{"record":{"id":"ab3a488a53b004cf","repo":"argoproj/argo-workflows","slug":"secure-must-be-set-if-encryptopts-ssecpassword-is","errorCode":null,"errorMessage":"secure must be set if EncryptOpts.SSECPassword is set","messagePattern":"secure must be set if EncryptOpts\\.SSECPassword is set","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"workflow/artifacts/s3/s3.go","lineNumber":529,"sourceCode":"\t\tbucketLookupType = minio.BucketLookupDNS\n\tdefault:\n\t\tbucketLookupType = minio.BucketLookupAuto\n\t}\n\tminioOpts := &minio.Options{Creds: credentials, Secure: s3cli.Secure, Transport: opts.Transport, Region: s3cli.Region, BucketLookup: bucketLookupType}\n\tminioClient, err = minio.New(s3cli.Endpoint, minioOpts)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif opts.Trace {\n\t\tminioClient.TraceOn(os.Stderr)\n\t}\n\n\tif opts.EncryptOpts.KmsKeyID != \"\" && opts.EncryptOpts.ServerSideCustomerKey != \"\" {\n\t\treturn nil, fmt.Errorf(\"EncryptOpts.KmsKeyId and EncryptOpts.SSECPassword cannot be set together\")\n\t}\n\n\tif opts.EncryptOpts.ServerSideCustomerKey != \"\" && !opts.Secure {\n\t\treturn nil, fmt.Errorf(\"secure must be set if EncryptOpts.SSECPassword is set\")\n\t}\n\n\ts3cli.ctx = ctx\n\ts3cli.minioClient = minioClient\n\n\treturn &s3cli, nil\n}\n\n// Gets number of threads for S3 upload from env var. Default if not set: 4.\nfunc (s *s3client) getFromEnvS3UploadNbThreads() int {\n\t// Minio default threads: https://github.com/minio/minio-go/blob/v7.0.98/constants.go#L58\n\tconst defaultThreads = 4\n\n\tnbThreadsStr := os.Getenv(common.EnvVarS3UploadThreads)\n\tvar nbThreads int\n\tif nbThreadsStr != \"\" {\n\t\tvar err error\n\t\tlogging.RequireLoggerFromContext(s.ctx).WithFields(logging.Fields{\"envvar\": common.EnvVarS3UploadThreads, \"nbThreads\": nbThreadsStr}).Info(s.ctx, \"Number of threads or s3 multipart upload detected\")","sourceCodeStart":511,"sourceCodeEnd":547,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/workflow/artifacts/s3/s3.go#L511-L547","documentation":"NewClient requires TLS (Secure) when an SSEC customer-key password is configured, because the SSE-C key must never travel over an unencrypted connection. Client construction fails outright when ServerSideCustomerKey is set but opts.Secure is false.","triggerScenarios":"encryptionOptions.ssecPassword set while the S3 config has insecure: true (or the endpoint scheme is http), e.g. against a local Minio without TLS.","commonSituations":"Local Minio dev setups with insecure: true plus copied production encryption settings; users assuming SSE-C works over plain HTTP; missing enableTLS on Minio gateway.","solutions":["Set secure: true (insecure: false) in the S3 artifact config, ensuring the endpoint serves TLS","Or remove the ssecPassword option if you don't actually need SSE-C","Configure TLS on your Minio/S3 endpoint (MINIO_* certs or a TLS-terminating proxy) before enabling SSE-C"],"exampleFix":"// before\ns3:\n  endpoint: minio:9000\n  insecure: true\n  encryptionOptions:\n    ssecPasswordSecret: {name: ssec, key: pw}\n// after\ns3:\n  endpoint: minio:9000\n  insecure: false\n  encryptionOptions:\n    ssecPasswordSecret: {name: ssec, key: pw}","handlingStrategy":"validation","validationCode":"func validateSSEC(o s3.Opts) error {\n  if o.EncryptOpts.ServerSideCustomerKey != \"\" && !o.Secure {\n    return errors.New(\"SSEC requires secure=true (TLS)\")\n  }\n  return nil\n}","typeGuard":"func ssecWithoutTLS(o s3.Opts) bool {\n  return o.EncryptOpts.ServerSideCustomerKey != \"\" && !o.Secure\n}","tryCatchPattern":null,"preventionTips":["Never combine insecure: true with ssecPassword","Verify the Minio/S3 endpoint presents a valid TLS cert before enabling SSE-C","Use https endpoints in prod; reserve insecure for local non-SSEC dev"],"tags":["s3","encryption","tls","configuration"],"backgroundTag":"ssec-requires-tls","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}