Alert: KEKUnwrapFailure¶
Symptom¶
Loki detected imaging_envelope_decrypt_failed in lastvet-api audit logs (KEK unwrap failure path).
Immediate action¶
ssh lastvet-api 'journalctl -u lastvet-api-prod -u lastvet-api-staging --since "15 min ago" | grep imaging_envelope_decrypt_failed'
Diagnosis¶
- Confirm whether test traffic or real veteran imaging request.
- Check KEK availability on lastvet-imaging and API env (BWS-sourced secrets).
- Review recent deploy or secret rotation.
Escalation¶
Ryan immediately; may indicate crypto misconfiguration or data access failure.
Resolution history¶
| Date | Notes |
|---|---|