benbjohnson/litestream · error

cannot read sse-customer-key-path %q: %w

Error message

cannot read sse-customer-key-path %q: %w

What it means

Wraps os.ReadFile failure while loading the SSE-C customer key from the file named by s3 sse-customer-key-path. Fires when the file is missing, unreadable, or permission-denied; the key material cannot be applied to the S3 client.

Source

Thrown at cmd/litestream/main.go:1702

		client.SSECustomerAlgorithm = c.SSECustomerAlgorithm
		if client.SSECustomerAlgorithm == "" {
			client.SSECustomerAlgorithm = "AES256"
		}

		// Read key from file if path is specified, otherwise use direct value.
		if c.SSECustomerKeyPath != "" {
			keyPath := c.SSECustomerKeyPath
			// Expand ~ to home directory
			if strings.HasPrefix(keyPath, "~") {
				home, err := os.UserHomeDir()
				if err != nil {
					return nil, fmt.Errorf("cannot expand home directory for sse-customer-key-path: %w", err)
				}
				keyPath = home + keyPath[1:]
			}
			keyData, err := os.ReadFile(keyPath)
			if err != nil {
				return nil, fmt.Errorf("cannot read sse-customer-key-path %q: %w", c.SSECustomerKeyPath, err)
			}
			client.SSECustomerKey = strings.TrimSpace(string(keyData))
		} else {
			client.SSECustomerKey = c.SSECustomerKey
		}
	}

	// Apply SSE-KMS configuration if specified.
	if c.SSEKMSKeyID != "" {
		client.SSEKMSKeyID = c.SSEKMSKeyID
	}

	return client, nil
}

// newGSReplicaClientFromConfig returns a new instance of gs.ReplicaClient built from config.
func newGSReplicaClientFromConfig(c *ReplicaConfig, _ *litestream.Replica) (_ *gs.ReplicaClient, err error) {
	// Ensure URL & constituent parts are not both specified.

View on GitHub (pinned to 4ed7a308f6)

Solutions

1. Verify the path exists and is readable by the litestream process
2. Check for typos or wrong working directory; use an absolute path
3. Alternatively pass the base64 key directly via sse-customer-key

When it happens

Trigger: Thrown at cmd/litestream/main.go:1702 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of benbjohnson/litestream@4ed7a308f6 (2026-09-06). Data as JSON: /api/errors/2127446716f9fc9f. Report an issue: GitHub.