{"record":{"id":"9aee67c965086114","repo":"getsops/sops","slug":"failed-to-fetch-azure-key-to-retrieve-key-version","errorCode":null,"errorMessage":"failed to fetch Azure Key to retrieve key version: %w","messagePattern":"failed to fetch Azure Key to retrieve key version: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"azkv/keysource.go","lineNumber":195,"sourceCode":"\t}\n\n\ttoken, err := key.getTokenCredential()\n\n\tif err != nil {\n\t\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Encryption failed\")\n\t\treturn fmt.Errorf(\"failed to get Azure token credential to retrieve key version: %w\", err)\n\t}\n\n\tc, err := azkeys.NewClient(key.VaultURL, token, key.clientOptions)\n\tif err != nil {\n\t\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Encryption failed\")\n\t\treturn fmt.Errorf(\"failed to construct Azure Key Vault client to retrieve key version: %w\", err)\n\t}\n\n\tkdetail, err := c.GetKey(ctx, key.Name, key.Version, nil)\n\tif err != nil {\n\t\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Encryption failed\")\n\t\treturn fmt.Errorf(\"failed to fetch Azure Key to retrieve key version: %w\", err)\n\t}\n\tkey.Version = kdetail.Key.KID.Version()\n\n\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Version fetch succeeded\")\n\treturn nil\n}\n\n// EncryptContext takes a SOPS data key, encrypts it with Azure Key Vault, and stores\n// the result in the EncryptedKey field.\nfunc (key *MasterKey) EncryptContext(ctx context.Context, dataKey []byte) error {\n\ttoken, err := key.getTokenCredential()\n\tif err != nil {\n\t\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Encryption failed\")\n\t\treturn fmt.Errorf(\"failed to get Azure token credential to encrypt data: %w\", err)\n\t}\n\n\tc, err := azkeys.NewClient(key.VaultURL, token, key.clientOptions)\n\tif err != nil {","sourceCodeStart":177,"sourceCodeEnd":213,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/azkv/keysource.go#L177-L213","documentation":"ensureKeyHasVersion calls c.GetKey to fetch the key and derive its version when the URL omitted one. This error means the KeyVault GetKey REST call failed — the key doesn't exist, the credential lacks permission, or the request couldn't reach the vault.","triggerScenarios":"ensureKeyHasVersion (from NewMasterKeyFromURL) invokes c.GetKey(ctx, key.Name, key.Version, nil) and receives an error: 403 from missing 'get' key permission, 404 unknown key name, network failure, or expired/insufficient token scope.","commonSituations":"Service principal without Key Vault 'Key Vault Crypto User'/'get' role; key name typo in .sops.yaml; vault firewall blocking the client IP; key deleted or purged; private-link/DNS issues.","solutions":["Grant the identity the Key Vault 'get' key permission / 'Key Vault Crypto User' role via an access policy or RBAC","Verify the key name and vault are correct: az keyvault key show --vault-name <vault> -n <name>","Check the vault's network rules/firewall allow the caller's IP or VNet","Confirm the token scope with az account get-access-token --resource https://vault.azure.net"],"exampleFix":"# before: principal has no access\naz keyvault set-policy -n myvault --spn <client-id> --key-permissions get encrypt decrypt\n# after: retry sops with granted permissions","handlingStrategy":"retry","validationCode":"// preflight: confirm identity can read the key\nout, err := exec.Command(\"az\", \"keyvault\", \"key\", \"show\", \"--vault-name\", vault, \"-n\", keyName).CombinedOutput()\nif err != nil {\n    return fmt.Errorf(\"key %s/%s not accessible: %s\", vault, keyName, out)\n}","typeGuard":null,"tryCatchPattern":"err := sopsRun(...)\nif strings.Contains(err.Error(), \"failed to fetch Azure Key\") {\n    var respErr *azcore.ResponseError\n    if errors.As(err, &respErr) && respErr.StatusCode == 403 {\n        return fmt.Errorf(\"grant the identity 'get' key permission / Key Vault Crypto User role: %w\", err)\n    }\n    return err // 404: fix key name; network: retry\n}","preventionTips":["Grant get/encrypt/decrypt permissions or Key Vault Crypto User RBAC role","Verify key names with az keyvault key show","Whitelist client IPs in vault firewall/network rules","Confirm token scope resource is https://vault.azure.net"],"tags":["azure","key-vault","getkey","permissions","network"],"backgroundTag":"key-vault-access-denied","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}