{"record":{"id":"69e446252f5abf66","repo":"getsops/sops","slug":"failed-to-encrypt-sops-data-key-with-aws-kms-w","errorCode":null,"errorMessage":"failed to encrypt sops data key with AWS KMS: %w","messagePattern":"failed to encrypt sops data key with AWS KMS: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kms/keysource.go","lineNumber":283,"sourceCode":"\n// EncryptContext takes a SOPS data key, encrypts it with KMS and stores the result\n// in the EncryptedKey field.\nfunc (key *MasterKey) EncryptContext(ctx context.Context, dataKey []byte) error {\n\tcfg, err := key.createKMSConfig(ctx)\n\tif err != nil {\n\t\tlog.WithField(\"arn\", key.Arn).Info(\"Encryption failed\")\n\t\treturn err\n\t}\n\tclient := key.createClient(cfg)\n\tinput := &kms.EncryptInput{\n\t\tKeyId:             &key.Arn,\n\t\tPlaintext:         dataKey,\n\t\tEncryptionContext: stringPointerToStringMap(key.EncryptionContext),\n\t}\n\tout, err := client.Encrypt(ctx, input)\n\tif err != nil {\n\t\tlog.WithField(\"arn\", key.Arn).Info(\"Encryption failed\")\n\t\treturn fmt.Errorf(\"failed to encrypt sops data key with AWS KMS: %w\", err)\n\t}\n\tkey.EncryptedKey = base64.StdEncoding.EncodeToString(out.CiphertextBlob)\n\tlog.WithField(\"arn\", key.Arn).Info(\"Encryption succeeded\")\n\treturn nil\n}\n\n// EncryptIfNeeded encrypts the provided SOPS data key, if it has not been\n// encrypted yet.\nfunc (key *MasterKey) EncryptIfNeeded(dataKey []byte) error {\n\tif key.EncryptedKey == \"\" {\n\t\treturn key.Encrypt(dataKey)\n\t}\n\treturn nil\n}\n\n// EncryptedDataKey returns the encrypted data key this master key holds.\nfunc (key *MasterKey) EncryptedDataKey() []byte {\n\treturn []byte(key.EncryptedKey)","sourceCodeStart":265,"sourceCodeEnd":301,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/kms/keysource.go#L265-L301","documentation":"Error \"failed to encrypt sops data key with AWS KMS: %w\" thrown in getsops/sops.","triggerScenarios":"Thrown at kms/keysource.go:283 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}