S3 Vectors: an engine without the SSE-S3 key answers ValidationException

After seaweedfs#12484, an index of an encrypted bucket on an engine
without s3.sse.kek or s3.sse.key is refused with the reason instead of
InternalFailure.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011UpvafvK8JpagF94MHWqwK

S3-Vector-Bucket.md

@@ -256,7 +256,7 @@ neuromancer 0.1 {'genre': 'scifi', 'pages': 271, 'summary': 'Cyberspace heist.'}
 * **Ports.** The default `8090` is free next to `weed mini` and `weed server`, whose volume server uses `8080`. If the port is taken, `weed-vector` exits with `Error: listen on 127.0.0.1:8090` and `Address already in use (os error 98)`; pass another `--listen`.
 * **Engine on another host.** With a wildcard address such as `--listen 0.0.0.0:8090`, the engine registers the IP it uses to reach the first master.
 * **What it reads from `security.toml`.** The same settings the weed processes use, with `WEED_*` environment variables over the file: `[grpc.vector]` for its own listener and `[grpc.client]` for the masters and the filers, `https.client` for volume servers under HTTPS, `jwt.signing.read.key` where volume reads are signed, and `s3.sse.kek` or `s3.sse.key` for vector buckets with SSE-S3 encryption (a KEK the filer holds as `/etc/s3/sse_kek` is read too).
-* **Encrypted vector buckets.** The engine writes the index files itself, so for a bucket created with `encryptionConfiguration` `{"sseType": "AES256"}` it needs the gateway's SSE-S3 key. Without it, `CreateIndex` on such a bucket fails with `InternalFailure`, and the S3 gateway logs `the bucket encrypts with SSE-S3, which needs s3.sse.kek or s3.sse.key for the engine as for the S3 gateway`. `weed mini` generates its key into `.mini_sse_kek` in its data directory and gives it only to its own S3 server, so start the engine with it:
+* **Encrypted vector buckets.** The engine writes the index files itself, so for a bucket created with `encryptionConfiguration` `{"sseType": "AES256"}` it needs the gateway's SSE-S3 key. Without it, every index operation on such a bucket is refused with `ValidationException: the bucket encrypts with SSE-S3, which needs s3.sse.kek or s3.sse.key for the engine as for the S3 gateway` (before [#12484](https://github.com/seaweedfs/seaweedfs/pull/12484), `CreateIndex` failed with `InternalFailure` and the message was only in the gateway log). `weed mini` generates its key into `.mini_sse_kek` in its data directory and gives it only to its own S3 server, so start the engine with it:
 
   ```bash
   WEED_S3_SSE_KEK=$(cat /data/seaweedfs/.mini_sse_kek) weed-vector --masters localhost:9333
@@ -421,7 +421,7 @@ S3 Vectors: discovered weed-vector at 127.0.0.1:8090 via master 172.17.0.3:9333
 | Symptom | Cause |
 |---------|-------|
 | `ServiceUnavailableException: vector service unavailable` on `CreateIndex`, `PutVectors` or `QueryVectors`, and the gateway logs `no weed-vector registered on master` | No engine is registered: it is not running, it has no `--masters`, or it exited (for example on a busy `--listen` port). Bucket operations keep working. |
-| `InternalFailure: internal error, see the S3 gateway log` on `CreateIndex` in an encrypted bucket, and the gateway logs `the bucket encrypts with SSE-S3, which needs s3.sse.kek or s3.sse.key for the engine as for the S3 gateway` | The engine has no SSE-S3 key. Give it the gateway's; see [Running the engine](#running-the-engine). |
+| `ValidationException: the bucket encrypts with SSE-S3, which needs s3.sse.kek or s3.sse.key for the engine as for the S3 gateway` on an index of an encrypted bucket | The engine has no SSE-S3 key. Give it the gateway's; see [Running the engine](#running-the-engine). |
 | `weed-vector` exits with `error: unexpected argument '--storage-option' found` | A command line written for release 4.52 or earlier. Drop the `--storage-option` flags; the engine needs no S3 credentials. |
 | `weed-vector` exits with `Address already in use (os error 98)` | The `--listen` port is taken; see the ports note above. |
 | `PutVectors` fails with `ValidationException: request body exceeds 32 MiB` | Send fewer vectors per call. In our tests 500 vectors of 4096 dimensions took 9.8 to 33.2 MiB as JSON, depending on the digits per value. |

S3-Vectors-API.md

@@ -20,7 +20,7 @@ Every bucket and index can be addressed by name or by ARN. ARNs always use regio
 
 * **Names**: 3 to 63 characters, lowercase letters, digits and hyphens, starting and ending with a letter or digit.
 * **Deleting** a bucket that still has indexes fails with `ConflictException`.
-* **Encryption**: with `encryptionConfiguration` `{"sseType": "AES256"}`, every object of the bucket's indexes is written with SSE-S3: `HeadObject` on them shows `ServerSideEncryption: AES256`, and queries work as in an unencrypted bucket. `GetVectorBucket` returns the setting. It needs an SSE-S3 key on the S3 gateway (`s3.sse.kek` or `s3.sse.key` in `security.toml`; `weed mini` creates one); without a key, `CreateVectorBucket` is refused with `AES256 encryption needs an SSE-S3 key on the S3 gateway: set s3.sse.kek or s3.sse.key in security.toml`. `weed-vector` writes the index files itself and needs the same key, or `CreateIndex` fails with `InternalFailure`; with `weed mini`, pass it the generated one (see [[S3 Vector Bucket#running-the-engine]]). `aws:kms` is rejected with `unsupported sseType "aws:kms"`.
+* **Encryption**: with `encryptionConfiguration` `{"sseType": "AES256"}`, every object of the bucket's indexes is written with SSE-S3: `HeadObject` on them shows `ServerSideEncryption: AES256`, and queries work as in an unencrypted bucket. `GetVectorBucket` returns the setting. It needs an SSE-S3 key on the S3 gateway (`s3.sse.kek` or `s3.sse.key` in `security.toml`; `weed mini` creates one); without a key, `CreateVectorBucket` is refused with `AES256 encryption needs an SSE-S3 key on the S3 gateway: set s3.sse.kek or s3.sse.key in security.toml`. `weed-vector` writes the index files itself and needs the same key, or index operations on the bucket are refused with `ValidationException: the bucket encrypts with SSE-S3, which needs s3.sse.kek or s3.sse.key for the engine as for the S3 gateway`; with `weed mini`, pass it the generated one (see [[S3 Vector Bucket#running-the-engine]]). `aws:kms` is rejected with `unsupported sseType "aws:kms"`.
 * A vector bucket is a table bucket with format `LANCE`, and its objects are visible through the S3 API under `vector/<index>/`.
 
 ## Indexes