diff --git a/cmd/cluster/encryption/encryption.go b/cmd/cluster/encryption/encryption.go
index 3e56b359..e9e3f352 100644
--- a/cmd/cluster/encryption/encryption.go
+++ b/cmd/cluster/encryption/encryption.go
@@ -105,6 +105,10 @@ var updateCmk = &cobra.Command{
 			logrus.Fatalf("Unable to parse new CMK spec: %v", err)
 		}
 
+		if newCmkSpec.GetProviderType() != oldCmkSpec.GetProviderType() {
+			logrus.Fatalf("Modifying KMS provider is not allowed.")
+		}
+
 		// Need to copy over the AWS ARNs
 		if newCmkSpec.GetProviderType() == "AWS" {
 			newCmkSpec.AwsCmkSpec.Get().ArnList = oldCmkSpec.AwsCmkSpec.Get().ArnList