{"record":{"id":"63ec00ba8ec34eaa","repo":"getsops/sops","slug":"failed-to-encrypt-sops-data-key-with-huaweicloud-k","errorCode":null,"errorMessage":"failed to encrypt sops data key with HuaweiCloud KMS: %w","messagePattern":"failed to encrypt sops data key with HuaweiCloud KMS: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"hckms/keysource.go","lineNumber":163,"sourceCode":"\t\tlog.WithField(\"keyID\", key.KeyID).Info(\"Encryption failed\")\n\t\treturn fmt.Errorf(\"failed to create HuaweiCloud KMS client: %w\", err)\n\t}\n\n\tplaintext := base64.StdEncoding.EncodeToString(dataKey)\n\tencryptAlgorithm := model.GetEncryptDataRequestBodyEncryptionAlgorithmEnum().SYMMETRIC_DEFAULT\n\n\trequest := &model.EncryptDataRequest{\n\t\tBody: &model.EncryptDataRequestBody{\n\t\t\tKeyId:               key.KeyUUID,\n\t\t\tPlainText:           plaintext,\n\t\t\tEncryptionAlgorithm: &encryptAlgorithm,\n\t\t},\n\t}\n\n\tresponse, err := client.EncryptData(request)\n\tif err != nil {\n\t\tlog.WithField(\"keyID\", key.KeyID).Info(\"Encryption failed\")\n\t\treturn fmt.Errorf(\"failed to encrypt sops data key with HuaweiCloud KMS: %w\", err)\n\t}\n\n\tif response.CipherText == nil {\n\t\treturn fmt.Errorf(\"encryption response missing ciphertext\")\n\t}\n\tkey.EncryptedKey = *response.CipherText\n\tlog.WithField(\"keyID\", key.KeyID).Info(\"Encryption succeeded\")\n\treturn nil\n}\n\n// EncryptIfNeeded encrypts the provided SOPS data key, if it has not been\n// encrypted yet.\nfunc (key *MasterKey) EncryptIfNeeded(dataKey []byte) error {\n\tif key.EncryptedKey == \"\" {\n\t\treturn key.Encrypt(dataKey)\n\t}\n\treturn nil\n}","sourceCodeStart":145,"sourceCodeEnd":181,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/hckms/keysource.go#L145-L181","documentation":"SOPS calls HuaweiCloud KMS EncryptData to wrap the file's data key with the master key identified by KeyUUID. When the KMS API returns any error response, EncryptContext (hckms/keysource.go:163) wraps it with this message via %w. The underlying SDK error carries the real cause (auth failure, bad key ID, throttling, network).","triggerScenarios":"Calling MasterKey.Encrypt or EncryptContext on an hckms.MasterKey when client.EncryptData returns a non-nil error — e.g. invalid KeyUUID, denied IAM permission (kms:crypto:encrypt), expired credentials, unreachable KMS endpoint, or request throttling.","commonSituations":"Key was deleted or exists in a different region than the one in the 'region:key-uuid' sops key entry; IAM user lacks KMS encrypt permission; HuaweiCloud SDK credentials expired; transient network/API outage during `sops -e` or `sops rotate -i`.","solutions":["Read the wrapped SDK error (%v of the cause) to get the HuaweiCloud API error code and message","Verify the key UUID in the sops config entry exists and is enabled in the region given by the 'region:key-uuid' KeyID","Check IAM permissions for kms:crypto:encrypt (or the KMS CMK's key policy) on the principal whose credentials are used","Re-authenticate (env vars HC_ACCESS_KEY/HC_SECRET_KEY or profile) and retry; enable request-level logging to see the HTTP response"],"exampleFix":"// before: key UUID from another region, API returns 404\nk, _ := hckms.NewMasterKey(\"tr-west-1:00000000-0000-0000-0000-000000000000\")\n// after: use a key UUID that exists and is enabled in that region\nk, _ := hckms.NewMasterKey(\"tr-west-1:real-key-uuid-from-huaweicloud-console\")","handlingStrategy":"try-catch","validationCode":"// Go: verify key material exists before encrypting\nif key.KeyUUID == \"\" || key.Region == \"\" {\n    return fmt.Errorf(\"hckms key %q lacks region/key-uuid; cannot encrypt\", key.KeyID)\n}","typeGuard":null,"tryCatchPattern":"if err := key.EncryptContext(ctx, dataKey); err != nil {\n    var respErr error\n    if errors.As(err, &respErr) { /* unwrap %w chain for the HuaweiCloud API error code */ }\n    log.Errorf(\"HCKMS encrypt failed for %s: %v\", key.KeyID, err)\n    return err\n}","preventionTips":["Validate the region:key-uuid exists and is enabled in the HuaweiCloud console before committing it to .sops.yaml","Grant kms:crypto:encrypt to the CI/service principal on the CMK","Wrap encrypt calls with bounded retries for transient 5xx/network errors","Keep huaweicloud-sdk-go-v3 up to date"],"tags":["huaweicloud","kms","encryption","cloud"],"backgroundTag":"kms-encrypt-api-error","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}