mongodb/mongoid · error · Mongoid::Errors::InvalidAutoEncryptionConfiguration

Automatic encryption configuration for client

Error message

Automatic encryption configuration for client %{client} does include options for kms_provider %{kms_provider}

What it means

Raised by Mongoid::Tasks::Encryption#prepare_arguments when creating a data key for a client whose auto_encryption_options do not include an entry for the requested kms_provider. The KMS provider must first be configured under auto_encryption_options.kms_providers; the faulting input is the missing kms_provider name for that client.

Solutions

1. Add the KMS provider credentials (e.g. aws, azure, gcp, local) under kms_providers in mongoid.yml
2. Fix the provider name spelling passed via --kms_provider_name

When it happens

Trigger: Thrown at lib/mongoid/tasks/encryption.rb:73 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of mongodb/mongoid@0da0e23d71 (2026-08-23). Data as JSON: /api/errors/eec32b987389ff41. Report an issue: GitHub.

Appendix: source

Thrown at lib/mongoid/tasks/encryption.rb:73

      #   normalized kms provider name, the kms providers hash, and the key
      #   vault namespace.
      def prepare_arguments(kms_provider_name, client_name)
        client = (client_name || 'default').to_s
        client_options = Mongoid.clients[client]
        raise Errors::NoClientConfig.new(client) unless client_options.is_a?(Hash)

        auto_encryption_options = client_options.dig(:options, :auto_encryption_options)
        raise Errors::InvalidAutoEncryptionConfiguration.new(client) unless auto_encryption_options.is_a?(Hash)

        key_vault_namespace = auto_encryption_options[:key_vault_namespace]
        raise Errors::InvalidAutoEncryptionConfiguration.new(client) unless key_vault_namespace.is_a?(String)

        kms_providers = auto_encryption_options[:kms_providers]
        raise Errors::InvalidAutoEncryptionConfiguration.new(client) unless kms_providers.is_a?(Hash)

        valid_kms_provider_name = get_kms_provider_name(kms_provider_name, kms_providers)
        unless kms_providers.key?(valid_kms_provider_name)
          raise Errors::InvalidAutoEncryptionConfiguration.new(client, valid_kms_provider_name)
        end

        [ valid_kms_provider_name, kms_providers, key_vault_namespace ]
      end

      # Get kms provider name to use for creating a data key.
      #
      # If kms_provider_name is provided, it will be used. Otherwise, if there
      # is only one kms provider, that provider will be used. Otherwise, an
      # error will be raised.
      #
      # @param [ String | nil ] kms_provider_name The name of the kms provider
      #   as provided by the user.
      # @param [ Hash ] kms_providers The kms providers hash from the client's
      #   auto_encryption_options.
      #
      # @return [ String ] The kms provider name to use for creating a data
      #   key.

View on GitHub (pinned to 0da0e23d71)