{"record":{"id":"7a678c661d7601a5","repo":"getsops/sops","slug":"failed-to-encrypt-sops-data-key-with-azure-key-vau","errorCode":null,"errorMessage":"failed to encrypt sops data key with Azure Key Vault key '%s': %w","messagePattern":"failed to encrypt sops data key with Azure Key Vault key '(.+?)': %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"azkv/keysource.go","lineNumber":224,"sourceCode":"\ttoken, err := key.getTokenCredential()\n\tif err != nil {\n\t\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Encryption failed\")\n\t\treturn fmt.Errorf(\"failed to get Azure token credential to encrypt data: %w\", err)\n\t}\n\n\tc, err := azkeys.NewClient(key.VaultURL, token, key.clientOptions)\n\tif err != nil {\n\t\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Encryption failed\")\n\t\treturn fmt.Errorf(\"failed to construct Azure Key Vault client to encrypt data: %w\", err)\n\t}\n\n\tresp, err := c.Encrypt(ctx, key.Name, key.Version, azkeys.KeyOperationParameters{\n\t\tAlgorithm: to.Ptr(azkeys.EncryptionAlgorithmRSAOAEP256),\n\t\tValue:     dataKey,\n\t}, nil)\n\tif err != nil {\n\t\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Encryption failed\")\n\t\treturn fmt.Errorf(\"failed to encrypt sops data key with Azure Key Vault key '%s': %w\", key.ToString(), err)\n\t}\n\n\tencodedEncryptedKey := base64.RawURLEncoding.EncodeToString(resp.KeyOperationResult.Result)\n\tkey.SetEncryptedDataKey([]byte(encodedEncryptedKey))\n\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Encryption succeeded\")\n\treturn nil\n}\n\n// EncryptedDataKey returns the encrypted data key this master key holds.\nfunc (key *MasterKey) EncryptedDataKey() []byte {\n\treturn []byte(key.EncryptedKey)\n}\n\n// SetEncryptedDataKey sets the encrypted data key for this master key.\nfunc (key *MasterKey) SetEncryptedDataKey(enc []byte) {\n\tkey.EncryptedKey = string(enc)\n}\n","sourceCodeStart":206,"sourceCodeEnd":242,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/azkv/keysource.go#L206-L242","documentation":"This error is raised by sops' Azure Key Vault keysource when the azkeys client's Encrypt call (RSA-OAEP-256) on the vault key fails while encrypting the SOPS data key during EncryptContext. The underlying Azure SDK error is wrapped, so the real cause (auth, network, permission, key state) is in the %w suffix.","triggerScenarios":"Calling Encrypt/EncryptContext on an azkv.MasterKey where c.Encrypt returns an error: key name/version does not exist in the vault, the credential lacks the 'encrypt' key permission, the vault is unreachable, or the key is disabled/expired.","commonSituations":"Missing or expired Azure login (az login / Managed Identity unavailable), RBAC or access policy missing 'encrypt' (e.g. Key Vault Crypto User role not assigned), typo in key name or vault URL in .sops.yaml, key soft-deleted or purged, network/firewall blocking the vault endpoint.","solutions":["Run `az login` (or fix Managed Identity / AZURE_* env vars) and confirm `az keyvault key show --vault-name <vault> --name <key>` works","Grant the identity the Key Vault Crypto User role (or 'encrypt' access policy permission) on the vault","Verify key name and version in the Azure KV master key config match an enabled, non-expired key in the vault","Check network reachability to the vault URL (VPN, firewall, private endpoint DNS)"],"exampleFix":"// before\nsops -e file.yaml  # fails with Azure KV key 'mykey' encrypt error\n// after\naz login\naz role assignment create --assignee <user> --role 'Key Vault Crypto User' --scope /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.KeyVault/vaults/<vault>\nsops -e file.yaml","handlingStrategy":"try-catch","validationCode":"// before calling Encrypt\nimport \"os/exec\"\nfunc checkVaultKey(vault, name string) error {\n\tout, err := exec.Command(\"az\", \"keyvault\", \"key\", \"show\", \"--vault-name\", vault, \"--name\", name).CombinedOutput()\n\tif err != nil { return fmt.Errorf(\"key not accessible: %s\", out) }\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"if err := key.Encrypt(); err != nil {\n\tvar azErr *azcore.ResponseError\n\tif errors.As(err, &azErr) && azErr.StatusCode == http.StatusForbidden {\n\t\t// handle RBAC/access-policy denial: prompt to run az login or grant Crypto User\n\t}\n\treturn fmt.Errorf(\"azure kv encrypt failed: %w\", err)\n}","preventionTips":["Run `az login` and test key access with `az keyvault key show` before encrypting","Grant Key Vault Crypto User role to the encrypting identity","Pin enabled, non-expired keys in .sops.yaml and audit them periodically","Ensure network/VPN access to <vault>.vault.azure.net from CI and dev machines"],"tags":["azure","key-vault","encryption","authentication"],"backgroundTag":"azure-key-vault-encrypt-denied","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}