{"record":{"id":"635a83f11325b258","repo":"argoproj/argo-workflows","slug":"serversidecustomerkeysecret-and-kmskeyid-cannot-be","errorCode":null,"errorMessage":"serverSideCustomerKeySecret and kmsKeyId cannot be set together","messagePattern":"serverSideCustomerKeySecret and kmsKeyId cannot be set together","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"workflow/artifacts/artifacts.go","lineNumber":72,"sourceCode":"\t\t\tsecretKeyBytes, err := ri.GetSecret(ctx, art.S3.SecretKeySecret.Name, art.S3.SecretKeySecret.Key)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t\tsecretKey = secretKeyBytes\n\n\t\t\tif art.S3.SessionTokenSecret != nil && art.S3.SessionTokenSecret.Name != \"\" {\n\t\t\t\tsessionTokenBytes, err := ri.GetSecret(ctx, art.S3.SessionTokenSecret.Name, art.S3.SessionTokenSecret.Key)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn nil, err\n\t\t\t\t}\n\t\t\t\tsessionToken = sessionTokenBytes\n\t\t\t}\n\t\t}\n\n\t\tif art.S3.EncryptionOptions != nil {\n\t\t\tif art.S3.EncryptionOptions.ServerSideCustomerKeySecret != nil {\n\t\t\t\tif art.S3.EncryptionOptions.KmsKeyId != \"\" {\n\t\t\t\t\treturn nil, fmt.Errorf(\"serverSideCustomerKeySecret and kmsKeyId cannot be set together\")\n\t\t\t\t}\n\n\t\t\t\tserverSideCustomerKeyBytes, err := ri.GetSecret(ctx, art.S3.EncryptionOptions.ServerSideCustomerKeySecret.Name, art.S3.EncryptionOptions.ServerSideCustomerKeySecret.Key)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn nil, err\n\t\t\t\t}\n\t\t\t\tserverSideCustomerKey = serverSideCustomerKeyBytes\n\t\t\t}\n\n\t\t\tenableEncryption = art.S3.EncryptionOptions.EnableEncryption\n\t\t\tkmsKeyID = art.S3.EncryptionOptions.KmsKeyId\n\t\t\tkmsEncryptionContext = art.S3.EncryptionOptions.KmsEncryptionContext\n\t\t}\n\n\t\tif art.S3.CASecret != nil && art.S3.CASecret.Name != \"\" {\n\t\t\tcaBytes, err := ri.GetSecret(ctx, art.S3.CASecret.Name, art.S3.CASecret.Key)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/workflow/artifacts/artifacts.go#L54-L90","documentation":"newDriver validates S3 EncryptionOptions and rejects artifacts that specify both a ServerSideCustomerKeySecret (SSE-C) and a KmsKeyId (SSE-KMS), since AWS S3 allows only one server-side encryption mechanism per request.","triggerScenarios":"An S3 artifact whose encryptionOptions contains both serverSideCustomerKeySecret and a non-empty kmsKeyId; raised synchronously inside newDriver before any S3 call is made.","commonSituations":"Merging encryption settings from a corporate artifact-repository configmap (KMS key) with per-workflow artifact overrides (customer key); copy-pasting example YAML that included both fields.","solutions":["Remove kmsKeyId from encryptionOptions and keep serverSideCustomerKeySecret if you must use SSE-C.","Remove serverSideCustomerKeySecret and keep kmsKeyId for SSE-KMS.","Make the choice configurable at the config level and only pass one field from workflow templates."],"exampleFix":"// before\ns3:\n  encryptionOptions:\n    kmsKeyId: arn:aws:kms:us-east-1:123:key/abc\n    serverSideCustomerKeySecret:\n      name: my-secret\n      key: sse-key\n// after\ns3:\n  encryptionOptions:\n    kmsKeyId: arn:aws:kms:us-east-1:123:key/abc","handlingStrategy":"validation","validationCode":"func validateS3Encryption(art *wfv1.Artifact) error {\n\tif art.S3 != nil && art.S3.EncryptionOptions != nil &&\n\t\tart.S3.EncryptionOptions.ServerSideCustomerKeySecret != nil &&\n\t\tart.S3.EncryptionOptions.KmsKeyId != \"\" {\n\t\treturn fmt.Errorf(\"set either serverSideCustomerKeySecret or kmsKeyId, not both\")\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"if err := validateS3Encryption(art); err != nil { return err }\ndriver, err := artifacts.NewDriver(ctx, art, ri)\nif err != nil { return fmt.Errorf(\"s3 artifact %s: %w\", art.Name, err) }","preventionTips":["Choose one SSE strategy (KMS or SSE-C) org-wide and encode it in templates.","Avoid merging encryptionOptions from multiple config sources without dropping one field.","Add the mutual-exclusion check to your workflow linting pipeline."],"tags":["s3","configuration","encryption"],"backgroundTag":"conflicting-config-options","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}