{"record":{"id":"c660b4dd8ae1e48a","repo":"getsops/sops","slug":"failed-to-get-azure-token-credential-to-encrypt-da","errorCode":null,"errorMessage":"failed to get Azure token credential to encrypt data: %w","messagePattern":"failed to get Azure token credential to encrypt data: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"azkv/keysource.go","lineNumber":209,"sourceCode":"\n\tkdetail, err := c.GetKey(ctx, key.Name, key.Version, nil)\n\tif err != nil {\n\t\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Encryption failed\")\n\t\treturn fmt.Errorf(\"failed to fetch Azure Key to retrieve key version: %w\", err)\n\t}\n\tkey.Version = kdetail.Key.KID.Version()\n\n\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Version fetch succeeded\")\n\treturn nil\n}\n\n// EncryptContext takes a SOPS data key, encrypts it with Azure Key Vault, and stores\n// the result in the EncryptedKey field.\nfunc (key *MasterKey) EncryptContext(ctx context.Context, dataKey []byte) error {\n\ttoken, err := key.getTokenCredential()\n\tif err != nil {\n\t\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Encryption failed\")\n\t\treturn fmt.Errorf(\"failed to get Azure token credential to encrypt data: %w\", err)\n\t}\n\n\tc, err := azkeys.NewClient(key.VaultURL, token, key.clientOptions)\n\tif err != nil {\n\t\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Encryption failed\")\n\t\treturn fmt.Errorf(\"failed to construct Azure Key Vault client to encrypt data: %w\", err)\n\t}\n\n\tresp, err := c.Encrypt(ctx, key.Name, key.Version, azkeys.KeyOperationParameters{\n\t\tAlgorithm: to.Ptr(azkeys.EncryptionAlgorithmRSAOAEP256),\n\t\tValue:     dataKey,\n\t}, nil)\n\tif err != nil {\n\t\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Encryption failed\")\n\t\treturn fmt.Errorf(\"failed to encrypt sops data key with Azure Key Vault key '%s': %w\", key.ToString(), err)\n\t}\n\n\tencodedEncryptedKey := base64.RawURLEncoding.EncodeToString(resp.KeyOperationResult.Result)","sourceCodeStart":191,"sourceCodeEnd":227,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/azkv/keysource.go#L191-L227","documentation":"EncryptContext encrypts the SOPS data key with the vault key. This error means obtaining the Azure token credential failed at encryption time — same family as the version-retrieval credential error but raised inside the encrypt path.","triggerScenarios":"EncryptContext calls key.getTokenCredential() before building the client; it errors because no DefaultAzureCredential source (az login, service principal env vars, managed identity) is available or valid.","commonSituations":"Running sops -e in CI without Azure credentials; expired service principal secret; az login session for the wrong tenant/subscription; container without managed identity.","solutions":["Run az login or set AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET before invoking sops -e","Enable/verify managed identity if running inside Azure compute","Rotate the expired client secret or certificate and update the environment","Validate ambient credentials with az account get-access-token --resource https://vault.azure.net"],"exampleFix":"// before\nsops -e file.yaml  # fails: no Azure credentials in CI\n// after\nexport AZURE_TENANT_ID=... AZURE_CLIENT_ID=... AZURE_CLIENT_SECRET=...\nsops -e file.yaml","handlingStrategy":"try-catch","validationCode":"cred, err := azidentity.NewDefaultAzureCredential(nil)\nif err != nil {\n    return fmt.Errorf(\"run 'az login' or set AZURE_TENANT_ID/AZURE_CLIENT_ID/AZURE_CLIENT_SECRET before encrypting: %w\", err)\n}\n_, err = cred.GetToken(context.Background(), policy.TokenRequestOptions{Scopes: []string{\"https://vault.azure.net/.default\"}})\nif err != nil { return fmt.Errorf(\"Azure token acquisition failed: %w\", err) }","typeGuard":null,"tryCatchPattern":"err := sopsEncrypt(...)\nif strings.Contains(err.Error(), \"failed to get Azure token credential to encrypt data\") {\n    var cue *azidentity.CredentialUnavailableError\n    if errors.As(err, &cue) {\n        return fmt.Errorf(\"no Azure auth source; run 'az login' or configure a service principal: %w\", err)\n    }\n    return err\n}","preventionTips":["Authenticate before CI encrypt jobs (OIDC federation or secrets)","Rotate credentials before expiry and update env vars","Use managed identity on Azure-hosted runners","Smoke-test credential acquisition in pipeline setup steps"],"tags":["azure","authentication","credential","encryption"],"backgroundTag":"azure-credential-not-found","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}