{"record":{"id":"dbec652d36a1daff","repo":"hashicorp/nomad","slug":"unable-to-create-key-wrapper-w","errorCode":null,"errorMessage":"unable to create key wrapper: %w","messagePattern":"unable to create key wrapper: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/encrypter.go","lineNumber":870,"sourceCode":"\n// encryptDEK encrypts the DEKs (one for encryption and one for signing) with\n// the KMS provider and returns a WrappedKey built from the provider's\n// kms.BlobInfo. This includes the cleartext KEK for the AEAD provider.\nfunc (e *Encrypter) encryptDEK(rootKey *structs.UnwrappedRootKey, provider *structs.KEKProviderConfig) (*structs.WrappedKey, error) {\n\tif provider == nil {\n\t\tpanic(\"can't encrypt DEK without a provider\")\n\t}\n\tvar kek []byte\n\tvar err error\n\tif provider.Provider == structs.KEKProviderAEAD || provider.Provider == \"\" {\n\t\tkek, err = crypto.Bytes(32)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to generate key wrapper key: %w\", err)\n\t\t}\n\t}\n\twrapper, err := e.newKMSWrapper(provider, rootKey.Meta.KeyID, kek)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to create key wrapper: %w\", err)\n\t}\n\n\trootBlob, err := wrapper.Encrypt(e.srv.shutdownCtx, rootKey.Key)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to encrypt root key: %w\", err)\n\t}\n\n\tkekWrapper := &structs.WrappedKey{\n\t\tProvider:                 provider.Provider.String(),\n\t\tProviderID:               provider.ID(),\n\t\tWrappedDataEncryptionKey: rootBlob,\n\t\tWrappedRSAKey:            &kms.BlobInfo{},\n\t\tKeyEncryptionKey:         kek,\n\t}\n\n\t// Only cipherSets created after 1.7.0 will contain an RSA key.\n\tif len(rootKey.RSAKey) > 0 {\n\t\trsaBlob, err := wrapper.Encrypt(e.srv.shutdownCtx, rootKey.RSAKey)","sourceCodeStart":852,"sourceCodeEnd":888,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/encrypter.go#L852-L888","documentation":"encryptDEK builds the KMS wrapper via newKMSWrapper for the configured provider (Vault Transit, AWS KMS, Azure KeyVault, PKCS11, or AEAD). If wrapper construction fails — bad provider config, missing credentials, unreachable endpoint — the error is wrapped as \"unable to create key wrapper\". No root key wrapping can proceed without a working wrapper.","triggerScenarios":"newKMSWrapper(provider, rootKey.Meta.KeyID, kek) returns an error while wrapping a root key — e.g., invalid kms config struct, unknown provider name, or provider constructor failing (bad key ID, missing config fields).","commonSituations":"Misconfigured kms block in server config (wrong key_id, region, vault address); missing provider credentials; typo'd provider name; KMS plugin binary missing or fails to launch.","solutions":["Read the wrapped cause: fix the provider configuration fields the inner error names (key_id, endpoint, region, etc.).","Verify credentials/env vars for the provider (VAULT_TOKEN, AWS credentials, Azure creds) are present on the Nomad server.","Confirm the provider name is valid and the external KMS plugin (if used) is installed and executable.","Test connectivity to the KMS endpoint (Vault, AWS KMS, Azure KeyVault) from the server host."],"exampleFix":"// before\nkms_config {\n  provider = \"awskms\"\n  config { key_id = \"alias/wrong-key\" }\n}\n// after\nkms_config {\n  provider = \"awskms\"\n  config { key_id = \"alias/nomad-default\" region = \"us-east-1\" endpoint = \"kms.us-east-1.amazonaws.com\" }\n}","handlingStrategy":"validation","validationCode":"// before wrapping, validate the kms_config is complete and provider is known\nif provider == \"\" {\n    return errors.New(\"kms provider must be set\")\n}\n// e.g. for awskms: check key_id and region are non-empty in config","typeGuard":"func validKMSConfig(p string, cfg map[string]string) bool {\n    switch p {\n    case \"awskms\":\n        return cfg[\"kms_key_id\"] != \"\" && cfg[\"region\"] != \"\"\n    case \"vault\":\n        return cfg[\"vault_address\"] != \"\" && cfg[\"transit_key\"] != \"\"\n    case \"aead\":\n        return true\n    default:\n        return false\n    }\n}","tryCatchPattern":"wrapper, err := encryptDEK(...)\nif err != nil && strings.Contains(err.Error(), \"unable to create key wrapper\") {\n    // log full wrapped chain; fix provider config before retrying\n}","preventionTips":["Validate the full kms_config block against provider docs before deploying.","Smoke-test KMS credentials on the host (e.g., aws kms list-keys) before starting the server.","Keep provider name strings exact and sourced from a shared constant/config template."],"tags":["kms","key-wrapping","configuration"],"backgroundTag":"kms-wrapper-creation-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}