# Issue KMS vault transit with boundary enterprise ( seft-managed )

**URL:** <https://discuss.hashicorp.com/t/issue-kms-vault-transit-with-boundary-enterprise-seft-managed/63423>\
**Category:** Boundary\
**Created:** [March 6, 2024, 12:59am UTC](https://discuss.hashicorp.com/t/issue-kms-vault-transit-with-boundary-enterprise-seft-managed/63423 "2024-03-06T00:59:32Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![epotest39](https://avatars.discourse-cdn.com/v4/letter/e/8491ac/32.png) [@epotest39](https://discuss.hashicorp.com/u/epotest39)\
**Post date:** [March 6, 2024, 12:59am UTC](https://discuss.hashicorp.com/t/issue-kms-vault-transit-with-boundary-enterprise-seft-managed/63423/1 "2024-03-06T00:59:32Z")

</div>

Dear teams,

I build boundary enterpise ( seft-managed ) demo but have issue kms :" Error parsing KMS configuration: error fetching kms plugin rpc client: fork/exec /tmp/3469086231/boundary-plugin-kms-transit-bhkZe: permission denied"

version : Boundary Enterprise. 15

After confgi Vault transit,  
I run command:  
journalctl -u boundary

and see issue : boundary[34499]: Error parsing KMS configuration: error fetching kms plugin rpc client: fork/exec /tmp/3469086231/boundary-plugin-kms-transit-bhkZe: permission denied

config file controller.hcl :

kms “transit” {  
purpose = “root”  
address = “[http://x.x.x.x:8200](http://x.x.x.x:8200)”  
token = “hvs.CAESIMn-K-a-jBPJ3zA6t75JVoW-1Svu4SFpBDk77l777hiEKHGh2cy5idm0zWFNUVjlyN3JwUDhmUVdkYnp6UlEQ3Sg”

disable\_renewal = “false”

// Key configuration  
key\_name = “boundary”  
mount\_path = “transit/”

// TLS Configuration  
tls\_skip\_verify = “true”  
}

Please help me recommend follow config fix it, I think misconfiguration.

Many thanks for your teams support.

---

<div class="post-metadata">

**Author:** ![jeff](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jeff/32/12882_2.png) [@jeff](https://discuss.hashicorp.com/u/jeff)\
**Post date:** [March 7, 2024, 4:46pm UTC](https://discuss.hashicorp.com/t/issue-kms-vault-transit-with-boundary-enterprise-seft-managed/63423/2 "2024-03-07T16:46:18Z")

</div>

The issue is that it is trying to spin out plugin binaries to execute them but it is unable to. You should specify a custom directory via [Plugins - configuration | Boundary | HashiCorp Developer](https://developer.hashicorp.com/boundary/docs/configuration/plugins) where the files Boundary writes in are able to be executed.

---

<div class="post-metadata">

**Author:** ![epotest39](https://avatars.discourse-cdn.com/v4/letter/e/8491ac/32.png) [@epotest39](https://discuss.hashicorp.com/u/epotest39)\
**Post date:** [March 8, 2024, 12:36am UTC](https://discuss.hashicorp.com/t/issue-kms-vault-transit-with-boundary-enterprise-seft-managed/63423/3 "2024-03-08T00:36:48Z")

</div>

Hi Mr. Jeft.

Thank for your support, I config Plugins add to file controller.hcl  
"plugins {  
execution\_dir = “/var/run/boundary/plugin-exec”  
}  
"

But have error:

Error parsing KMS configuration: error writing out plugin for execution: open /var/run/boundary/plugin-exec/boundary-plugin-kms-transit-kQd45: permission deni\>  
boundary[52361]: Error parsing KMS configuration: error fetching kms plugin rpc client: fork/exec /tmp/1429644624/boundary-plugin-kms-transit-69osd: permission denied  
Error parsing KMS configuration: error writing out plugin for execution: open /var/run/boundary/plugin-exec/boundary-plugin-kms-transit-QU0NA: no such file or\>  
I think miss configuration "namespace "transit with vault ? Please recommend config fix error: permission denied.

Many thanks,  
EP

---

<div class="post-metadata">

**Author:** ![jeff](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jeff/32/12882_2.png) [@jeff](https://discuss.hashicorp.com/u/jeff)\
**Post date:** [March 12, 2024, 5:31pm UTC](https://discuss.hashicorp.com/t/issue-kms-vault-transit-with-boundary-enterprise-seft-managed/63423/4 "2024-03-12T17:31:06Z")

</div>

It looks like `/var/run` may be a symlink to `/tmp` (which is not uncommon), and you still don’t have permission to execute binaries in that space, which may be due to how tmpfs is mounted. Try using a different directory outside tmpfs and see if that helps.

---

<div class="post-metadata">

**Author:** ![epotest39](https://avatars.discourse-cdn.com/v4/letter/e/8491ac/32.png) [@epotest39](https://discuss.hashicorp.com/u/epotest39)\
**Post date:** [March 13, 2024, 1:19am UTC](https://discuss.hashicorp.com/t/issue-kms-vault-transit-with-boundary-enterprise-seft-managed/63423/5 "2024-03-13T01:19:18Z")

</div>

Hi Mr. Jeft,

Thank for your support. Error fix but have new error 🙂

Mar 13 07:58:58 server-boundary boundary[22270]: Error parsing KMS configuration: error setting configuration on the kms plugin: rpc error: code = Unknown desc = Error making API request.  
Mar 13 07:58:58 server-boundary boundary[22270]: URL: PUT [http://x](http://x)…x.x.x:8200/v1/transit/encrypt/boundary  
Mar 13 07:58:58 server-boundary boundary[22270]: Code: 403. Errors:  
Mar 13 07:58:58 server-boundary boundary[22270]: \* permission denied

This is error config transit kms “namespace” on server vault ? Please recommend resolved misconfiguration fix it.

Many thanks,

EP