Production deployments must disable Erlang crash dump files.
KMS handles plaintext key material in process heaps while encrypting, decrypting, deriving session envelopes, and serving HTTP requests. Erlang crash dumps can include process stack/heap data, messages, dictionaries, and runtime metadata. Treat any crash dump from a KMS node as secret material.
Required production setting:
ERL_CRASH_DUMP_BYTES=0
ERL_CRASH_DUMP_SECONDS=0 also disables crash dump writing. Prefer setting ERL_CRASH_DUMP_BYTES=0 in release/service/container environments.
Do not rely on erl +d for this control: OTP docs state +d suppresses crash dumps for internal emulator errors, but explicit erlang:halt/1 with a string and SIGUSR1 still force crash dumps.
KMS production startup fails unless ERL_CRASH_DUMP_BYTES=0 or ERL_CRASH_DUMP_SECONDS=0 is present.
Defense in depth:
- KMS marks the cache process sensitive.
- KMS marks HTTP API request processes sensitive while handling
/api/*requests. - Do not enable BEAM tracing or crash dump collection around KMS nodes.
- If a dump is created, handle it as a high-severity secret spill and rotate affected RMK/API/session/key material where possible.