argoproj/argo-workflows · error

failed to marshal KMS encryption context: %w

Error message

failed to marshal KMS encryption context: %w

What it means

parseKMSEncCntx marshals the kmsEncryptionContext through json.RawMessage to validate and normalize it; if the raw string isn't valid JSON, json.Marshal fails and this wrapped error is returned (nil, nil semantics rely on valid JSON). It is the upstream source of error 536's wrapper.

Source

Thrown at workflow/artifacts/s3/s3.go:953

		if err != nil {
			return nil, err
		}

		return kms, nil
	}

	return encrypt.NewSSE(), nil
}

// parseKMSEncCntx validates if kmsEncCntx is a valid JSON
func parseKMSEncCntx(kmsEncCntx string) (*string, error) {
	if kmsEncCntx == "" {
		return nil, nil
	}

	jsonKMSEncryptionContext, err := json.Marshal(json.RawMessage(kmsEncCntx))
	if err != nil {
		return nil, fmt.Errorf("failed to marshal KMS encryption context: %w", err)
	}

	parsedKMSEncryptionContext := base64.StdEncoding.EncodeToString(jsonKMSEncryptionContext)

	return &parsedKMSEncryptionContext, nil
}

View on GitHub (pinned to 35bff19146)

Solutions

1. Fix the kmsEncryptionContext string to be valid JSON, e.g. '{"k":"v"}'
2. Run it through jq/JSON linter to verify before applying config
3. Check for template placeholders that were not substituted
4. Omit the field if no encryption context is required

Example fix

// before
kmsEncryptionContext: '{k:"v"}'
// after
kmsEncryptionContext: '{"k":"v"}'

if ctxStr := e.KmsEncryptionContext; ctxStr != "" {
  if json.Valid([]byte(ctxStr)) == false { return errors.New("kmsEncryptionContext must be valid JSON") }
}

func kmsContextValid(s string) bool { return s == "" || json.Valid([]byte(s)) }

When it happens

Trigger: kmsEncryptionContext is a non-empty string that json.Marshal(json.RawMessage(...)) rejects — malformed JSON such as missing quotes, invalid escape, or trailing characters.

Common situations: Templated values producing '{{...}}' leftovers; secrets injected with stray whitespace/newlines; hand-written context with unescaped quotes.

Related errors

• failed to parse KMS encryption context: %w
• serverSideCustomerKeySecret and kmsKeyId cannot be set toget
• EncryptOpts.KmsKeyId and EncryptOpts.SSECPassword cannot be
• secure must be set if EncryptOpts.SSECPassword is set
• invalid TTL

AI-assisted analysis of argoproj/argo-workflows@35bff19146 (2026-09-03). Data as JSON: /api/errors/076d46a87e74ce8d. Report an issue: GitHub.