JuliusBrussee/caveman · error

kms: invalid Scaleway region

Error message

kms: invalid Scaleway region

What it means

validateLocation checks the region against regionPattern before building KMS API URLs. A region not matching the expected Scaleway region format (e.g. fr-par) produces this error at client construction (New) or decrypt-time URL composition.

Solutions

1. Use a valid Scaleway region such as fr-par, nl-ams, or pl-waw
2. Check the REGION/env value with strings.TrimSpace and lowercase before passing to New
3. Log the region value at startup to catch config plumbing errors early

Example fix

// before
region := strings.ToUpper(os.Getenv("REGION")) // "FR-PAR"
// after
region := strings.ToLower(strings.TrimSpace(os.Getenv("REGION"))) // "fr-par"

region := strings.ToLower(strings.TrimSpace(cfg.Region))
if !regexp.MustCompile(`^[a-z]{2}-[a-z]{3}$`).MatchString(region) {
	return fmt.Errorf("invalid Scaleway region: %q", cfg.Region)
}

When it happens

Trigger: Config.Region left empty, set to a wrong identifier ("paris", "eu-west-1", "FR-PAR"), or built from a malformed env var.

Common situations: Copy-pasting AWS region names into a Scaleway config, missing REGION env var, typos or uppercase region strings from deployment templates.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• kms: invalid Scaleway key ID
• kms: unsupported provider
• cave_breaker_retry_backoff_invalid
• cave_breaker_retry_requires_budget
• cave_breaker_retry_spend_invalid

AI-assisted analysis of JuliusBrussee/caveman@3ee70a1026 (2026-09-20). Data as JSON: /api/errors/e02a3b5e08045b08. Report an issue: GitHub.

Appendix: source

Thrown at shared/platform/kms/kms.go:338

		return fmt.Errorf("kms: generate probe: %w", err)
	}
	envelope, err := c.Encrypt(ctx, plaintext)
	if err != nil {
		return fmt.Errorf("kms: probe encrypt: %w", err)
	}
	decrypted, err := c.Decrypt(ctx, envelope)
	if err != nil {
		return fmt.Errorf("kms: probe decrypt: %w", err)
	}
	if !bytes.Equal(decrypted, plaintext) {
		return errors.New("kms: probe plaintext mismatch")
	}
	return nil
}

func validateLocation(region, keyID string) error {
	if !regionPattern.MatchString(region) {
		return errors.New("kms: invalid Scaleway region")
	}
	if !keyIDPattern.MatchString(keyID) {
		return errors.New("kms: invalid Scaleway key ID")
	}
	return nil
}

func (c *Client) call(ctx context.Context, region, keyID, operation string, input, output any) error {
	body, err := json.Marshal(input)
	if err != nil {
		return fmt.Errorf("kms: encode %s request: %w", operation, err)
	}
	endpoint := c.apiBaseURL + "/key-manager/v1alpha1/regions/" + url.PathEscape(region) +
		"/keys/" + url.PathEscape(keyID) + "/" + operation
	req, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(body))
	if err != nil {
		return fmt.Errorf("kms: create %s request: %w", operation, err)
	}

View on GitHub (pinned to 3ee70a1026)