{"record":{"id":"79afc753e08a18c9","repo":"getsops/sops","slug":"failed-to-construct-azure-key-vault-client-to-encr","errorCode":null,"errorMessage":"failed to construct Azure Key Vault client to encrypt data: %w","messagePattern":"failed to construct Azure Key Vault client to encrypt data: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"azkv/keysource.go","lineNumber":215,"sourceCode":"\tkey.Version = kdetail.Key.KID.Version()\n\n\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Version fetch succeeded\")\n\treturn nil\n}\n\n// EncryptContext takes a SOPS data key, encrypts it with Azure Key Vault, and stores\n// the result in the EncryptedKey field.\nfunc (key *MasterKey) EncryptContext(ctx context.Context, dataKey []byte) error {\n\ttoken, err := key.getTokenCredential()\n\tif err != nil {\n\t\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Encryption failed\")\n\t\treturn fmt.Errorf(\"failed to get Azure token credential to encrypt data: %w\", err)\n\t}\n\n\tc, err := azkeys.NewClient(key.VaultURL, token, key.clientOptions)\n\tif err != nil {\n\t\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Encryption failed\")\n\t\treturn fmt.Errorf(\"failed to construct Azure Key Vault client to encrypt data: %w\", err)\n\t}\n\n\tresp, err := c.Encrypt(ctx, key.Name, key.Version, azkeys.KeyOperationParameters{\n\t\tAlgorithm: to.Ptr(azkeys.EncryptionAlgorithmRSAOAEP256),\n\t\tValue:     dataKey,\n\t}, nil)\n\tif err != nil {\n\t\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Encryption failed\")\n\t\treturn fmt.Errorf(\"failed to encrypt sops data key with Azure Key Vault key '%s': %w\", key.ToString(), err)\n\t}\n\n\tencodedEncryptedKey := base64.RawURLEncoding.EncodeToString(resp.KeyOperationResult.Result)\n\tkey.SetEncryptedDataKey([]byte(encodedEncryptedKey))\n\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Encryption succeeded\")\n\treturn nil\n}\n\n// EncryptedDataKey returns the encrypted data key this master key holds.","sourceCodeStart":197,"sourceCodeEnd":233,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/azkv/keysource.go#L197-L233","documentation":"EncryptContext builds an azkeys client to perform the encrypt operation. This error means azkeys.NewClient failed, indicating an invalid VaultURL or client options rather than an Azure-side problem.","triggerScenarios":"EncryptContext calls azkeys.NewClient(key.VaultURL, token, key.clientOptions) and the SDK errors because key.VaultURL is empty or not a valid absolute https URL (e.g. from a malformed azure_kv entry in .sops.yaml).","commonSituations":"Malformed key URL stored in the sops metadata; hand-edited .sops.yaml dropping the scheme; SDK/clientOptions misconfiguration; very old sops with incompatible Azure SDK versions.","solutions":["Verify the vault URL is a complete https URL: https://<vault>.vault.azure.net","Re-generate the encrypted file with a correctly formed azure_kv URL rather than hand-editing metadata","Inspect key.clientOptions for custom proxy/transport settings that could invalidate the client","Upgrade sops and its azure-sdk-for-go dependencies to the latest versions"],"exampleFix":"// before\nazure_kv: \"vault.azure.net/keys/k1\"\n// after\nazure_kv: \"https://myvault.vault.azure.net/keys/k1\"","handlingStrategy":"validation","validationCode":"if key.VaultURL == \"\" || !strings.HasPrefix(key.VaultURL, \"https://\") {\n    return fmt.Errorf(\"cannot encrypt: invalid vault URL %q\", key.VaultURL)\n}\nif _, err := url.Parse(key.VaultURL); err != nil {\n    return fmt.Errorf(\"unparseable vault URL: %w\", err)\n}","typeGuard":"func hasValidVaultURL(key *azkv.MasterKey) bool {\n    u, err := url.Parse(key.VaultURL)\n    return key.VaultURL != \"\" && err == nil && u.Scheme == \"https\" && u.Host != \"\"\n}","tryCatchPattern":"err := key.Encrypt(dataKey)\nif strings.Contains(err.Error(), \"failed to construct Azure Key Vault client to encrypt data\") {\n    return fmt.Errorf(\"vault URL in metadata is invalid; re-encrypt with a correct azure_kv URL: %w\", err)\n}","preventionTips":["Store azure_kv keys as full https identifiers only","Re-encrypt files rather than hand-editing encrypted metadata","Pin/upgrade Azure SDK versions with sops upgrades","Validate vault URLs at config-load time"],"tags":["azure","key-vault","client-construction","encryption"],"backgroundTag":"invalid-key-vault-url","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}