{"record":{"id":"5f5cc0518d8d9fe1","repo":"gravitational/teleport","slug":"gcp-kms-support-requires-a-license-with-the-hsm-fe","errorCode":null,"errorMessage":"GCP KMS support requires a license with the HSM feature enabled: %w","messagePattern":"GCP KMS support requires a license with the HSM feature enabled: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"lib/auth/auth.go","lineNumber":290,"sourceCode":"\t\t\treturn nil, trace.Wrap(err)\n\t\t}\n\t\tcfg.ClusterConfiguration = clusterConfig\n\t}\n\tif cfg.KeyStore == nil {\n\t\tkeystoreOpts := &keystore.Options{\n\t\t\tHostUUID:             cfg.HostUUID,\n\t\t\tClusterName:          cfg.ClusterName,\n\t\t\tAuthPreferenceGetter: cfg.ClusterConfiguration,\n\t\t\tFIPS:                 cfg.FIPS,\n\t\t\tClock:                cfg.Clock,\n\t\t}\n\t\tif cfg.KeyStoreConfig.PKCS11 != (servicecfg.PKCS11Config{}) {\n\t\t\tif !cfg.Modules.Features().GetEntitlement(entitlements.HSM).Enabled {\n\t\t\t\treturn nil, fmt.Errorf(\"PKCS11 HSM support requires a license with the HSM feature enabled: %w\", ErrRequiresEnterprise)\n\t\t\t}\n\t\t} else if cfg.KeyStoreConfig.GCPKMS != (servicecfg.GCPKMSConfig{}) {\n\t\t\tif !cfg.Modules.Features().GetEntitlement(entitlements.HSM).Enabled {\n\t\t\t\treturn nil, fmt.Errorf(\"GCP KMS support requires a license with the HSM feature enabled: %w\", ErrRequiresEnterprise)\n\t\t\t}\n\t\t} else if cfg.KeyStoreConfig.AWSKMS != nil {\n\t\t\tif !cfg.Modules.Features().GetEntitlement(entitlements.HSM).Enabled {\n\t\t\t\treturn nil, fmt.Errorf(\"AWS KMS support requires a license with the HSM feature enabled: %w\", ErrRequiresEnterprise)\n\t\t\t}\n\t\t}\n\t\tcfg.KeyStore, err = keystore.NewManager(context.Background(), &cfg.KeyStoreConfig, keystoreOpts)\n\t\tif err != nil {\n\t\t\treturn nil, trace.Wrap(err)\n\t\t}\n\t}\n\tif cfg.RecordingEncryption == nil {\n\t\tlocalRecordingEncryption, err := local.NewRecordingEncryptionService(cfg.Backend)\n\t\tif err != nil {\n\t\t\treturn nil, trace.Wrap(err)\n\t\t}\n\n\t\trecordingEncryptionManager, err := recordingencryption.NewManager(closeCtx, recordingencryption.ManagerConfig{","sourceCodeStart":272,"sourceCodeEnd":308,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/auth/auth.go#L272-L308","documentation":"Same HSM-entitlement gate as PKCS11, applied to the GCP KMS key store: NewServer rejects startup when cfg.KeyStoreConfig.GCPKMS is configured but the license's HSM entitlement is disabled. Teleport treats cloud KMS-backed CA keys as an HSM-class Enterprise feature, wrapping ErrRequiresEnterprise.","triggerScenarios":"Configuring key_store with GCP KMS (keyring/key names under gcp_kms) and starting the auth server on a build/license without the HSM entitlement enabled.","commonSituations":"Migrating config from an Enterprise HSM-enabled cluster to one licensed without HSM; forgetting to upload the new license after enabling GCP KMS; OSS binaries picking up Enterprise config files.","solutions":["Install/refresh an Enterprise license that includes the HSM entitlement, then restart.","Remove the gcp_kms block from key_store config to fall back to the software key store.","Confirm cfg.Modules reflects the Enterprise build (Features().GetEntitlement(entitlements.HSM).Enabled) via diagnostics before configuring GCP KMS."],"exampleFix":"// before (auth_service config)\nkey_store: { gcp_kms: { keyring: teleport, key: ca } }\n// after\nkey_store: {} // until an HSM-entitled Enterprise license is loaded","handlingStrategy":"validation","validationCode":"if cfg.KeyStoreConfig.GCPKMS != (servicecfg.GCPKMSConfig{}) &&\n\t!cfg.Modules.Features().GetEntitlement(entitlements.HSM).Enabled {\n\treturn errors.New(\"GCP KMS key store configured but license lacks HSM entitlement\")\n}","typeGuard":null,"tryCatchPattern":"srv, err := auth.NewServer(...)\nif err != nil {\n\tif strings.Contains(err.Error(), \"GCP KMS support requires a license\") {\n\t\t// remove gcp_kms config or load HSM-entitled license, then restart\n\t}\n}","preventionTips":["Gate GCP KMS config rollouts on license entitlement checks in CI/deploy scripts.","Monitor license expiry so entitlements don't silently disappear.","Use separate config files for OSS and Enterprise clusters."],"tags":["licensing","hsm","gcp-kms","startup"],"backgroundTag":"enterprise-feature-license-required","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}