hashicorp/packer · error

signing_mode %q requires a recognized KMS or Vault URI: awsk

Error message

signing_mode %q requires a recognized KMS or Vault URI: awskms://, gcpkms://, azurekms://, or hashivault://

What it means

signingBackendConfig validates that a KMS signer reference starts with a recognized scheme via isRecognizedKMSSigner. Only awskms://, gcpkms://, azurekms://, and hashivault:// URIs are accepted for signing_mode "kms".

Source

Thrown at post-processor/provenance/post-processor.go:405

	switch mode {
	case internalattestation.SigningModeNone:
		return internalattestation.BackendConfig{Mode: mode}, nil
	case internalattestation.SigningModeKey:
		if signerRef == "" {
			return internalattestation.BackendConfig{}, fmt.Errorf("signing_mode %q requires signer or key", mode)
		}
		return internalattestation.BackendConfig{
			Mode:        mode,
			SignerRef:   signerRef,
			VerifierRef: p.config.Verifier,
			Env:         p.currentEnv(),
		}, nil
	case internalattestation.SigningModeKMS:
		if signerRef == "" {
			return internalattestation.BackendConfig{}, fmt.Errorf("signing_mode %q requires signer or key", mode)
		}
		if !isRecognizedKMSSigner(signerRef) {
			return internalattestation.BackendConfig{}, fmt.Errorf("signing_mode %q requires a recognized KMS or Vault URI: awskms://, gcpkms://, azurekms://, or hashivault://", mode)
		}
		return internalattestation.BackendConfig{
			Mode:        mode,
			SignerRef:   signerRef,
			VerifierRef: p.config.Verifier,
			Env:         p.currentEnv(),
		}, nil
	case internalattestation.SigningModeKeyless:
		if p.config.Verifier != "" {
			return internalattestation.BackendConfig{}, fmt.Errorf("signing_mode %q does not support verifier overrides; keyless attestations are verified against keyless_identity and keyless_oidc_issuer", mode)
		}
		if strings.TrimSpace(p.config.KeylessIdentity) == "" || strings.TrimSpace(p.config.KeylessOIDCIssuer) == "" {
			return internalattestation.BackendConfig{}, fmt.Errorf("signing_mode %q requires keyless_identity and keyless_oidc_issuer", mode)
		}
		return internalattestation.BackendConfig{
			Mode:              mode,
			Env:               p.currentEnv(),
			FulcioURL:         p.config.FulcioURL,

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Prefix the reference with a supported scheme: awskms://, gcpkms://, azurekms://, or hashivault://.
2. Correct scheme typos (aws-kms:// -> awskms://, vault:// -> hashivault://).
3. Convert a bare key ARN to awskms://<arn-or-alias>.
4. Check isRecognizedKMSSigner in post-processor/provenance/post-processor.go for the current allow-list.

Example fix

// before
"signer": "arn:aws:kms:us-east-1:123456789:key/abcd"
// after
"signer": "awskms://arn:aws:kms:us-east-1:123456789:key/abcd"

var kmsSchemes = []string{"awskms://", "gcpkms://", "azurekms://", "hashivault://"}
func isRecognizedKMSSigner(v string) bool {
	for _, p := range kmsSchemes {
		if strings.HasPrefix(v, p) { return true }
	}
	return false
}
// check before configuring: isRecognizedKMSSigner(cfg.Signer)

if err := p.Configure(raws); err != nil {
	if strings.Contains(err.Error(), "recognized KMS or Vault URI") {
		return fmt.Errorf("fix signer URI scheme: %w", err)
	}
	return err
}

When it happens

Trigger: SigningModeKMS with non-empty signerRef whose value lacks a recognized prefix (e.g. plain key ID, file://, or a typo'd scheme like aws-kms://); raised in Configure/writeAttestation.

Common situations: Passing a bare AWS key ARN/alias instead of an awskms:// URI; using vault:// instead of hashivault://; using a scheme supported by cosign/other tooling but not this post-processor.

Related errors

• initialize KMS signer %q: %w%s
• initialize KMS signer %q: %w
• signing_mode %q requires signer
• build keyless identity policy: %w
• signing_mode %q requires keyless_identity and keyless_oidc_i

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/4fccce8e5085ff46. Report an issue: GitHub.