Errors about "Encrypted Saved Objects plugin is missing encryption key" are marked as user errors

[mikecote]

I noticed in the actions plugin whenever an error of Unable to execute action because the Encrypted Saved Objects plugin is missing encryption key. Please set xpack.encryptedSavedObjects.encryptionKey in the kibana.yml or use the bin/kibana-encryption-keys command. is thrown, we mark it as a user error (link to code).

Given in serverless we control the encryption key, we should be the ones aware and notified if ever the field is missing.

cc @elastic/response-ops-execution @kobelb @heespi

[kobelb]

Great catch, @mikecote. In ESS dedicated, this would be the same also, right? For on-prem, it's the only situation where we don't know if we broke something with the AAD or the customer changed the encryption key?

[mikecote]

@kobelb

In ESS dedicated, this would be the same also, right?

Correct, given we are in control of these encryption keys.

For on-prem, it's the only situation where we don't know if we broke something with the AAD or the customer changed the encryption key?

From following the code path down to the ESO plugin (link), this error will only occurs if an encryption key hasn't been set in the kibana.yml file. This will be good to indicate to on-prem system admins that something is wrong.

This part of the code doesn't capture errors caused by breaking something with the AAD, the AAD errors are reported as "framework" errors here (link) unless it's a 404, which would be caused by the user / test deleting the rule while it's running.