{"record":{"id":"bd56b0079d8c2590","repo":"hashicorp/packer","slug":"load-kms-public-key-q-w","errorCode":null,"errorMessage":"load KMS public key %q: %w","messagePattern":"load KMS public key %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/sign_kms.go","lineNumber":48,"sourceCode":"}\n\nfunc newKMSSigner(ctx context.Context, cfg BackendConfig) (Signer, error) {\n\tif cfg.SignerRef == \"\" {\n\t\treturn nil, fmt.Errorf(\"signing_mode %q requires signer or key\", SigningModeKMS)\n\t}\n\n\tsignerVerifier, err := newKMSSignerVerifier(ctx, cfg.SignerRef)\n\tif err != nil {\n\t\tvar notFound *sigstorekms.ProviderNotFoundError\n\t\tif errors.As(err, &notFound) {\n\t\t\treturn nil, fmt.Errorf(\"initialize KMS signer %q: %w%s\", cfg.SignerRef, err, kmsProviderBuildHint(cfg.SignerRef))\n\t\t}\n\t\treturn nil, fmt.Errorf(\"initialize KMS signer %q: %w\", cfg.SignerRef, err)\n\t}\n\n\tpublicKey, err := signerVerifier.PublicKey()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"load KMS public key %q: %w\", cfg.SignerRef, err)\n\t}\n\n\tverifier, err := newSigstoreVerifierFromPublicKey(publicKey)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"create KMS verifier %q: %w\", cfg.SignerRef, err)\n\t}\n\n\treturn &kmsSigner{\n\t\tsignerVerifier: signerVerifier,\n\t\tverifier:       verifier,\n\t\tkeyID:          verifier.KeyID(),\n\t}, nil\n}\n\nfunc (s *kmsSigner) Sign(_ context.Context, payloadType string, payload []byte) (Signature, error) {\n\tencoded := PreAuthEncode(payloadType, payload)\n\tsignature, err := s.signerVerifier.SignMessage(bytes.NewReader(encoded))\n\tif err != nil {","sourceCodeStart":30,"sourceCodeEnd":66,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/sign_kms.go#L30-L66","documentation":"After the SignerVerifier is constructed, newKMSSigner calls signerVerifier.PublicKey() to retrieve the public half of the KMS key so it can build a local verifier. This error wraps any failure of that call — typically an API error fetching the key material from the cloud KMS (permissions, deleted key, network) or a failure of the provider to parse/expose the key. It is thrown because attestation verification requires the public key locally even though signing happens remotely.","triggerScenarios":"signing_mode \"kms\" where the KMS provider initializes fine but SignerVerifier.PublicKey() returns an error: caller lacks GetPublicKey permission on the key, the key is scheduled for deletion/disabled, or the KMS API call fails transiently.","commonSituations":"IAM policy grants kms:Sign but not kms:GetPublicKey (or the equivalent on GCP/Azure/Vault); asymmetric key rotated or disabled after signer init; the key is symmetric-only in a provider that cannot export a public key this way; intermittent cloud API/network failure at startup.","solutions":["Grant the caller GetPublicKey permission on the KMS key (e.g. aws kms get-public-key works with the same credentials).","Confirm the key exists, is enabled, and is an asymmetric key suitable for signing (check its state in the KMS console).","Retry the run if the wrapped error indicates a transient API/network failure.","Verify the key ID/alias still resolves after rotation; update the config if the alias changed."],"exampleFix":"{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [{\n    \"Effect\": \"Allow\",\n    \"Action\": [\"kms:Sign\", \"kms:GetPublicKey\"],\n    \"Resource\": \"arn:aws:kms:us-east-1:123456789012:key/abcd-1234\"\n  }]\n}","handlingStrategy":"try-catch","validationCode":"// pre-flight permission check before signing\nout, err := kmsClient.GetPublicKey(&kms.GetPublicKeyInput{KeyId: aws.String(keyID)})\nif err != nil {\n\treturn fmt.Errorf(\"caller lacks GetPublicKey on key or key disabled/deleted: %w\", err)\n}\nif *out.KeyState != \"Enabled\" { return fmt.Errorf(\"key state %s\", *out.KeyState) }","typeGuard":null,"tryCatchPattern":"signer, err := attestation.NewSigner(ctx, cfg)\nif err != nil && strings.Contains(err.Error(), \"load KMS public key\") {\n\t// typically kms:GetPublicKey permission or key state issue\n\tif isTransient(err) { return retryInit(ctx, cfg) }\n\treturn fmt.Errorf(\"grant GetPublicKey on the KMS key and ensure it is enabled/asymmetric: %w\", err)\n}","preventionTips":["Grant both kms:Sign and kms:GetPublicKey (or provider equivalent) to the signing identity.","Use asymmetric signing keys; symmetric-only keys cannot expose a public key this way.","Monitor key state (enabled/disabled/pending deletion) and rotation of aliases referenced in config.","Retry on transient KMS API errors with backoff; treat AccessDenied as a config/permission fix.","Validate permissions with a cloud CLI call (e.g. aws kms get-public-key) in CI before builds."],"tags":["kms","permissions","public-key","sigstore"],"backgroundTag":"kms-get-public-key-denied","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}