SOPS 3.11 unable to encrypt a file with encryption context on AWS KMS

I have a KMS key set up with an alias, and a policy that requires an encryption context. Using 3.11.0, I'm unable to encrypt a fresh file:

❯ sops --verbose -i -e --encryption-context AppName:vantage values.encrypted.yaml
[AWSKMS]         INFO[0000] Encryption failed                             arn="arn:aws:kms:eu-west-2:123412341234:alias/shearn89-sandbox-myapp-sops"
Could not generate data key: [failed to encrypt new data key with master key "arn:aws:kms:eu-west-2:123412341234:alias/shearn89-sandbox-myapp-sops": failed to encrypt sops data key with AWS KMS: operation error KMS: Encrypt, https response error StatusCode: 400, RequestID: guid, api error AccessDeniedException: User: arn:aws:iam::123412341234:user/alex.shearn is not authorized to perform: kms:Encrypt on resource: arn:aws:kms:eu-west-2:123412341234:key/key-guid with an explicit deny in a resource-based policy]

If I remove the context statement, it works. If I downgrade to 3.10.2, it also works...

Policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Delegate access to IAM",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123412341234:root"
      },
      "Action": "kms:*",
      "Resource": "*"
    },
    {
      "Sid": "Explicitly require encryption context for enc/decrypt operations, overriding IAM",
      "Effect": "Deny",
      "Principal": {
        "AWS": "*"
      },
      "Action": [
        "kms:ReEncrypt*",
        "kms:GenerateDataKey*",
        "kms:Encrypt",
        "kms:Decrypt"
      ],
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "kms:EncryptionContext:AppName": "myapp"
        }
      }
    }
  ]
}

This works for me:

export AWS_PROFILE=sso-demo
sops encrypt \
  --encrypted-regex '^(data|stringData)$' \
  --in-place \
  --kms arn:aws:kms:eu-west-2:<redacted>:key/<redacted> \
  --encryption-context foo:bar \
  secret.yaml

Result:

apiVersion: v1
kind: Secret
metadata:
    name: flux-github-app-demo-app
    namespace: flux-system
    labels:
        reconcile.fluxcd.io/watch: Enabled
type: Opaque
stringData:
    githubAppID: <redacted>
    githubAppInstallationID: <redacted>
    githubAppPrivateKey: <redacted>
sops:
    kms:
        - arn: arn:aws:kms:eu-west-2:<redacted>:key/<redacted>
          context:
            foo: bar
          created_at: "2025-10-21T13:07:05Z"
          enc: <redacted>
          aws_profile: ""
    lastmodified: "2025-10-21T13:07:06Z"
    mac: <redacted>
    encrypted_regex: ^(data|stringData)$
    version: 3.11.0

Decryption also works:

sops decrypt --in-place secret.yaml

Result:

apiVersion: v1
kind: Secret
metadata:
    name: flux-github-app-demo-app
    namespace: flux-system
    labels:
        reconcile.fluxcd.io/watch: Enabled
type: Opaque
stringData:
    githubAppID: <redacted>
    githubAppInstallationID: <redacted>
    githubAppPrivateKey: |
        <redacted>

Would you mind sharing a redacted snippet of the KMS key policy applied to the key, I wonder if that's my problem?

Here you go:

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "Enable IAM User Permissions",
			"Effect": "Allow",
			"Principal": {
				"AWS": "arn:aws:iam::<redacted>:root"
			},
			"Action": "kms:*",
			"Resource": "*"
		},
		{
			"Sid": "Allow kustomize-controller to decrypt using the key",
			"Effect": "Allow",
			"Principal": {
				"AWS": "arn:aws:iam::<redacted>:role/flux-d2-kustomize-controller"
			},
			"Action": [
				"kms:Decrypt",
				"kms:DescribeKey"
			],
			"Resource": "*"
		}
	]
}

This is more likely caused by a dependency upgrade (i.e. some behavior change in Amazon's SDK).

Okay - work is busy this week but if I get time I’ll try and build from source so I can do a git bisect to find the issue…

Okay - ran a git bisect, and 84c7673 is the first bad commit.

@felixfontein

Introduced in #1939, @felixfontein.

Happy to help with testing any branch fixes, or setting up example keys/policies. The policy in the first post is what we use, and then we set --encryption-context AppName:myapp on first encryption.

Hi - any chance this can be investigated? The git bisect clearly shows where the bug was introduced, and I've included an example KMS policy to require the context being passed.

I will try and get time myself but I'm not familiar with the code base.

The policy linked here doesn't actually Deny if the context is missing, so it passes anyway. The policy in my original post does Deny, hence the failure.

Hi - any chance this can be investigated? The git bisect clearly shows where the bug was introduced, and I've included an example KMS policy to require the context being passed.

I had this on my list of things to look at, but there was too much going on in the last months and I forgot about it... Sorry. I'm glad you were able to create a PR to fix t.

Any chance of a bugfix release for 3.11 anytime soon? 😁

Since features already have been merged the next release will be 3.12.0.

Navigation Menu

Repository navigation

SOPS 3.11 unable to encrypt a file with encryption context on AWS KMS #1972

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

SOPS 3.11 unable to encrypt a file with encryption context on AWS KMS #1972

Description

Activity

matheuscscp commented on Oct 21, 2025

shearn89 commented on Oct 21, 2025

matheuscscp commented on Oct 21, 2025

felixfontein commented on Oct 21, 2025

shearn89 commented on Oct 21, 2025

shearn89 commented on Oct 22, 2025

shearn89 commented on Oct 22, 2025

shearn89 commented on Oct 22, 2025

shearn89 commented on Dec 16, 2025

shearn89 commented on Dec 16, 2025

felixfontein commented on Dec 16, 2025

shearn89 commented on Jan 7, 2026

felixfontein commented on Jan 11, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions