{"record":{"id":"1cf54fca806665f1","repo":"getsops/sops","slug":"failed-to-construct-azure-key-vault-client-to-decr","errorCode":null,"errorMessage":"failed to construct Azure Key Vault client to decrypt data: %w","messagePattern":"failed to construct Azure Key Vault client to decrypt data: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"azkv/keysource.go","lineNumber":278,"sourceCode":"// DecryptContext decrypts the EncryptedKey field with Azure Key Vault and returns\n// the result.\nfunc (key *MasterKey) DecryptContext(ctx context.Context) ([]byte, error) {\n\ttoken, err := key.getTokenCredential()\n\tif err != nil {\n\t\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Decryption failed\")\n\t\treturn nil, fmt.Errorf(\"failed to get Azure token credential to decrypt: %w\", err)\n\t}\n\n\trawEncryptedKey, err := base64.RawURLEncoding.DecodeString(key.EncryptedKey)\n\tif err != nil {\n\t\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Decryption failed\")\n\t\treturn nil, fmt.Errorf(\"failed to base64 decode Azure Key Vault encrypted key: %w\", err)\n\t}\n\n\tc, err := azkeys.NewClient(key.VaultURL, token, key.clientOptions)\n\tif err != nil {\n\t\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Decryption failed\")\n\t\treturn nil, fmt.Errorf(\"failed to construct Azure Key Vault client to decrypt data: %w\", err)\n\t}\n\n\tresp, err := c.Decrypt(ctx, key.Name, key.Version, azkeys.KeyOperationParameters{\n\t\tAlgorithm: to.Ptr(azkeys.EncryptionAlgorithmRSAOAEP256),\n\t\tValue:     rawEncryptedKey,\n\t}, nil)\n\tif err != nil {\n\t\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Decryption failed\")\n\t\treturn nil, fmt.Errorf(\"failed to decrypt sops data key with Azure Key Vault key '%s': %w\", key.ToString(), err)\n\t}\n\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Decryption succeeded\")\n\treturn resp.KeyOperationResult.Result, nil\n}\n\n// NeedsRotation returns whether the data key needs to be rotated or not.\nfunc (key *MasterKey) NeedsRotation() bool {\n\treturn time.Since(key.CreationDate) > (azkvTTL)\n}","sourceCodeStart":260,"sourceCodeEnd":296,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/azkv/keysource.go#L260-L296","documentation":"Raised in DecryptContext when azkeys.NewClient fails to construct the Azure Key Vault client, typically because the VaultURL is not a valid URL. Client construction happens after credential acquisition and base64 decoding, so this points at the vault URL configuration rather than auth.","triggerScenarios":"Calling Decrypt on an Azure KV MasterKey whose VaultURL field is empty, malformed (missing scheme, stray characters), or otherwise rejected by azkeys.NewClient.","commonSituations":"Missing vault_url in the .sops.yaml Azure KV key entry, hand-written vault URL like 'myvault' instead of 'https://myvault.vault.azure.net/', templated config where the vault URL variable resolved empty.","solutions":["Set the full vault URL in .sops.yaml, e.g. vault_url: 'https://<vault-name>.vault.azure.net/'","Check that the config key field is not empty or mis-indented so it parses into MasterKey.VaultURL","Fix templating/env substitution that left the vault URL blank"],"exampleFix":"// before\nazure_kv:\n  - vault_url: myvault\n// after\nazure_kv:\n  - vault_url: 'https://myvault.vault.azure.net/'\n    key: mykey","handlingStrategy":"validation","validationCode":"u, err := url.Parse(key.VaultURL)\nvalid := err == nil && u.Scheme == \"https\" && strings.HasSuffix(u.Hostname(), \".vault.azure.net\")\nif !valid { return fmt.Errorf(\"invalid vault_url %q; use https://<name>.vault.azure.net/\", key.VaultURL) }","typeGuard":null,"tryCatchPattern":"if err := masterKey.Decrypt(); err != nil {\n\tif strings.Contains(err.Error(), \"failed to construct Azure Key Vault client\") {\n\t\treturn fmt.Errorf(\"check vault_url in .sops.yaml: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Always use the full https://<vault>.vault.azure.net/ form for vault_url","Avoid templating vault_url from env vars that may resolve empty","Keep .sops.yaml indentation consistent so fields parse into the right struct slots","Copy vault URLs directly from `az keyvault show` output"],"tags":["azure","key-vault","configuration","client"],"backgroundTag":"invalid-vault-url","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}