GCP KMS support requires a license with the HSM feature enab

Error message

GCP KMS support requires a license with the HSM feature enabled: %w

What it means

Same HSM-entitlement gate as PKCS11, applied to the GCP KMS key store: NewServer rejects startup when cfg.KeyStoreConfig.GCPKMS is configured but the license's HSM entitlement is disabled. Teleport treats cloud KMS-backed CA keys as an HSM-class Enterprise feature, wrapping ErrRequiresEnterprise.

Source

Thrown at lib/auth/auth.go:290

			return nil, trace.Wrap(err)
		}
		cfg.ClusterConfiguration = clusterConfig
	}
	if cfg.KeyStore == nil {
		keystoreOpts := &keystore.Options{
			HostUUID:             cfg.HostUUID,
			ClusterName:          cfg.ClusterName,
			AuthPreferenceGetter: cfg.ClusterConfiguration,
			FIPS:                 cfg.FIPS,
			Clock:                cfg.Clock,
		}
		if cfg.KeyStoreConfig.PKCS11 != (servicecfg.PKCS11Config{}) {
			if !cfg.Modules.Features().GetEntitlement(entitlements.HSM).Enabled {
				return nil, fmt.Errorf("PKCS11 HSM support requires a license with the HSM feature enabled: %w", ErrRequiresEnterprise)
			}
		} else if cfg.KeyStoreConfig.GCPKMS != (servicecfg.GCPKMSConfig{}) {
			if !cfg.Modules.Features().GetEntitlement(entitlements.HSM).Enabled {
				return nil, fmt.Errorf("GCP KMS support requires a license with the HSM feature enabled: %w", ErrRequiresEnterprise)
			}
		} else if cfg.KeyStoreConfig.AWSKMS != nil {
			if !cfg.Modules.Features().GetEntitlement(entitlements.HSM).Enabled {
				return nil, fmt.Errorf("AWS KMS support requires a license with the HSM feature enabled: %w", ErrRequiresEnterprise)
			}
		}
		cfg.KeyStore, err = keystore.NewManager(context.Background(), &cfg.KeyStoreConfig, keystoreOpts)
		if err != nil {
			return nil, trace.Wrap(err)
		}
	}
	if cfg.RecordingEncryption == nil {
		localRecordingEncryption, err := local.NewRecordingEncryptionService(cfg.Backend)
		if err != nil {
			return nil, trace.Wrap(err)
		}

		recordingEncryptionManager, err := recordingencryption.NewManager(closeCtx, recordingencryption.ManagerConfig{

View on GitHub (pinned to 1283425b60)

Solutions

Install/refresh an Enterprise license that includes the HSM entitlement, then restart.
Remove the gcp_kms block from key_store config to fall back to the software key store.
Confirm cfg.Modules reflects the Enterprise build (Features().GetEntitlement(entitlements.HSM).Enabled) via diagnostics before configuring GCP KMS.

Example fix

// before (auth_service config)
key_store: { gcp_kms: { keyring: teleport, key: ca } }
// after
key_store: {} // until an HSM-entitled Enterprise license is loaded

Defensive patterns

Strategy: validation

Validate before calling

if cfg.KeyStoreConfig.GCPKMS != (servicecfg.GCPKMSConfig{}) &&
	!cfg.Modules.Features().GetEntitlement(entitlements.HSM).Enabled {
	return errors.New("GCP KMS key store configured but license lacks HSM entitlement")
}

Try / catch

srv, err := auth.NewServer(...)
if err != nil {
	if strings.Contains(err.Error(), "GCP KMS support requires a license") {
		// remove gcp_kms config or load HSM-entitled license, then restart
	}
}

Prevention

Gate GCP KMS config rollouts on license entitlement checks in CI/deploy scripts.
Monitor license expiry so entitlements don't silently disappear.
Use separate config files for OSS and Enterprise clusters.

When it happens

Trigger: Configuring key_store with GCP KMS (keyring/key names under gcp_kms) and starting the auth server on a build/license without the HSM entitlement enabled.

Common situations: Migrating config from an Enterprise HSM-enabled cluster to one licensed without HSM; forgetting to upload the new license after enabling GCP KMS; OSS binaries picking up Enterprise config files.

Related errors

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/5f5cc0518d8d9fe1. Report an issue: GitHub.