{"record":{"id":"00d2c78fbefabc6e","repo":"opentofu/opentofu","slug":"invalid-key-vault-name-azure-requires-a-key-vault","errorCode":null,"errorMessage":"invalid key vault name: Azure requires a key vault name consists of 3-24 letters, numbers, and hyphens only. It must start with a letter and cannot end with a hyphen. See documentation here: https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/resource-name-rules#microsoftkeyvault","messagePattern":"invalid key vault name: Azure requires a key vault name consists of 3-24 letters, numbers, and hyphens only\\. It must start with a letter and cannot end with a hyphen\\. See documentation here: https://learn\\.microsoft\\.com/en-us/azure/azure-resource-manager/management/resource-name-rules#microsoftkeyvault","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/encryption/keyprovider/azure_vault/config.go","lineNumber":230,"sourceCode":"\tkeyNamePattern := regexp.MustCompile(`^[0-9a-zA-Z\\-]{1,127}$`)\n\tvaultPattern := regexp.MustCompile(`^[a-zA-Z][0-9a-zA-Z\\-]{1,22}[0-9a-zA-Z]$`)\n\thyphenPattern := regexp.MustCompile(`\\-\\-`)\n\tif !keyNamePattern.Match([]byte(keyName)) {\n\t\treturn errors.New(\"invalid key name: Azure requires a key name consists of 1-127 letters, numbers, or hyphens. See documentation here: https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/resource-name-rules#microsoftkeyvault\")\n\t}\n\t// Break apart the URL into parts\n\tu, err := url.Parse(vaultUrl)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"invalid key vault URL: %w\", err)\n\t}\n\thostname := u.Hostname()\n\thostParts := strings.Split(hostname, \".\")\n\tif len(hostParts) == 0 {\n\t\treturn errors.New(\"invalid vault host name: no subdomain found\")\n\t}\n\tvaultName := hostParts[0]\n\tif !vaultPattern.Match([]byte(vaultName)) {\n\t\treturn errors.New(\"invalid key vault name: Azure requires a key vault name consists of 3-24 letters, numbers, and hyphens only. It must start with a letter and cannot end with a hyphen. See documentation here: https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/resource-name-rules#microsoftkeyvault\")\n\t}\n\tif hyphenPattern.Match([]byte(vaultName)) {\n\t\treturn errors.New(\"invalid key vault name: Hyphens in a key vault name must be nonconsecutive. See documentation here: https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/resource-name-rules#microsoftkeyvault\")\n\t}\n\treturn nil\n}\n","sourceCodeStart":212,"sourceCodeEnd":237,"githubUrl":"https://github.com/opentofu/opentofu/blob/3561785c48c1ce615e7c50261bd351f26053efa2/internal/encryption/keyprovider/azure_vault/config.go#L212-L237","documentation":"The subdomain of the parsed vault_uri hostname must match ^[a-zA-Z][0-9a-zA-Z-]{1,22}[0-9a-zA-Z]$, i.e. 3-24 characters, starting with a letter, ending with a letter/digit, containing only alphanumerics and hyphens. This mirrors Azure's Key Vault naming rules and is checked in Config.Build() before contacting Azure, wrapped as ErrInvalidConfiguration.","triggerScenarios":"A vault_uri whose first hostname label violates the pattern: name starting with a digit, ending with a hyphen, containing underscores, being 1-2 or 25+ characters, or an empty hostname (e.g. 'https://vault.azure.net' where the subdomain 'vault' is a placeholder, or an empty host which yields vaultName \"\").","commonSituations":"Using the generic docs example URL, omitting the vault name, pasting a management-plane or portal URL instead of the vault DNS name, or a vault name with underscore typed by mistake.","solutions":["Set vault_uri to the 'DNS Name' value from the vault's Overview page in the Azure portal (https://<vault-name>.vault.azure.net)","Check the vault name is 3-24 chars, starts with a letter, ends with a letter/digit, and uses only alphanumerics and hyphens","For non-public clouds, use the correct domain suffix (e.g. vault.azure.us, vault.microsoftazure.de) with the vault name as subdomain"],"exampleFix":"// before\nvault_uri = \"https://vault.azure.net/\"\n\n// after\nvault_uri = \"https://my-vault-2024.vault.azure.net/\"","handlingStrategy":"validation","validationCode":"var reVault = regexp.MustCompile(`^[a-zA-Z][0-9a-zA-Z-]{1,22}[0-9a-zA-Z]$`)\nu, _ := url.Parse(cfg.VaultURI)\nname := strings.Split(u.Hostname(), \".\")[0]\nif !reVault.MatchString(name) {\n    return fmt.Errorf(\"vault name %q must be 3-24 chars, start with a letter, end with a letter/digit\", name)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Source vault_uri from the portal 'DNS Name' field, never from examples or memory","Include the azure_vault encryption config in automated config checks before init"],"tags":["azure","keyvault","encryption","config-validation"],"backgroundTag":null,"analyzedSha":"3561785c48c1ce615e7c50261bd351f26053efa2","analyzedAt":"2026-08-15T23:27:16.226Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}