{"record":{"id":"af93dc75b7e2e9c2","repo":"getsops/sops","slug":"failed-to-get-azure-token-credential-to-retrieve-k","errorCode":null,"errorMessage":"failed to get Azure token credential to retrieve key version: %w","messagePattern":"failed to get Azure token credential to retrieve key version: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"azkv/keysource.go","lineNumber":183,"sourceCode":"// Encrypt takes a SOPS data key, encrypts it with Azure Key Vault, and stores\n// the result in the EncryptedKey field.\n//\n// Consider using EncryptContext instead.\nfunc (key *MasterKey) Encrypt(dataKey []byte) error {\n\treturn key.EncryptContext(context.Background(), dataKey)\n}\n\nfunc (key *MasterKey) ensureKeyHasVersion(ctx context.Context) error {\n\tif key.Version != \"\" {\n\t\t// Nothing to do\n\t\treturn nil\n\t}\n\n\ttoken, err := key.getTokenCredential()\n\n\tif err != nil {\n\t\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Encryption failed\")\n\t\treturn fmt.Errorf(\"failed to get Azure token credential to retrieve key version: %w\", err)\n\t}\n\n\tc, err := azkeys.NewClient(key.VaultURL, token, key.clientOptions)\n\tif err != nil {\n\t\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Encryption failed\")\n\t\treturn fmt.Errorf(\"failed to construct Azure Key Vault client to retrieve key version: %w\", err)\n\t}\n\n\tkdetail, err := c.GetKey(ctx, key.Name, key.Version, nil)\n\tif err != nil {\n\t\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Encryption failed\")\n\t\treturn fmt.Errorf(\"failed to fetch Azure Key to retrieve key version: %w\", err)\n\t}\n\tkey.Version = kdetail.Key.KID.Version()\n\n\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Version fetch succeeded\")\n\treturn nil\n}","sourceCodeStart":165,"sourceCodeEnd":201,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/azkv/keysource.go#L165-L201","documentation":"ensureKeyHasVersion resolves the latest version of a key when the URL omitted a key version. It first needs a DefaultAzureCredential-style token credential; this error means obtaining that credential failed, so the key version cannot be looked up.","triggerScenarios":"ensureKeyHasVersion (called from NewMasterKeyFromURL) calls key.getTokenCredential() and it errors — typically azidentity.NewDefaultAzureCredential failing because no Azure authentication source is configured.","commonSituations":"Missing AZURE_TENANT_ID / AZURE_CLIENT_ID / AZURE_CLIENT_SECRET; not logged in with az login; running in CI without a managed identity; AZURE_AUTHORITY_HOST misconfigured; azidentity environment variables pointing to an invalid service principal.","solutions":["Authenticate locally with az login, or set AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET for a service principal","In Azure-hosted environments, ensure the resource has a managed identity enabled","Verify AZURE_CLIENT_SECRET/AZURE_CLIENT_CERTIFICATE_PATH values are current and not expired","Run az account get-access-token to confirm the ambient credential works before running sops"],"exampleFix":"// before\nexport SOPS_AZURE_KEY_VAULT_URL=https://myvault.vault.azure.net/keys/k  # no creds set\n// after\nexport AZURE_TENANT_ID=... AZURE_CLIENT_ID=... AZURE_CLIENT_SECRET=...\nexport SOPS_AZURE_KEY_VAULT_URL=https://myvault.vault.azure.net/keys/k","handlingStrategy":"try-catch","validationCode":"cred, err := azidentity.NewDefaultAzureCredential(nil)\nif err != nil {\n    return fmt.Errorf(\"no Azure credential available: %w (run 'az login' or set AZURE_TENANT_ID/AZURE_CLIENT_ID/AZURE_CLIENT_SECRET)\", err)\n}\ntok, err := cred.GetToken(context.Background(), policy.TokenRequestOptions{Scopes: []string{\"https://vault.azure.net/.default\"}})\nif err != nil { return fmt.Errorf(\"Azure token acquisition failed: %w\", err) }\n_ = tok","typeGuard":null,"tryCatchPattern":"err := sopsRun(...)\nvar credErr *azidentity.CredentialUnavailableError\nif errors.As(err, &credErr) || strings.Contains(err.Error(), \"failed to get Azure token credential\") {\n    return fmt.Errorf(\"authenticate to Azure first (az login or service principal env vars): %w\", err)\n}","preventionTips":["Run az login before local sops commands","Set AZURE_* env vars in CI secrets","Ensure managed identity is enabled on Azure compute","Periodically validate tokens with az account get-access-token"],"tags":["azure","authentication","credential","key-vault"],"backgroundTag":"azure-credential-not-found","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}