{"record":{"id":"bd45671e21ff218a","repo":"getsops/sops","slug":"invalid-region-q-w","errorCode":null,"errorMessage":"invalid region %q: %w","messagePattern":"invalid region %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"hckms/keysource.go","lineNumber":281,"sourceCode":"func (key *MasterKey) createKMSClient(ctx context.Context) (*huaweikms.KmsClient, error) {\n\tvar cred auth.ICredential\n\tvar err error\n\n\tif key.credentials != nil {\n\t\tcred = key.credentials\n\t} else {\n\t\t// Use default credential provider chain (env -> profile -> metadata)\n\t\tcredentialProviderChain := provider.BasicCredentialProviderChain()\n\t\tcred, err = credentialProviderChain.GetCredentials()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to get HuaweiCloud credentials: %w\", err)\n\t\t}\n\t}\n\n\t// Get KMS region with endpoint\n\treg, err := kmsregion.SafeValueOf(key.Region)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid region %q: %w\", key.Region, err)\n\t}\n\n\t// Create HTTP client builder\n\thcClientBuilder := core.NewHcHttpClientBuilder().\n\t\tWithCredential(cred).\n\t\tWithRegion(reg)\n\n\thcClient := hcClientBuilder.Build()\n\n\t// Create KMS client\n\tkmsClient := huaweikms.NewKmsClient(hcClient)\n\treturn kmsClient, nil\n}\n","sourceCodeStart":263,"sourceCodeEnd":295,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/hckms/keysource.go#L263-L295","documentation":"createKMSClient resolves the Region string via kmsregion.SafeValueOf to obtain the KMS endpoint (hckms/keysource.go:281). If the region name is not recognized by the SDK's region catalog, this error wraps the lookup failure and no API call is made.","triggerScenarios":"EncryptContext or DecryptContext runs with a MasterKey whose Region (the part before ':' in 'region:key-uuid') does not match any region in huaweicloud-sdk-go-v3/services/kms/v2/region — unknown name, wrong casing, or a region added to HuaweiCloud after your SDK version was released.","commonSituations":"Typo in the region in .sops.yaml (e.g. 'tr-west-0' vs 'tr-west-1'); copy-pasting an AWS-style region (us-east-1); newly launched HuaweiCloud region not present in an older pinned SDK version.","solutions":["Check the region part of the KeyID against HuaweiCloud's KMS region list and the SDK's region package","Correct the 'region:key-uuid' entry in .sops.yaml / file metadata","Upgrade huaweicloud-sdk-go-v3 so newer regions are included in the SDK's region catalog","Verify case/format: regions are lowercase names like 'tr-west-1', not ARNs or endpoints"],"exampleFix":"// before (.sops.yaml)\n- hckms: us-east-1:1234abcd-12ab-34cd-56ef-1234567890ab\n// after\n- hckms: tr-west-1:1234abcd-12ab-34cd-56ef-1234567890ab","handlingStrategy":"validation","validationCode":"// Go: preflight the region string before encrypt/decrypt\nr, err := kmsregion.SafeValueOf(key.Region)\nif err != nil {\n    return fmt.Errorf(\"region %q is not a known HuaweiCloud KMS region\", key.Region)\n}","typeGuard":null,"tryCatchPattern":"if _, err := key.DecryptContext(ctx); err != nil {\n    if strings.Contains(err.Error(), \"invalid region\") {\n        return fmt.Errorf(\"fix the region part of the hckms 'region:key-uuid' entry\")\n    }\n    return err\n}","preventionTips":["Copy region names from HuaweiCloud docs, never AWS-style names","Keep .sops.yaml entries lowercase 'region:key-uuid' format","Upgrade huaweicloud-sdk-go-v3 when adopting newly launched regions","Lint .sops.yaml on CI to validate regions before use"],"tags":["huaweicloud","kms","region","configuration"],"backgroundTag":"invalid-cloud-region","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}