{"record":{"id":"76d80232340b3904","repo":"getsops/sops","slug":"failed-to-get-huaweicloud-credentials-w","errorCode":null,"errorMessage":"failed to get HuaweiCloud credentials: %w","messagePattern":"failed to get HuaweiCloud credentials: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"hckms/keysource.go","lineNumber":274,"sourceCode":"// TypeToIdentifier returns the string identifier for the MasterKey type.\nfunc (key *MasterKey) TypeToIdentifier() string {\n\treturn KeyTypeIdentifier\n}\n\n// createKMSClient creates a HuaweiCloud KMS client with the appropriate credentials\n// and region configuration.\nfunc (key *MasterKey) createKMSClient(ctx context.Context) (*huaweikms.KmsClient, error) {\n\tvar cred auth.ICredential\n\tvar err error\n\n\tif key.credentials != nil {\n\t\tcred = key.credentials\n\t} else {\n\t\t// Use default credential provider chain (env -> profile -> metadata)\n\t\tcredentialProviderChain := provider.BasicCredentialProviderChain()\n\t\tcred, err = credentialProviderChain.GetCredentials()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to get HuaweiCloud credentials: %w\", err)\n\t\t}\n\t}\n\n\t// Get KMS region with endpoint\n\treg, err := kmsregion.SafeValueOf(key.Region)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid region %q: %w\", key.Region, err)\n\t}\n\n\t// Create HTTP client builder\n\thcClientBuilder := core.NewHcHttpClientBuilder().\n\t\tWithCredential(cred).\n\t\tWithRegion(reg)\n\n\thcClient := hcClientBuilder.Build()\n\n\t// Create KMS client\n\tkmsClient := huaweikms.NewKmsClient(hcClient)","sourceCodeStart":256,"sourceCodeEnd":292,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/hckms/keysource.go#L256-L292","documentation":"When no credentials were injected via hckms.Credentials, createKMSClient uses the SDK's BasicCredentialProviderChain (env vars -> config profile -> ECS metadata). If GetCredentials finds no usable credentials, the failure is wrapped here (hckms/keysource.go:274) and aborts both encrypt and decrypt.","triggerScenarios":"EncryptContext or DecryptContext is called with key.credentials == nil and the default provider chain cannot resolve credentials: no HuaweiCloud env vars, no config profile file, and no ECS metadata endpoint reachable.","commonSituations":"CI/CD runner without HuaweiCloud secrets configured; local machine where ~/.huaweicloud profile was never created or is unreadable; typo'd environment variable names; running in a container off-ECS where metadata service is unreachable.","solutions":["Set the HuaweiCloud credential environment variables expected by the provider chain (access key + secret key) before running sops","Create a valid credentials/config profile file for the SDK's profile provider","Inject credentials programmatically via hckms.NewCredentials(credential).ApplyToMasterKey(key) when using the keyservice API","Run the workload on an ECS with an attached IAM agency so metadata credentials resolve"],"exampleFix":"// before\n$ sops -d secrets.yaml\n// after (CI)\n$ export HC_ACCESS_KEY_ID=\"$HUAWEI_AK\"\n$ export HC_SECRET_ACCESS_KEY=\"$HUAWEI_SK\"\n$ sops -d secrets.yaml","handlingStrategy":"validation","validationCode":"// Go: fail fast before touching KMS\nif _, err := provider.BasicCredentialProviderChain().GetCredentials(); err != nil {\n    log.Fatal(\"HuaweiCloud credentials not found; set HC access/secret env vars or an SDK profile\")\n}","typeGuard":null,"tryCatchPattern":"if _, err := key.Decrypt(); err != nil {\n    var credErr error\n    if errors.As(err, &credErr) && strings.Contains(err.Error(), \"failed to get HuaweiCloud credentials\") {\n        return fmt.Errorf(\"no HuaweiCloud credentials: configure env vars, profile, or ECS metadata\")\n    }\n    return err\n}","preventionTips":["Standardize credential env vars in CI templates so every job has them","Document the provider chain order (env -> profile -> ECS metadata) for your team","Inject credentials via hckms.Credentials in service code instead of relying on ambient state"],"tags":["huaweicloud","credentials","environment","authentication"],"backgroundTag":"missing-cloud-credentials","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}