{"record":{"id":"a13bfbb36d197f7e","repo":"getsops/sops","slug":"no-valid-resource-id-found-in-q","errorCode":null,"errorMessage":"no valid resource ID found in %q","messagePattern":"no valid resource ID found in %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"gcpkms/keysource.go","lineNumber":294,"sourceCode":"\tout[\"created_at\"] = key.CreationDate.UTC().Format(time.RFC3339)\n\tout[\"enc\"] = key.EncryptedKey\n\treturn out\n}\n\n// TypeToIdentifier returns the string identifier for the MasterKey type.\nfunc (key *MasterKey) TypeToIdentifier() string {\n\treturn KeyTypeIdentifier\n}\n\n// newKMSClient returns a GCP KMS client configured with the tokenSource\n// or credentialJSON, and/or grpcConn, falling back to environmental defaults.\n// It returns an error if the ResourceID is invalid, or if the setup of the\n// client fails.\nfunc (key *MasterKey) newKMSClient(ctx context.Context) (*kms.KeyManagementClient, error) {\n\tre := regexp.MustCompile(`^projects/[^/]+/locations/[^/]+/keyRings/[^/]+/cryptoKeys/[^/]+$`)\n\tmatches := re.FindStringSubmatch(key.ResourceID)\n\tif matches == nil {\n\t\treturn nil, fmt.Errorf(\"no valid resource ID found in %q\", key.ResourceID)\n\t}\n\n\tvar opts []option.ClientOption\n\tswitch {\n\tcase key.tokenSource != nil:\n\t\topts = append(opts, option.WithTokenSource(key.tokenSource))\n\tcase key.credentialJSON != nil:\n\t\topts = append(opts, option.WithCredentialsJSON(key.credentialJSON))\n\tdefault:\n\t\tcredentials, err := getGoogleCredentials()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"credentials: failed to obtain credentials from %q: %w\", SopsGoogleCredentialsEnv, err)\n\t\t}\n\t\tif credentials != nil {\n\t\t\topts = append(opts, option.WithCredentialsJSON(credentials))\n\t\t\tbreak\n\t\t}\n","sourceCodeStart":276,"sourceCodeEnd":312,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/gcpkms/keysource.go#L276-L312","documentation":"newKMSClient validates that MasterKey.ResourceID matches the canonical GCP KMS crypto key path `projects/.../locations/.../keyRings/.../cryptoKeys/...` via regex. Anything else — aliases, partial paths, URLs, extra segments — is rejected before creating the client.","triggerScenarios":"EncryptContext/DecryptContext (and their tests) called with a MasterKey whose ResourceID is not exactly projects/P/locations/L/keyRings/R/cryptoKeys/K, e.g. a bare key name or a global-key path.","commonSituations":"Writing .sops.yaml creation rules by hand and using the key ring path instead of the crypto key path; copying a console URL fragment; omitting the location (e.g. using 'global' incorrectly); trailing slashes or whitespace.","solutions":["Set ResourceID to the full canonical path, e.g. projects/my-proj/locations/us-east1/keyRings/sops/cryptoKeys/sops-key.","Generate it with: gcloud kms keys describe KEY --location L --keyring R --format 'value(name)'.","Trim whitespace and remove any 'https://...' prefix or query string.","If using key alternatives versions, reference the cryptoKey, not the cryptoKeyVersion."],"exampleFix":"// before\n// resource_ids: ['projects/my-proj/locations/global/keyRings/sops']\n// after\n// resource_ids: ['projects/my-proj/locations/global/keyRings/sops/cryptoKeys/my-key']","handlingStrategy":"validation","validationCode":"var gcpKeyRe = regexp.MustCompile(`^projects/[^/]+/locations/[^/]+/keyRings/[^/]+/cryptoKeys/[^/]+$`)\nfunc validGCPResourceID(id string) bool { return gcpKeyRe.MatchString(strings.TrimSpace(id)) }","typeGuard":"null","tryCatchPattern":"null","preventionTips":["Generate ResourceIDs with `gcloud kms keys describe --format 'value(name)'` instead of typing them.","Lint .sops.yaml resource_ids against the canonical regex in CI.","Never paste console URLs or keyring-only paths as resource IDs."],"tags":["gcp","kms","validation","configuration"],"backgroundTag":"invalid-resource-id-format","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}