{"record":{"id":"4acec50b301c584c","repo":"JuliusBrussee/caveman","slug":"kms-invalid-scaleway-key-id","errorCode":null,"errorMessage":"kms: invalid Scaleway key ID","messagePattern":"kms: invalid Scaleway key ID","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shared/platform/kms/kms.go","lineNumber":341,"sourceCode":"\tif err != nil {\n\t\treturn fmt.Errorf(\"kms: probe encrypt: %w\", err)\n\t}\n\tdecrypted, err := c.Decrypt(ctx, envelope)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"kms: probe decrypt: %w\", err)\n\t}\n\tif !bytes.Equal(decrypted, plaintext) {\n\t\treturn errors.New(\"kms: probe plaintext mismatch\")\n\t}\n\treturn nil\n}\n\nfunc validateLocation(region, keyID string) error {\n\tif !regionPattern.MatchString(region) {\n\t\treturn errors.New(\"kms: invalid Scaleway region\")\n\t}\n\tif !keyIDPattern.MatchString(keyID) {\n\t\treturn errors.New(\"kms: invalid Scaleway key ID\")\n\t}\n\treturn nil\n}\n\nfunc (c *Client) call(ctx context.Context, region, keyID, operation string, input, output any) error {\n\tbody, err := json.Marshal(input)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"kms: encode %s request: %w\", operation, err)\n\t}\n\tendpoint := c.apiBaseURL + \"/key-manager/v1alpha1/regions/\" + url.PathEscape(region) +\n\t\t\"/keys/\" + url.PathEscape(keyID) + \"/\" + operation\n\treq, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(body))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"kms: create %s request: %w\", operation, err)\n\t}\n\treq.Header.Set(\"content-type\", \"application/json\")\n\treq.Header.Set(\"accept\", \"application/json\")\n\treq.Header.Set(\"x-auth-token\", c.token)","sourceCodeStart":323,"sourceCodeEnd":359,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/3ee70a102609e550bd2e68004bf5990a9341c851/shared/platform/kms/kms.go#L323-L359","documentation":"validateLocation checks the key ID against keyIDPattern (a UUID-formatted identifier in Scaleway KMS). A key ID that is empty, malformed, or from another provider fails this check at New or when Decrypt composes the key URL.","triggerScenarios":"Config.KeyID empty, containing dashes/spaces or a key name/alias instead of the UUID, or a truncated ID from a copy-paste.","commonSituations":"Using an AWS KMS key ARN or an alias in a Scaleway config, missing KEY_ID env var, or IDs extracted from logs with whitespace.","solutions":["Use the full Scaleway KMS key UUID from the console/API (e.g. 85xyt4nm-1baf-51ad-a37b-6bf4b3725440)","strings.TrimSpace the key ID read from env or config files","Validate the UUID format (uuid.Parse) before constructing the client"],"exampleFix":"// before\nkeyID := os.Getenv(\"KMS_KEY\") // \"my-master-key\"\n// after\nkeyID := strings.TrimSpace(os.Getenv(\"KMS_KEY_ID\")) // full UUID\nif _, err := uuid.Parse(keyID); err != nil { return err }","handlingStrategy":"validation","validationCode":"if _, err := uuid.Parse(strings.TrimSpace(cfg.KeyID)); err != nil {\n\treturn fmt.Errorf(\"KMS key ID must be a UUID: %q\", cfg.KeyID)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Store the full Scaleway key UUID, not names/aliases/ARNs","Trim whitespace when reading IDs from env or files","Validate key IDs with uuid.Parse at config load"],"tags":["kms","config","validation"],"backgroundTag":"invalid-identifier-format","analyzedSha":"3ee70a102609e550bd2e68004bf5990a9341c851","analyzedAt":"2026-09-20T15:53:39.229Z","contentChangedAt":"2026-09-20T15:53:39.229Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}