{"record":{"id":"37fb547422c4c2d9","repo":"getsops/sops","slug":"failed-to-decrypt-sops-data-key-with-huaweicloud-k","errorCode":null,"errorMessage":"failed to decrypt sops data key with HuaweiCloud KMS: %w","messagePattern":"failed to decrypt sops data key with HuaweiCloud KMS: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"hckms/keysource.go","lineNumber":221,"sourceCode":"\tif err != nil {\n\t\tlog.WithField(\"keyID\", key.KeyID).Info(\"Decryption failed\")\n\t\treturn nil, fmt.Errorf(\"failed to create HuaweiCloud KMS client: %w\", err)\n\t}\n\n\tdecryptAlgorithm := model.GetDecryptDataRequestBodyEncryptionAlgorithmEnum().SYMMETRIC_DEFAULT\n\n\trequest := &model.DecryptDataRequest{\n\t\tBody: &model.DecryptDataRequestBody{\n\t\t\tCipherText:          key.EncryptedKey,\n\t\t\tEncryptionAlgorithm: &decryptAlgorithm,\n\t\t\tKeyId:               &key.KeyUUID,\n\t\t},\n\t}\n\n\tresponse, err := client.DecryptData(request)\n\tif err != nil {\n\t\tlog.WithField(\"keyID\", key.KeyID).Info(\"Decryption failed\")\n\t\treturn nil, fmt.Errorf(\"failed to decrypt sops data key with HuaweiCloud KMS: %w\", err)\n\t}\n\n\tif response.PlainText == nil {\n\t\treturn nil, fmt.Errorf(\"decryption response missing plaintext\")\n\t}\n\tdecrypted, err := base64.StdEncoding.DecodeString(*response.PlainText)\n\tif err != nil {\n\t\tlog.WithField(\"keyID\", key.KeyID).Info(\"Decryption failed\")\n\t\treturn nil, fmt.Errorf(\"failed to base64 decode decrypted data key: %w\", err)\n\t}\n\n\tlog.WithField(\"keyID\", key.KeyID).Info(\"Decryption succeeded\")\n\treturn decrypted, nil\n}\n\n// NeedsRotation returns whether the data key needs to be rotated or not.\nfunc (key *MasterKey) NeedsRotation() bool {\n\treturn time.Since(key.CreationDate) > hckmsTTL","sourceCodeStart":203,"sourceCodeEnd":239,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/hckms/keysource.go#L203-L239","documentation":"SOPS calls HuaweiCloud KMS DecryptData to unwrap the stored EncryptedKey using the key in KeyUUID. Any error returned by the API is wrapped with this message in DecryptContext (hckms/keysource.go:221); the wrapped SDK error holds the real API-level cause.","triggerScenarios":"client.DecryptData returns non-nil error during Decrypt/DecryptContext — wrong KeyUUID, key disabled/deleted, IAM lacking kms:crypto:decrypt, ciphertext truncated or tampered in the file's sops metadata, or network/auth failure.","commonSituations":"File edited by hand so the 'enc' ciphertext field got mangled; KMS key disabled or scheduled for deletion; region mismatch between stored key and actual key; credentials rotated and IAM policy no longer grants decrypt; `sops -d` of a file shared from another account without cross-account key grants.","solutions":["Inspect the wrapped SDK error for the HuaweiCloud error code (e.g. KMS.0104 invalid ciphertext, 403 auth)","Confirm the KeyUUID in the file metadata still exists, is enabled, and matches the region in the KeyID","Grant kms:crypto:decrypt on the CMK to the principal whose credentials are in use","Restore the original 'enc' value from git history if the ciphertext was manually modified","Retry on transient network errors; re-authenticate if credentials expired"],"exampleFix":"// before: ciphertext field manually edited in the file\nenc: AEADB4Ab<manually-tampered>\n// after: restore from version control\n$ git checkout -- secrets.yaml","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"dataKey, err := key.DecryptContext(ctx)\nif err != nil {\n    if strings.Contains(err.Error(), \"failed to decrypt sops data key with HuaweiCloud KMS\") {\n        // inspect wrapped SDK error code: auth vs invalid ciphertext vs key state\n    }\n    return err\n}","preventionTips":["Never hand-edit the 'enc' field in sops files; recover from git if damaged","Grant kms:crypto:decrypt on the CMK to all principals that need decryption","Alert on key disabled/scheduled-deletion states in the KMS console","Keep key region and KeyUUID consistent with the region:key-uuid entry"],"tags":["huaweicloud","kms","decryption","cloud"],"backgroundTag":"kms-decrypt-api-error","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}