{"record":{"id":"402937ffbd2396e1","repo":"FuelLabs/fuels-rs","slug":"key-arn-missing-from-response","errorCode":null,"errorMessage":"key arn missing from response","messagePattern":"key arn missing from response","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"e2e/src/aws_kms.rs","lineNumber":143,"sourceCode":"    _container: testcontainers::ContainerAsync<AwsKmsImage>,\n    client: Client,\n    url: String,\n}\n\nimpl AwsKmsProcess {\n    pub async fn create_signer(&self) -> anyhow::Result<AwsKmsSigner> {\n        let response = self\n            .client\n            .create_key()\n            .key_usage(KeyUsageType::SignVerify)\n            .key_spec(KeySpec::EccSecgP256K1)\n            .send()\n            .await?;\n\n        let id = response\n            .key_metadata\n            .and_then(|metadata| metadata.arn)\n            .ok_or_else(|| anyhow::anyhow!(\"key arn missing from response\"))?;\n\n        let kms_signer = AwsKmsSigner::new(id.clone(), &self.client).await?;\n\n        Ok(kms_signer)\n    }\n\n    pub fn client(&self) -> &Client {\n        &self.client\n    }\n\n    pub fn url(&self) -> &str {\n        &self.url\n    }\n}\n","sourceCodeStart":125,"sourceCodeEnd":158,"githubUrl":"https://github.com/FuelLabs/fuels-rs/blob/d9a250a51818dda64bfeb5ef7cc19cf27bdcd623/e2e/src/aws_kms.rs#L125-L158","documentation":"Thrown in AwsKmsClient::create_signer (e2e KMS harness) when the AWS SDK CreateKey call succeeds but the returned KeyMetadata carries no ARN. The signer cannot be constructed because the key ARN is the identifier used for all subsequent signing requests.","triggerScenarios":"create_key() with KeyUsageType::SignVerify and KeySpec::EccSecgP256K1 returns a response whose key_metadata is None or whose arn field is None — typically against a KMS-compatible test endpoint (LocalStack/mock server, given the client carries a custom url) that does not populate KeyMetadata.arn, or an IAM/permission quirk returning a stripped response.","commonSituations":"Running the e2e AWS KMS tests against LocalStack or an in-process mock whose CreateKey implementation omits the ARN; version drift between the AWS SDK in use and the emulator's response shape; extremely rare against real AWS.","solutions":["If using LocalStack/mock: update it to a version whose CreateKey response includes a full KeyMetadata.arn, or patch the mock to return the ARN.","Against real AWS, verify the credentials/region and retry; capture the raw CreateKey response to confirm whether metadata is being dropped.","Update the aws-sdk-kms crate version in Cargo.toml if a serialization bug is suspected.","As a workaround in tests, construct AwsKmsSigner::new directly with a known existing key ARN instead of creating a fresh key."],"exampleFix":"// before: relies on create_key response containing the ARN\nlet signer = client.create_signer().await?;\n// after (workaround): import a pre-created key and skip create_key\nlet arn = std::env::var(\"TEST_KMS_KEY_ARN\").expect(\"set TEST_KMS_KEY_ARN\");\nlet signer = AwsKmsSigner::new(arn, client.client()).await?;","handlingStrategy":"validation","validationCode":"let resp = client.create_key().key_usage(KeyUsageType::SignVerify).key_spec(KeySpec::EccSecgP256K1).send().await?;\nif resp.key_metadata.as_ref().and_then(|m| m.arn.as_ref()).is_none() {\n    anyhow::bail!(\"endpoint did not return a key ARN — is a LocalStack/mock KMS missing KeyMetadata.arn?\");\n}","typeGuard":null,"tryCatchPattern":"match client.create_signer().await {\n    Err(e) if e.to_string().contains(\"key arn missing\") => {\n        // fall back to importing a pre-provisioned key ARN from the environment\n        let arn = std::env::var(\"TEST_KMS_KEY_ARN\")?;\n        AwsKmsSigner::new(arn, client.client()).await\n    }\n    other => other,\n}","preventionTips":["Run KMS e2e tests against LocalStack versions known to populate KeyMetadata.arn on CreateKey.","Keep a pre-created ECC key's ARN in TEST_KMS_KEY_ARN as an import fallback for tests.","Smoke-test create_key round-trips after any aws-sdk-kms or LocalStack version bump."],"tags":["aws","kms","e2e","localstack","signer"],"backgroundTag":null,"analyzedSha":"d9a250a51818dda64bfeb5ef7cc19cf27bdcd623","analyzedAt":"2026-08-16T09:49:30.618Z","schemaVersion":2},"datasetVersion":"2026-08-16T13:17:31.715Z"}