-create-gcp-kms-service-w","errorCode":null,"errorMessage":"cannot create GCP KMS service: %w","messagePattern":"cannot create GCP KMS service: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"gcpkms/keysource.go","lineNumber":174,"sourceCode":"func (c ClientOptions) ApplyToMasterKey(key *MasterKey) {\n\tkey.clientOpts = c\n}\n\n// Encrypt takes a SOPS data key, encrypts it with GCP KMS, and stores the\n// result in the EncryptedKey field.\n//\n// Consider using EncryptContext instead.\nfunc (key *MasterKey) Encrypt(dataKey []byte) error {\n\treturn key.EncryptContext(context.Background(), dataKey)\n}\n\n// EncryptContext takes a SOPS data key, encrypts it with GCP KMS, and stores the\n// result in the EncryptedKey field.\nfunc (key *MasterKey) EncryptContext(ctx context.Context, dataKey []byte) error {\n\tservice, err := key.newKMSClient(ctx)\n\tif err != nil {\n\t\tlog.WithField(\"resourceID\", key.ResourceID).Info(\"Encryption failed\")\n\t\treturn fmt.Errorf(\"cannot create GCP KMS service: %w\", err)\n\t}\n\tdefer func() {\n\t\tif err := service.Close(); err != nil {\n\t\t\tlog.Error(\"failed to close GCP KMS client connection\")\n\t\t}\n\t}()\n\n\treq := &kmspb.EncryptRequest{\n\t\tName:      key.ResourceID,\n\t\tPlaintext: dataKey,\n\t}\n\tresp, err := service.Encrypt(ctx, req)\n\tif err != nil {\n\t\tlog.WithField(\"resourceID\", key.ResourceID).Info(\"Encryption failed\")\n\t\treturn fmt.Errorf(\"failed to encrypt sops data key with GCP KMS key: %w\", err)\n\t}\n\t// NB: base64 encoding is for compatibility with SOPS <=3.8.x.\n\t// The previous GCP KMS client used to work with base64 encoded","sourceCodeStart":156,"sourceCodeEnd":192,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/gcpkms/keysource.go#L156-L192","documentation":"SOPS wraps any error returned while constructing the Google Cloud KMS client during encryption. It is not a key permission problem; it means the client object itself could not be built (bad credentials, bad options, bad endpoint/universe domain, or an invalid resource ID surfaced early). The wrapped error (%w) holds the real cause.","triggerScenarios":"Calling MasterKey.EncryptContext (sops/gcpkms) when key.newKMSClient fails: getGoogleCredentials returns nothing usable and ADC fails, invalid credentialJSON, or the ResourceID fails the projects/.../cryptoKeys/... regex check.","commonSituations":"GOOGLE_APPLICATION_CREDENTIALS pointing to a missing/invalid JSON file; running in an environment without Application Default Credentials (laptop, CI without Workload Identity); SOPS_GCP_CREDENTIALS set to malformed JSON; mistyped resource path like missing keyRings segment.","solutions":["Inspect the wrapped error and fix credentials: set GOOGLE_APPLICATION_CREDENTIALS to a valid service-account JSON or use Workload Identity/ADC.","If using SOPS_GCP_CREDENTIALS (SopsGoogleCredentialsEnv), validate it is well-formed service-account JSON.","Verify key.ResourceID matches projects/PROJECT/locations/LOC/keyRings/RING/cryptoKeys/KEY exactly.","If using custom endpoint/universe domain env vars, confirm they point at a reachable, valid KMS endpoint."],"exampleFix":"// before: client built with no credentials available\nexport SOPS_GCP_CREDENTIALS=\"\"\n// after\nexport GOOGLE_APPLICATION_CREDENTIALS=/path/to/sa-key.json  # or rely on ADC/Workload Identity","handlingStrategy":"try-catch","validationCode":"if os.Getenv(\"GOOGLE_APPLICATION_CREDENTIALS\") == \"\" {\n    if _, err := os.Stat(\"/path/to/sa.json\"); err != nil {\n        t.Fatal(\"no GCP credentials available\")\n    }\n}\nre := regexp.MustCompile(`^projects/[^/]+/locations/[^/]+/keyRings/[^/]+/cryptoKeys/[^/]+$`)\nif !re.MatchString(key.ResourceID) { /* fix ResourceID first */ }","typeGuard":"null","tryCatchPattern":"if err := key.EncryptContext(ctx, dataKey); err != nil {\n    if strings.Contains(err.Error(), \"cannot create GCP KMS service\") {\n        // inspect wrapped cause: fix credentials/ADC before retrying\n    }\n    return err\n}","preventionTips":["Always configure GOOGLE_APPLICATION_CREDENTIALS or Workload Identity before running sops in CI.","Validate ResourceID against the canonical cryptoKey regex in .sops.yaml review.","Smoke-test credentials with `gcloud kms keys list` before encryption."],"tags":["gcp","kms","credentials","encryption"],"backgroundTag":"kms-client-creation-failed","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}