{"record":{"id":"78ce2e8ca277040c","repo":"hashicorp/nomad","slug":"failed-to-encrypt-root-key-w","errorCode":null,"errorMessage":"failed to encrypt root key: %w","messagePattern":"failed to encrypt root key: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/encrypter.go","lineNumber":875,"sourceCode":"\tif provider == nil {\n\t\tpanic(\"can't encrypt DEK without a provider\")\n\t}\n\tvar kek []byte\n\tvar err error\n\tif provider.Provider == structs.KEKProviderAEAD || provider.Provider == \"\" {\n\t\tkek, err = crypto.Bytes(32)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to generate key wrapper key: %w\", err)\n\t\t}\n\t}\n\twrapper, err := e.newKMSWrapper(provider, rootKey.Meta.KeyID, kek)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to create key wrapper: %w\", err)\n\t}\n\n\trootBlob, err := wrapper.Encrypt(e.srv.shutdownCtx, rootKey.Key)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to encrypt root key: %w\", err)\n\t}\n\n\tkekWrapper := &structs.WrappedKey{\n\t\tProvider:                 provider.Provider.String(),\n\t\tProviderID:               provider.ID(),\n\t\tWrappedDataEncryptionKey: rootBlob,\n\t\tWrappedRSAKey:            &kms.BlobInfo{},\n\t\tKeyEncryptionKey:         kek,\n\t}\n\n\t// Only cipherSets created after 1.7.0 will contain an RSA key.\n\tif len(rootKey.RSAKey) > 0 {\n\t\trsaBlob, err := wrapper.Encrypt(e.srv.shutdownCtx, rootKey.RSAKey)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to encrypt rsa key: %w\", err)\n\t\t}\n\t\tkekWrapper.WrappedRSAKey = rsaBlob\n\t}","sourceCodeStart":857,"sourceCodeEnd":893,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/encrypter.go#L857-L893","documentation":"After the KEK wrapper is built, encryptDEK calls wrapper.Encrypt on the root key material. If the provider's Encrypt call fails, the error is wrapped as \"failed to encrypt root key\". The key exists but could not be sealed with the KEK, so the wrapped key (KEKWrapper) cannot be persisted.","triggerScenarios":"wrapper.Encrypt(e.srv.shutdownCtx, rootKey.Key) returns an error — KMS backend rejected the encrypt (bad key ID, expired credentials, network error, shutdown context canceled), or local AEAD seal failed.","commonSituations":"Vault Transit endpoint unreachable or token expired; AWS KMS key not found or IAM denies kms:Encrypt; network partition between server and KMS; server shutting down (canceled shutdownCtx).","solutions":["Check connectivity and auth to the KMS backend; renew/refresh tokens or credentials.","Verify the KEK key ID exists in the backend and the server's identity has Encrypt permissions on it.","Inspect the wrapped inner error — KMS provider libraries return specific codes (e.g., NotFound, AccessDenied).","If the shutdown context was canceled, simply retry after the server is stable."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"blob, err := encryptDEK(...)\nif err != nil && strings.Contains(err.Error(), \"failed to encrypt root key\") {\n    // check KMS connectivity/auth, then retry with backoff\n}","preventionTips":["Grant the server identity explicit kms:Encrypt (or Vault transit/encrypt) capability.","Set up credential auto-renewal so tokens never expire mid-operation.","Monitor KMS endpoint reachability from server hosts."],"tags":["kms","encryption","network"],"backgroundTag":"kms-encrypt-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}