{"record":{"id":"93d11dd807a44fac","repo":"getsops/sops","slug":"no-valid-arn-found-in-s","errorCode":null,"errorMessage":"no valid ARN found in '%s'","messagePattern":"no valid ARN found in '(.+?)'","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kms/keysource.go","lineNumber":396,"sourceCode":"\t\t\toutcontext[k] = *v\n\t\t}\n\t\tout[\"context\"] = outcontext\n\t}\n\treturn out\n}\n\n// TypeToIdentifier returns the string identifier for the MasterKey type.\nfunc (key *MasterKey) TypeToIdentifier() string {\n\treturn KeyTypeIdentifier\n}\n\n// createKMSConfig returns an AWS config with the credentialsProvider of the\n// MasterKey, or the default configuration sources.\nfunc (key MasterKey) createKMSConfig(ctx context.Context) (*aws.Config, error) {\n\tre := regexp.MustCompile(arnRegex)\n\tmatches := re.FindStringSubmatch(key.Arn)\n\tif matches == nil {\n\t\treturn nil, fmt.Errorf(\"no valid ARN found in '%s'\", key.Arn)\n\t}\n\tregion := matches[1]\n\n\tcfg, err := config.LoadDefaultConfig(ctx, func(lo *config.LoadOptions) error {\n\t\t// Use the credentialsProvider if present, otherwise default to reading credentials\n\t\t// from the environment.\n\t\tif key.credentialsProvider != nil {\n\t\t\tlo.Credentials = key.credentialsProvider\n\t\t}\n\t\tif key.AwsProfile != \"\" {\n\t\t\tlo.SharedConfigProfile = key.AwsProfile\n\t\t}\n\t\tlo.Region = region\n\t\tif key.httpClient != nil {\n\t\t\tlo.HTTPClient = key.httpClient\n\t\t}\n\t\treturn nil\n\t})","sourceCodeStart":378,"sourceCodeEnd":414,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/kms/keysource.go#L378-L414","documentation":"This error comes from sops' KMS key source when the `arn` field of a MasterKey does not match the expected AWS KMS ARN format. createKMSConfig validates the ARN with a regexp to extract the region; if the pattern does not match (nil matches), it refuses to build an AWS config. The ARN must look like arn:aws:kms:<region>:<account>:key/<key-id> (or alias form), possibly with extra text around it that the regex extracts from.","triggerScenarios":"Calling EncryptContext or DecryptContext on a KMS MasterKey whose Arn field is empty, misspelled, points at another service (e.g. sqs, iam), lacks a region, or is otherwise malformed so the arnRegex FindStringSubmatch returns nil.","commonSituations":"Hand-edited sops .sops.yaml creation rules with a typo in the ARN; copying an ARN from another AWS service; forgetting the region segment; using an ARN of a KMS key from another partition (aws-cn, aws-gov) that the regex does not accept; leaving the arn field blank in code that constructs keys programmatically.","solutions":["Print the offending key's Arn (it is quoted in the message) and correct it to a full AWS KMS ARN such as arn:aws:kms:us-east-1:123456789012:key/xxxx-xxxx or alias/xxx form.","Verify there are no stray characters (whitespace, quotes, CRLF) around the ARN in .sops.yaml or the code that sets it.","If using a non-default partition (aws-cn, aws-us-gov), confirm the regex arnRegex in kms/keysource.go accepts it; otherwise use the standard partition or update the regex.","Regenerate the creation rule with `sops --kms <arn>` or `sops updatekeys` instead of hand-editing."],"exampleFix":"// before\nkms:\n  - arn: \"arn:aws:kms::123456789012:key/abcd-1234\"  # missing region\n// after\nkms:\n  - arn: \"arn:aws:kms:us-east-1:123456789012:key/abcd-1234\"","handlingStrategy":"validation","validationCode":"// Go\nvar arnRegex = regexp.MustCompile(`^arn:(aws[a-zA-Z-]*):kms:([a-z0-9-]+):\\d{12}:(key|alias)/.+$`)\nfunc validKMSArn(arn string) bool { return arnRegex.MatchString(strings.TrimSpace(arn)) }\n// call before building the key: if !validKMSArn(key.Arn) { return fmt.Errorf(\"bad KMS ARN: %q\", key.Arn) }","typeGuard":"func hasKMSArn(k kms.MasterKey) bool { return k.Arn != \"\" && strings.Contains(k.Arn, \":kms:\") }","tryCatchPattern":null,"preventionTips":["Generate creation rules with `sops --kms arn:...` instead of hand-editing YAML","Keep full ARNs (with region and account) in .sops.yaml, never partial IDs","Trim whitespace/newlines from ARNs loaded from config","Add a CI lint that regex-checks every kms arn in .sops.yaml"],"tags":["aws","kms","config","validation"],"backgroundTag":"invalid-arn-format","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}