{"record":{"id":"b35f379043fb9730","repo":"getsops/sops","slug":"could-not-parse-q-into-a-valid-azure-key-vault-ma","errorCode":null,"errorMessage":"could not parse %q into a valid Azure Key Vault MasterKey %v","messagePattern":"could not parse %q into a valid Azure Key Vault MasterKey (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"azkv/keysource.go","lineNumber":101,"sourceCode":"\n// NewMasterKey creates a new MasterKey from a URL, key name and (optional) version,\n// setting the creation date to the current date.\nfunc NewMasterKeyWithOptionalVersion(vaultURL string, keyName string, keyVersion string) (*MasterKey, error) {\n\tkey := newMasterKey(vaultURL, keyName, keyVersion)\n\tif err := key.ensureKeyHasVersion(context.Background()); err != nil {\n\t\treturn nil, err\n\t}\n\treturn key, nil\n}\n\n// NewMasterKeyFromURL takes an Azure Key Vault key URL, and returns a new\n// MasterKey. The URL format is {vaultUrl}/keys/{keyName}/{keyVersion}.\nfunc NewMasterKeyFromURL(url string) (*MasterKey, error) {\n\turl = strings.TrimSpace(url)\n\tre := regexp.MustCompile(\"^(https://[^/]+)/keys/([^/]+)(/[^/]*)?$\")\n\tparts := re.FindStringSubmatch(url)\n\tif len(parts) < 3 {\n\t\treturn nil, fmt.Errorf(\"could not parse %q into a valid Azure Key Vault MasterKey %v\", url, parts)\n\t}\n\t// Blank key versions are supported in Azure Key Vault, as they default to the latest\n\t// version of the key. We need to put the actual version in the sops metadata block though\n\tvar key *MasterKey\n\tif len(parts[3]) > 1 {\n\t\tkey = newMasterKey(parts[1], parts[2], parts[3][1:])\n\t} else {\n\t\tkey = newMasterKey(parts[1], parts[2], \"\")\n\t}\n\terr := key.ensureKeyHasVersion(context.Background())\n\treturn key, err\n}\n\n// MasterKeysFromURLs takes a comma separated list of Azure Key Vault URLs,\n// and returns a slice of new MasterKeys.\nfunc MasterKeysFromURLs(urls string) ([]*MasterKey, error) {\n\tvar keys []*MasterKey\n\tif urls == \"\" {","sourceCodeStart":83,"sourceCodeEnd":119,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/azkv/keysource.go#L83-L119","documentation":"NewMasterKeyFromURL parses an Azure Key Vault key URL of the form {vaultUrl}/keys/{keyName}/{keyVersion}. This error means the URL did not match that pattern, so a MasterKey cannot be constructed from it.","triggerScenarios":"Calling NewMasterKeyFromURL or MasterKeysFromURLs with a string missing https://, missing /keys/, missing key name, or containing unexpected whitespace/newlines that survive trimming.","commonSituations":"Copying a key ID from the Azure portal that uses vault:// or an incomplete path; forgetting the https:// scheme; using a managed-HSM URL with /keys under a different path shape; typos or extra query parameters; pasting a multi-line list into the sops config.","solutions":["Use the full key identifier copied from the Azure portal: https://<vault-name>.vault.azure.net/keys/<key-name>/<key-version>","Ensure the scheme is exactly https:// and there is no trailing slash issue or extra query string","Verify the URL contains the literal /keys/ segment followed by a non-empty key name","Trim whitespace/newlines if the URL came from a file or env var"],"exampleFix":"// before\nhttps://myvault.vault.azure.net/keys/           # missing key name\n// after\nhttps://myvault.vault.azure.net/keys/my-sops-key/1234abcd","handlingStrategy":"validation","validationCode":"var azKeyURLRe = regexp.MustCompile(`^https://[^/]+/keys/[^/]+(/[^/]*)?$`)\nfunc validateAzureKVURL(u string) error {\n    u = strings.TrimSpace(u)\n    if !azKeyURLRe.MatchString(u) {\n        return fmt.Errorf(\"invalid Azure KV key URL: %q (want https://vault/keys/name/version)\", u)\n    }\n    return nil\n}","typeGuard":"func isWellFormedAzureKeyURL(u string) bool {\n    u = strings.TrimSpace(u)\n    re := regexp.MustCompile(`^https://[^/]+/keys/[^/]+(/[^/]*)?$`)\n    return re.MatchString(u)\n}","tryCatchPattern":"k, err := azkv.NewMasterKeyFromURL(u)\nif err != nil {\n    return fmt.Errorf(\"bad azure_kv entry %q: %w\", u, err)\n}","preventionTips":["Copy key identifiers verbatim from the Azure portal 'Key Identifier' field","Lint .sops.yaml URLs before running sops","Trim whitespace from env/config inputs"],"tags":["azure","key-vault","url-parsing","config"],"backgroundTag":"invalid-key-vault-url","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}