getsops/sops · error

failed to decrypt sops data key with AWS KMS: %w

Error message

failed to decrypt sops data key with AWS KMS: %w

What it means

Error "failed to decrypt sops data key with AWS KMS: %w" thrown in getsops/sops.

Source

Thrown at kms/keysource.go:339

	if err != nil {
		log.WithField("arn", key.Arn).Info("Decryption failed")
		return nil, fmt.Errorf("error base64-decoding encrypted data key: %s", err)
	}
	cfg, err := key.createKMSConfig(ctx)
	if err != nil {
		log.WithField("arn", key.Arn).Info("Decryption failed")
		return nil, err
	}
	client := key.createClient(cfg)
	input := &kms.DecryptInput{
		KeyId:             &key.Arn,
		CiphertextBlob:    k,
		EncryptionContext: stringPointerToStringMap(key.EncryptionContext),
	}
	decrypted, err := client.Decrypt(ctx, input)
	if err != nil {
		log.WithField("arn", key.Arn).Info("Decryption failed")
		return nil, fmt.Errorf("failed to decrypt sops data key with AWS KMS: %w", err)
	}
	log.WithField("arn", key.Arn).Info("Decryption succeeded")
	return decrypted.Plaintext, nil
}

// NeedsRotation returns whether the data key needs to be rotated or not.
func (key *MasterKey) NeedsRotation() bool {
	return time.Since(key.CreationDate) > kmsTTL
}

// ToString converts the key to a string representation.
func (key *MasterKey) ToString() string {
	arnRole := key.Arn
	if key.Role != "" {
		arnRole = fmt.Sprintf("%s+%s", key.Arn, key.Role)
	}
	context := kmsContextToString(key.EncryptionContext)
	if key.AwsProfile != "" {

View on GitHub (pinned to 13442bb981)

When it happens

Trigger: Thrown at kms/keysource.go:339 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/2fc81af9947f5f3d. Report an issue: GitHub.