getsops/sops · error

failed to decrypt sops data key with HuaweiCloud KMS: %w

Error message

failed to decrypt sops data key with HuaweiCloud KMS: %w

What it means

SOPS calls HuaweiCloud KMS DecryptData to unwrap the stored EncryptedKey using the key in KeyUUID. Any error returned by the API is wrapped with this message in DecryptContext (hckms/keysource.go:221); the wrapped SDK error holds the real API-level cause.

Source

Thrown at hckms/keysource.go:221

	if err != nil {
		log.WithField("keyID", key.KeyID).Info("Decryption failed")
		return nil, fmt.Errorf("failed to create HuaweiCloud KMS client: %w", err)
	}

	decryptAlgorithm := model.GetDecryptDataRequestBodyEncryptionAlgorithmEnum().SYMMETRIC_DEFAULT

	request := &model.DecryptDataRequest{
		Body: &model.DecryptDataRequestBody{
			CipherText:          key.EncryptedKey,
			EncryptionAlgorithm: &decryptAlgorithm,
			KeyId:               &key.KeyUUID,
		},
	}

	response, err := client.DecryptData(request)
	if err != nil {
		log.WithField("keyID", key.KeyID).Info("Decryption failed")
		return nil, fmt.Errorf("failed to decrypt sops data key with HuaweiCloud KMS: %w", err)
	}

	if response.PlainText == nil {
		return nil, fmt.Errorf("decryption response missing plaintext")
	}
	decrypted, err := base64.StdEncoding.DecodeString(*response.PlainText)
	if err != nil {
		log.WithField("keyID", key.KeyID).Info("Decryption failed")
		return nil, fmt.Errorf("failed to base64 decode decrypted data key: %w", err)
	}

	log.WithField("keyID", key.KeyID).Info("Decryption succeeded")
	return decrypted, nil
}

// NeedsRotation returns whether the data key needs to be rotated or not.
func (key *MasterKey) NeedsRotation() bool {
	return time.Since(key.CreationDate) > hckmsTTL

View on GitHub (pinned to 13442bb981)

Solutions

1. Inspect the wrapped SDK error for the HuaweiCloud error code (e.g. KMS.0104 invalid ciphertext, 403 auth)
2. Confirm the KeyUUID in the file metadata still exists, is enabled, and matches the region in the KeyID
3. Grant kms:crypto:decrypt on the CMK to the principal whose credentials are in use
4. Restore the original 'enc' value from git history if the ciphertext was manually modified
5. Retry on transient network errors; re-authenticate if credentials expired

Example fix

// before: ciphertext field manually edited in the file
enc: AEADB4Ab<manually-tampered>
// after: restore from version control
$ git checkout -- secrets.yaml

dataKey, err := key.DecryptContext(ctx)
if err != nil {
    if strings.Contains(err.Error(), "failed to decrypt sops data key with HuaweiCloud KMS") {
        // inspect wrapped SDK error code: auth vs invalid ciphertext vs key state
    }
    return err
}

When it happens

Trigger: client.DecryptData returns non-nil error during Decrypt/DecryptContext — wrong KeyUUID, key disabled/deleted, IAM lacking kms:crypto:decrypt, ciphertext truncated or tampered in the file's sops metadata, or network/auth failure.

Common situations: File edited by hand so the 'enc' ciphertext field got mangled; KMS key disabled or scheduled for deletion; region mismatch between stored key and actual key; credentials rotated and IAM policy no longer grants decrypt; `sops -d` of a file shared from another account without cross-account key grants.

Related errors

• failed to encrypt sops data key with HuaweiCloud KMS: %w
• decryption response missing plaintext
• failed to base64 decode decrypted data key: %w
• failed to decrypt sops data key with GCP KMS key: %w
• invalid key ID format: expected 'region:key-uuid', got %q

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/37fb547422c4c2d9. Report an issue: GitHub.