AWS KMS support requires a license with the HSM feature enab

Error message

AWS KMS support requires a license with the HSM feature enabled: %w

What it means

The third branch of the same startup gate: when cfg.KeyStoreConfig.AWSKMS is set, NewServer requires the HSM entitlement. AWS KMS-backed CA keys are Enterprise-only; without the entitlement the auth server refuses to start, wrapping ErrRequiresEnterprise.

Source

Thrown at lib/auth/auth.go:294

	if cfg.KeyStore == nil {
		keystoreOpts := &keystore.Options{
			HostUUID:             cfg.HostUUID,
			ClusterName:          cfg.ClusterName,
			AuthPreferenceGetter: cfg.ClusterConfiguration,
			FIPS:                 cfg.FIPS,
			Clock:                cfg.Clock,
		}
		if cfg.KeyStoreConfig.PKCS11 != (servicecfg.PKCS11Config{}) {
			if !cfg.Modules.Features().GetEntitlement(entitlements.HSM).Enabled {
				return nil, fmt.Errorf("PKCS11 HSM support requires a license with the HSM feature enabled: %w", ErrRequiresEnterprise)
			}
		} else if cfg.KeyStoreConfig.GCPKMS != (servicecfg.GCPKMSConfig{}) {
			if !cfg.Modules.Features().GetEntitlement(entitlements.HSM).Enabled {
				return nil, fmt.Errorf("GCP KMS support requires a license with the HSM feature enabled: %w", ErrRequiresEnterprise)
			}
		} else if cfg.KeyStoreConfig.AWSKMS != nil {
			if !cfg.Modules.Features().GetEntitlement(entitlements.HSM).Enabled {
				return nil, fmt.Errorf("AWS KMS support requires a license with the HSM feature enabled: %w", ErrRequiresEnterprise)
			}
		}
		cfg.KeyStore, err = keystore.NewManager(context.Background(), &cfg.KeyStoreConfig, keystoreOpts)
		if err != nil {
			return nil, trace.Wrap(err)
		}
	}
	if cfg.RecordingEncryption == nil {
		localRecordingEncryption, err := local.NewRecordingEncryptionService(cfg.Backend)
		if err != nil {
			return nil, trace.Wrap(err)
		}

		recordingEncryptionManager, err := recordingencryption.NewManager(closeCtx, recordingencryption.ManagerConfig{
			Backend:                       localRecordingEncryption,
			Cache:                         localRecordingEncryption,
			ClusterConfig:                 cfg.ClusterConfiguration,
			KeyStore:                      cfg.KeyStore,

View on GitHub (pinned to 1283425b60)

Solutions

Load an Enterprise license with the HSM entitlement enabled before enabling AWS KMS.
Remove the aws_kms block from key_store configuration if KMS-backed keys are not licensed.
Check the auth server logs for license-loading messages to confirm which entitlements the loaded license grants.

Example fix

// before (auth_service config)
key_store: { aws_kms: { aws_key_id_list: ["arn:aws:kms:..."] } }
// after
key_store: {} // or obtain HSM-entitled Enterprise license and keep the config

Defensive patterns

Strategy: validation

Validate before calling

if cfg.KeyStoreConfig.AWSKMS != nil &&
	!cfg.Modules.Features().GetEntitlement(entitlements.HSM).Enabled {
	return errors.New("AWS KMS key store configured but license lacks HSM entitlement")
}

Try / catch

srv, err := auth.NewServer(...)
if err != nil {
	if strings.Contains(err.Error(), "AWS KMS support requires a license") {
		// strip aws_kms from key_store or upgrade to HSM-entitled Enterprise license
	}
}

Prevention

Verify HSM entitlement with a dry-run feature check before enabling aws_kms.
Alert on license expiry ahead of time in Enterprise deployments.
Document that all KMS/HSM key stores (PKCS11, GCP KMS, AWS KMS) require the same entitlement.

When it happens

Trigger: Starting the auth service with an AWS KMS key store configured (aws_kms section with key IDs/ARNs) while Features().GetEntitlement(entitlements.HSM).Enabled is false on the loaded license.

Common situations: Copying an Enterprise HA config (AWS KMS CA keys) into an OSS or non-HSM-licensed cluster; license expiry causing entitlements to reset; region/account mismatch causing the license loader to skip the file.

Related errors

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/15283a79a876ef2b. Report an issue: GitHub.