getsops/sops · error

failed to encrypt sops data key with HuaweiCloud KMS: %w

Error message

failed to encrypt sops data key with HuaweiCloud KMS: %w

What it means

SOPS calls HuaweiCloud KMS EncryptData to wrap the file's data key with the master key identified by KeyUUID. When the KMS API returns any error response, EncryptContext (hckms/keysource.go:163) wraps it with this message via %w. The underlying SDK error carries the real cause (auth failure, bad key ID, throttling, network).

Source

Thrown at hckms/keysource.go:163

		log.WithField("keyID", key.KeyID).Info("Encryption failed")
		return fmt.Errorf("failed to create HuaweiCloud KMS client: %w", err)
	}

	plaintext := base64.StdEncoding.EncodeToString(dataKey)
	encryptAlgorithm := model.GetEncryptDataRequestBodyEncryptionAlgorithmEnum().SYMMETRIC_DEFAULT

	request := &model.EncryptDataRequest{
		Body: &model.EncryptDataRequestBody{
			KeyId:               key.KeyUUID,
			PlainText:           plaintext,
			EncryptionAlgorithm: &encryptAlgorithm,
		},
	}

	response, err := client.EncryptData(request)
	if err != nil {
		log.WithField("keyID", key.KeyID).Info("Encryption failed")
		return fmt.Errorf("failed to encrypt sops data key with HuaweiCloud KMS: %w", err)
	}

	if response.CipherText == nil {
		return fmt.Errorf("encryption response missing ciphertext")
	}
	key.EncryptedKey = *response.CipherText
	log.WithField("keyID", key.KeyID).Info("Encryption succeeded")
	return nil
}

// EncryptIfNeeded encrypts the provided SOPS data key, if it has not been
// encrypted yet.
func (key *MasterKey) EncryptIfNeeded(dataKey []byte) error {
	if key.EncryptedKey == "" {
		return key.Encrypt(dataKey)
	}
	return nil
}

View on GitHub (pinned to 13442bb981)

Solutions

1. Read the wrapped SDK error (%v of the cause) to get the HuaweiCloud API error code and message
2. Verify the key UUID in the sops config entry exists and is enabled in the region given by the 'region:key-uuid' KeyID
3. Check IAM permissions for kms:crypto:encrypt (or the KMS CMK's key policy) on the principal whose credentials are used
4. Re-authenticate (env vars HC_ACCESS_KEY/HC_SECRET_KEY or profile) and retry; enable request-level logging to see the HTTP response

Example fix

// before: key UUID from another region, API returns 404
k, _ := hckms.NewMasterKey("tr-west-1:00000000-0000-0000-0000-000000000000")
// after: use a key UUID that exists and is enabled in that region
k, _ := hckms.NewMasterKey("tr-west-1:real-key-uuid-from-huaweicloud-console")

// Go: verify key material exists before encrypting
if key.KeyUUID == "" || key.Region == "" {
    return fmt.Errorf("hckms key %q lacks region/key-uuid; cannot encrypt", key.KeyID)
}

if err := key.EncryptContext(ctx, dataKey); err != nil {
    var respErr error
    if errors.As(err, &respErr) { /* unwrap %w chain for the HuaweiCloud API error code */ }
    log.Errorf("HCKMS encrypt failed for %s: %v", key.KeyID, err)
    return err
}

When it happens

Trigger: Calling MasterKey.Encrypt or EncryptContext on an hckms.MasterKey when client.EncryptData returns a non-nil error — e.g. invalid KeyUUID, denied IAM permission (kms:crypto:encrypt), expired credentials, unreachable KMS endpoint, or request throttling.

Common situations: Key was deleted or exists in a different region than the one in the 'region:key-uuid' sops key entry; IAM user lacks KMS encrypt permission; HuaweiCloud SDK credentials expired; transient network/API outage during `sops -e` or `sops rotate -i`.

Related errors

• failed to create HuaweiCloud KMS client: %w
• encryption response missing ciphertext
• failed to decrypt sops data key with HuaweiCloud KMS: %w
• cannot create GCP KMS service: %w
• failed to encrypt sops data key with GCP KMS key: %w

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/63ec00ba8ec34eaa. Report an issue: GitHub.