{"record":{"id":"9e10fc3c77e6c42b","repo":"getsops/sops","slug":"invalid-s-key-configuration-w","errorCode":null,"errorMessage":"invalid %s key configuration: %w","messagePattern":"invalid (.+?) key configuration: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"config/config.go","lineNumber":366,"sourceCode":"\t\t\tkeyGroup = append(keyGroup, key)\n\t\t} else {\n\t\t\treturn nil, err\n\t\t}\n\t}\n\tfor _, k := range group.Vault {\n\t\tif masterKey, err := hcvault.NewMasterKeyFromURI(k); err == nil {\n\t\t\tkeyGroup = append(keyGroup, masterKey)\n\t\t} else {\n\t\t\treturn nil, err\n\t\t}\n\t}\n\treturn deduplicateKeygroup(keyGroup), nil\n}\n\nfunc getKeysWithValidation(getKeysFunc func() ([]string, error), keyType string) ([]string, error) {\n\tkeys, err := getKeysFunc()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid %s key configuration: %w\", keyType, err)\n\t}\n\treturn keys, nil\n}\n\nfunc getKeyGroupsFromCreationRule(cRule *creationRule, kmsEncryptionContext map[string]*string) ([]sops.KeyGroup, error) {\n\tvar groups []sops.KeyGroup\n\tif len(cRule.KeyGroups) > 0 {\n\t\tfor _, group := range cRule.KeyGroups {\n\t\t\tkeyGroup, err := extractMasterKeys(group)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t\tgroups = append(groups, keyGroup)\n\t\t}\n\t} else {\n\t\tvar keyGroup sops.KeyGroup\n\t\tageKeys, err := getKeysWithValidation(cRule.GetAgeKeys, \"age\")\n\t\tif err != nil {","sourceCodeStart":348,"sourceCodeEnd":384,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/config/config.go#L348-L384","documentation":"getKeysWithValidation wraps errors from the per-key-type getters (GetKMSKeys, GetAgeKeys, etc.) with a message naming the key type, so failures like parseKeyField type errors surface as `invalid age key configuration: ...`. It is a contextual wrapper — the root cause is in the wrapped error.","triggerScenarios":"Calling getKeyGroupsFromCreationRule / config resolution for a creation rule where the underlying getter (e.g. GetAgeKeys) returns an error such as a non-string entry in the key list (error 66/67).","commonSituations":"A creation_rules entry in .sops.yaml has a malformed key list (maps instead of strings), so building key groups during `sops -e` fails with this prefixed error.","solutions":["Read the wrapped error after the colon to find the exact field and bad element type","Fix the offending key list in .sops.yaml so every entry is a plain string","Keep key entries under creation_rules as strings, or move multi-key setups into key_groups"],"exampleFix":"# before\ncreation_rules:\n  - path_regex: .*\\n    age:\n      - {recipient: age1abc}  # invalid -> 'invalid age key configuration'\n# after\ncreation_rules:\n  - path_regex: .*\n    age:\n      - \"age1abc...\"","handlingStrategy":"validation","validationCode":"// pre-validate creation rule key fields before building key groups\nfor _, rule := range cfg.CreationRules {\n\tfor _, k := range rule.Age {\n\t\tif _, ok := k.(string); !ok {\n\t\t\treturn fmt.Errorf(\"age entries must be plain strings in creation rule %q\", rule.PathRegex)\n\t\t}\n\t}\n}","typeGuard":null,"tryCatchPattern":"groups, err := config.GetKeyGroups(...)  // or the code path using getKeysWithValidation\nif err != nil {\n\tvar prefix string\n\tif _, conv := fmt.Sscanf(err.Error(), \"invalid %s key configuration\", &prefix); conv == nil {\n\t\treturn fmt.Errorf(\"bad key list for %s in .sops.yaml; see wrapped cause\", prefix)\n\t}\n\treturn err\n}","preventionTips":["Read the wrapped cause after 'invalid <type> key configuration:' to find the real problem","Keep all key entries in creation_rules as plain quoted strings","Test encryption with `sops -e /dev/null` after editing .sops.yaml","Maintain a golden/example .sops.yaml in the repo as the canonical shape"],"tags":["configuration","sops","yaml","key-groups"],"backgroundTag":"config-type-mismatch","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}