hashicorp/nomad · error

failed to encrypt root key: %w

Error message

failed to encrypt root key: %w

What it means

After the KEK wrapper is built, encryptDEK calls wrapper.Encrypt on the root key material. If the provider's Encrypt call fails, the error is wrapped as "failed to encrypt root key". The key exists but could not be sealed with the KEK, so the wrapped key (KEKWrapper) cannot be persisted.

Source

Thrown at nomad/encrypter.go:875

	if provider == nil {
		panic("can't encrypt DEK without a provider")
	}
	var kek []byte
	var err error
	if provider.Provider == structs.KEKProviderAEAD || provider.Provider == "" {
		kek, err = crypto.Bytes(32)
		if err != nil {
			return nil, fmt.Errorf("failed to generate key wrapper key: %w", err)
		}
	}
	wrapper, err := e.newKMSWrapper(provider, rootKey.Meta.KeyID, kek)
	if err != nil {
		return nil, fmt.Errorf("unable to create key wrapper: %w", err)
	}

	rootBlob, err := wrapper.Encrypt(e.srv.shutdownCtx, rootKey.Key)
	if err != nil {
		return nil, fmt.Errorf("failed to encrypt root key: %w", err)
	}

	kekWrapper := &structs.WrappedKey{
		Provider:                 provider.Provider.String(),
		ProviderID:               provider.ID(),
		WrappedDataEncryptionKey: rootBlob,
		WrappedRSAKey:            &kms.BlobInfo{},
		KeyEncryptionKey:         kek,
	}

	// Only cipherSets created after 1.7.0 will contain an RSA key.
	if len(rootKey.RSAKey) > 0 {
		rsaBlob, err := wrapper.Encrypt(e.srv.shutdownCtx, rootKey.RSAKey)
		if err != nil {
			return nil, fmt.Errorf("failed to encrypt rsa key: %w", err)
		}
		kekWrapper.WrappedRSAKey = rsaBlob
	}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Check connectivity and auth to the KMS backend; renew/refresh tokens or credentials.
2. Verify the KEK key ID exists in the backend and the server's identity has Encrypt permissions on it.
3. Inspect the wrapped inner error — KMS provider libraries return specific codes (e.g., NotFound, AccessDenied).
4. If the shutdown context was canceled, simply retry after the server is stable.

blob, err := encryptDEK(...)
if err != nil && strings.Contains(err.Error(), "failed to encrypt root key") {
    // check KMS connectivity/auth, then retry with backoff
}

When it happens

Trigger: wrapper.Encrypt(e.srv.shutdownCtx, rootKey.Key) returns an error — KMS backend rejected the encrypt (bad key ID, expired credentials, network error, shutdown context canceled), or local AEAD seal failed.

Common situations: Vault Transit endpoint unreachable or token expired; AWS KMS key not found or IAM denies kms:Encrypt; network partition between server and KMS; server shutting down (canceled shutdownCtx).

Related errors

• unable to decrypt wrapped key
• could not encrypt: %w
• %w (root key): %w
• %w (rsa key): %w
• could not configure cipher: %w

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/78ce2e8ca277040c. Report an issue: GitHub.