{"record":{"id":"bc4e37b83ab61537","repo":"Netflix/chaosmonkey","slug":"unsupported-decryptor-s","errorCode":null,"errorMessage":"unsupported decryptor: %s","messagePattern":"unsupported decryptor: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"decryptor/decryptor.go","lineNumber":39,"sourceCode":"\t\"github.com/pkg/errors\"\n)\n\ntype nullDecryptor struct{}\n\n// Decrypt implements chaosmonkey.Decryptor.Decrypt\n// This is a no-op implementation that simply returns the plaintext\nfunc (n nullDecryptor) Decrypt(ciphertext string) (string, error) {\n\treturn ciphertext, nil\n}\n\nfunc init() {\n\tdeps.GetDecryptor = getNullDecryptor\n}\n\nfunc getNullDecryptor(cfg *config.Monkey) (chaosmonkey.Decryptor, error) {\n\tkind := cfg.Decryptor()\n\tif kind != \"\" {\n\t\treturn nil, errors.Errorf(\"unsupported decryptor: %s\", kind)\n\t}\n\n\treturn nullDecryptor{}, nil\n}\n","sourceCodeStart":21,"sourceCodeEnd":44,"githubUrl":"https://github.com/Netflix/chaosmonkey/blob/eaa28fb761c0ebe8644d1333e5d164e9cc3071e9/decryptor/decryptor.go#L21-L44","documentation":"getNullDecryptor() returns a no-op decryptor only when no decryptor kind is configured. If a Decryptor kind IS configured, the null decryptor path cannot support it, so this error is thrown (only the KMS decryptor path supports real kinds).","triggerScenarios":"Setting a decryptor value in config (e.g. decryptor = \"kms\") while the code path builds the null decryptor because KMS support isn't available/initialized in this setup.","commonSituations":"Config copied from a KMS-enabled deployment into a build without KMS support, typo'd decryptor name, misunderstanding that \"\" means null decryptor.","solutions":["Set decryptor to an empty string if no encryption is desired","Use a deployment/build with KMS decryptor support if a real decryptor is required","Check the decryptor config key spelling and allowed values"],"exampleFix":"// before\ndecryptor = \"kms\"  # in a build without KMS support\n// after\ndecryptor = \"\"     # use null decryptor","handlingStrategy":"validation","validationCode":"if kind := cfg.Decryptor(); kind != \"\" && !kmsSupported {\n    log.Printf(\"warning: decryptor=%q requested but KMS support unavailable; unsetting\", kind)\n}\n// or require an empty decryptor when KMS is unavailable","typeGuard":null,"tryCatchPattern":"dec, err := getDecryptor(cfg)\nif err != nil {\n    if strings.Contains(err.Error(), \"unsupported decryptor\") {\n        log.Printf(\"falling back to null decryptor: %v\", err)\n        dec = nullDecryptor{}\n    } else {\n        return err\n    }\n}","preventionTips":["Only set the decryptor key in builds with KMS support","Document allowed decryptor values","Validate decryptor config at startup","Fail fast with a clear message rather than at decryption time"],"tags":["config","decryptor","unsupported"],"backgroundTag":"unsupported-decryptor","analyzedSha":"eaa28fb761c0ebe8644d1333e5d164e9cc3071e9","analyzedAt":"2026-09-03T17:04:39.020Z","contentChangedAt":"2026-09-03T17:04:39.020Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}