{"record":{"id":"91a3a49adf36370b","repo":"JuliusBrussee/caveman","slug":"kms-envelope-region-is-not-approved","errorCode":null,"errorMessage":"kms: envelope region is not approved","messagePattern":"kms: envelope region is not approved","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shared/platform/kms/kms.go","lineNumber":240,"sourceCode":"func (c *Client) Decrypt(ctx context.Context, blob []byte) ([]byte, error) {\n\tif !IsEnvelope(blob) {\n\t\treturn nil, errors.New(\"kms: unknown envelope format\")\n\t}\n\tif len(blob) > maxEnvelopeBytes {\n\t\treturn nil, errors.New(\"kms: envelope exceeds size limit\")\n\t}\n\tvar envelope Envelope\n\tif err := json.Unmarshal(blob[len(prefix):], &envelope); err != nil {\n\t\treturn nil, fmt.Errorf(\"kms: decode envelope: %w\", err)\n\t}\n\tif envelope.Provider != c.provider {\n\t\treturn nil, errors.New(\"kms: envelope provider does not match configured provider\")\n\t}\n\tif err := validateLocation(envelope.Region, envelope.KeyID); err != nil {\n\t\treturn nil, err\n\t}\n\tif envelope.Region != c.region {\n\t\treturn nil, errors.New(\"kms: envelope region is not approved\")\n\t}\n\tif _, ok := c.decryptKeyIDs[envelope.KeyID]; !ok {\n\t\treturn nil, errors.New(\"kms: envelope key ID is not approved\")\n\t}\n\tif strings.TrimSpace(envelope.Ciphertext) == \"\" {\n\t\treturn nil, errors.New(\"kms: envelope ciphertext is empty\")\n\t}\n\tvar response struct {\n\t\tKeyID     string `json:\"key_id\"`\n\t\tPlaintext string `json:\"plaintext\"`\n\t}\n\tif err := c.call(ctx, envelope.Region, envelope.KeyID, \"decrypt\", map[string]string{\n\t\t\"ciphertext\": envelope.Ciphertext,\n\t}, &response); err != nil {\n\t\treturn nil, err\n\t}\n\tif response.KeyID != envelope.KeyID || response.Plaintext == \"\" {\n\t\treturn nil, errors.New(\"kms: invalid decrypt response\")","sourceCodeStart":222,"sourceCodeEnd":258,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/27d5a3981a347890211bb1bf2439e5c821a63bc9/shared/platform/kms/kms.go#L222-L258","documentation":"Error \"kms: envelope region is not approved\" thrown in JuliusBrussee/caveman.","triggerScenarios":"Thrown at shared/platform/kms/kms.go:240 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use an approved region for the envelope key."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"27d5a3981a347890211bb1bf2439e5c821a63bc9","analyzedAt":"2026-08-15T09:26:11.751Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}