{"record":{"id":"b4f113728396fc60","repo":"hashicorp/nomad","slug":"no-such-kms-provider-q-configured","errorCode":null,"errorMessage":"no such KMS provider %q configured","messagePattern":"no such KMS provider %q configured","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/encrypter.go","lineNumber":478,"sourceCode":"\t// Use a channel to receive the cipherSet from the decrypter goroutines. It\n\t// allows us to fan-out decryption tasks for HA in Nomad Enterprise.\n\tcipherSetCh := make(chan *cipherSet)\n\n\t// We will use the key ID to track the decrypt tasks for this key. Doing\n\t// this here means we can do this once per function call.\n\te.decryptTasksLock.Lock()\n\te.decryptTasks[wrappedKeys.KeyID] = struct{}{}\n\te.decryptTasksLock.Unlock()\n\n\tfor _, wrappedKey := range wrappedKeys.WrappedKeys {\n\t\tproviderID := wrappedKey.ProviderID\n\t\tif providerID == \"\" {\n\t\t\tproviderID = string(structs.KEKProviderAEAD)\n\t\t}\n\n\t\tprovider, ok := e.providerConfigs[providerID]\n\t\tif !ok {\n\t\t\terr := fmt.Errorf(\"no such KMS provider %q configured\", providerID)\n\t\t\tmErr = multierror.Append(mErr, err)\n\t\t\tcontinue\n\t\t}\n\n\t\twrapper, err := e.newKMSWrapper(provider, wrappedKeys.KeyID, wrappedKey.KeyEncryptionKey)\n\t\tif err != nil {\n\t\t\t// the errors that bubble up from this library can be a bit opaque, so\n\t\t\t// make sure we wrap them with as much context as possible\n\t\t\terr := fmt.Errorf(\"unable to create KMS wrapper for provider %q: %w\", providerID, err)\n\t\t\tmErr = multierror.Append(mErr, err)\n\t\t\tcontinue\n\t\t}\n\n\t\t// fan-out decryption tasks for HA in Nomad Enterprise. we can use the\n\t\t// key whenever any one provider returns a successful decryption.\n\t\tgo e.decryptWrappedKeyTask(completeCtx, wrapper, wrappedKeys.Meta(), wrappedKey, cipherSetCh)\n\t\tdecryptTasks++\n\t}","sourceCodeStart":460,"sourceCodeEnd":496,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/encrypter.go#L460-L496","documentation":"AddWrappedKey encountered a wrapped key entry whose provider ID has no matching entry in e.providerConfigs (the server's configured KEK providers). The key cannot be unwrapped and the error is accumulated into a multierror for the whole call.","triggerScenarios":"AddWrappedKey (called by restoreImpl, applyRootKeyMetaUpsert, applyWrappedRootKeysUpsert) looks up e.providerConfigs[providerID]; the keyring metadata references a provider (e.g. \"awskms\", \"transit\", \"gcpckms\", \"azurekeyvault\", or custom ID) that the agent config does not define, defaulting to \"aead\" when the ID is empty.","commonSituations":"Keyring replicated from a cluster whose servers define a cloud KMS provider but this server's config omits it, typo in the kek provider name in the server config block, or the provider block was removed after keys were wrapped under it.","solutions":["Add the missing KEK provider block (matching the quoted provider ID in the error) to the server config and restart","Check the provider ID spelling in the config against the ID recorded in the keystore metadata","If the provider was intentionally removed, first rotate keys so no wrapped keys remain under that provider","Verify all servers share an equivalent provider configuration so replication can unwrap keys everywhere"],"exampleFix":"// before: server config missing provider used by wrapped keys\n// after: add the provider block\nkms = {\n  provider     = \"awskms\"\n  kms_key_id   = \"alias/nomad-key\"\n  region       = \"us-east-1\"\n}","handlingStrategy":"validation","validationCode":"// verify every provider ID used by keystore metadata exists in server config\nfor _, id := range providerIDsInKeystoreMetadata {\n  if _, ok := configuredKEKProviders[id]; !ok {\n    return fmt.Errorf(\"keystore references provider %q which is not in server config\", id)\n  }\n}","typeGuard":null,"tryCatchPattern":"if err := srv.AddWrappedKey(wrappedKeys); err != nil {\n  if strings.Contains(err.Error(), \"no such KMS provider\") {\n    return fmt.Errorf(\"server config is missing a KEK provider referenced by the keystore — add the kms block and restart: %w\", err)\n  }\n  return err\n}","preventionTips":["Keep identical kms provider blocks on all servers that share a keystore/region","Never remove a provider block while keys are still wrapped under it — rotate first","Copy provider IDs exactly (quote-safe) from keystore metadata into config","Diff server configs across the cluster after any KMS configuration change"],"tags":["kms","keystore","configuration","go"],"backgroundTag":"kms-provider-not-configured","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}