s3: cannot use both sse-customer-key and sse-kms-key-id; the

Error message

s3: cannot use both sse-customer-key and sse-kms-key-id; they are mutually exclusive

What it means

SSE validation guard in Init: both sse-customer-key (SSE-C) and sse-kms-key-id (SSE-KMS) were configured. S3 allows only one server-side encryption mode per object, so Litestream rejects the combination upfront rather than failing every request later.

Source

Thrown at s3/replica_client.go:531

			// Add scheme if not present
			if !strings.HasPrefix(endpoint, "http://") && !strings.HasPrefix(endpoint, "https://") {
				endpoint = "https://" + endpoint
			}

			o.BaseEndpoint = aws.String(endpoint)
			// For MinIO and other S3-compatible services
			if strings.HasPrefix(endpoint, "http://") {
				o.EndpointOptions.DisableHTTPS = true
			}
		})
	}
}

// validateSSEConfig validates server-side encryption configuration.
func (c *ReplicaClient) validateSSEConfig() error {
	// Check mutual exclusivity: SSE-C and SSE-KMS cannot both be set
	if c.SSECustomerKey != "" && c.SSEKMSKeyID != "" {
		return fmt.Errorf("s3: cannot use both sse-customer-key and sse-kms-key-id; they are mutually exclusive")
	}

	// Validate SSE-C configuration
	if c.SSECustomerKey != "" {
		// Algorithm must be AES256 (or default to it)
		if c.SSECustomerAlgorithm == "" {
			c.SSECustomerAlgorithm = "AES256"
		} else if c.SSECustomerAlgorithm != "AES256" {
			return fmt.Errorf("s3: sse-customer-algorithm must be AES256, got %q", c.SSECustomerAlgorithm)
		}

		// Validate key is valid base64 and correct length (256 bits = 32 bytes)
		keyBytes, err := base64.StdEncoding.DecodeString(c.SSECustomerKey)
		if err != nil {
			return fmt.Errorf("s3: sse-customer-key must be valid base64: %w", err)
		}
		if len(keyBytes) != 32 {
			return fmt.Errorf("s3: sse-customer-key must be 256-bit (32 bytes) when decoded, got %d bytes", len(keyBytes))

View on GitHub (pinned to 4ed7a308f6)

Solutions

Keep only one encryption mode: SSE-C key or SSE-KMS key id

Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at s3/replica_client.go:531 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of benbjohnson/litestream@4ed7a308f6 (2026-09-06). Data as JSON: /api/errors/0ab736113cd1217c. Report an issue: GitHub.