getsops/sops · error

failed to encrypt sops data key with AWS KMS: %w

Error message

failed to encrypt sops data key with AWS KMS: %w

What it means

Error "failed to encrypt sops data key with AWS KMS: %w" thrown in getsops/sops.

Source

Thrown at kms/keysource.go:283

// EncryptContext takes a SOPS data key, encrypts it with KMS and stores the result
// in the EncryptedKey field.
func (key *MasterKey) EncryptContext(ctx context.Context, dataKey []byte) error {
	cfg, err := key.createKMSConfig(ctx)
	if err != nil {
		log.WithField("arn", key.Arn).Info("Encryption failed")
		return err
	}
	client := key.createClient(cfg)
	input := &kms.EncryptInput{
		KeyId:             &key.Arn,
		Plaintext:         dataKey,
		EncryptionContext: stringPointerToStringMap(key.EncryptionContext),
	}
	out, err := client.Encrypt(ctx, input)
	if err != nil {
		log.WithField("arn", key.Arn).Info("Encryption failed")
		return fmt.Errorf("failed to encrypt sops data key with AWS KMS: %w", err)
	}
	key.EncryptedKey = base64.StdEncoding.EncodeToString(out.CiphertextBlob)
	log.WithField("arn", key.Arn).Info("Encryption succeeded")
	return nil
}

// EncryptIfNeeded encrypts the provided SOPS data key, if it has not been
// encrypted yet.
func (key *MasterKey) EncryptIfNeeded(dataKey []byte) error {
	if key.EncryptedKey == "" {
		return key.Encrypt(dataKey)
	}
	return nil
}

// EncryptedDataKey returns the encrypted data key this master key holds.
func (key *MasterKey) EncryptedDataKey() []byte {
	return []byte(key.EncryptedKey)

View on GitHub (pinned to 13442bb981)

When it happens

Trigger: Thrown at kms/keysource.go:283 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/69e446252f5abf66. Report an issue: GitHub.