{"record":{"id":"ff44ca41f584a55c","repo":"getsops/sops","slug":"failed-to-get-azure-token-credential-to-decrypt","errorCode":null,"errorMessage":"failed to get Azure token credential to decrypt: %w","messagePattern":"failed to get Azure token credential to decrypt: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"azkv/keysource.go","lineNumber":266,"sourceCode":"\t}\n\treturn nil\n}\n\n// Decrypt decrypts the EncryptedKey field with Azure Key Vault and returns\n// the result.\n//\n// Consider using DecryptContext instead.\nfunc (key *MasterKey) Decrypt() ([]byte, error) {\n\treturn key.DecryptContext(context.Background())\n}\n\n// DecryptContext decrypts the EncryptedKey field with Azure Key Vault and returns\n// the result.\nfunc (key *MasterKey) DecryptContext(ctx context.Context) ([]byte, error) {\n\ttoken, err := key.getTokenCredential()\n\tif err != nil {\n\t\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Decryption failed\")\n\t\treturn nil, fmt.Errorf(\"failed to get Azure token credential to decrypt: %w\", err)\n\t}\n\n\trawEncryptedKey, err := base64.RawURLEncoding.DecodeString(key.EncryptedKey)\n\tif err != nil {\n\t\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Decryption failed\")\n\t\treturn nil, fmt.Errorf(\"failed to base64 decode Azure Key Vault encrypted key: %w\", err)\n\t}\n\n\tc, err := azkeys.NewClient(key.VaultURL, token, key.clientOptions)\n\tif err != nil {\n\t\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Decryption failed\")\n\t\treturn nil, fmt.Errorf(\"failed to construct Azure Key Vault client to decrypt data: %w\", err)\n\t}\n\n\tresp, err := c.Decrypt(ctx, key.Name, key.Version, azkeys.KeyOperationParameters{\n\t\tAlgorithm: to.Ptr(azkeys.EncryptionAlgorithmRSAOAEP256),\n\t\tValue:     rawEncryptedKey,\n\t}, nil)","sourceCodeStart":248,"sourceCodeEnd":284,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/azkv/keysource.go#L248-L284","documentation":"Raised at the start of DecryptContext when getTokenCredential cannot produce an Azure token credential (azidentity fails to build a DefaultAzureCredential or similar). Decryption cannot even start without a credential, so the error is returned with the underlying azidentity cause wrapped.","triggerScenarios":"Calling Decrypt on an Azure KV MasterKey when no credential source is available: not logged in with az CLI, no Managed Identity, and none of AZURE_TENANT_ID/AZURE_CLIENT_ID/AZURE_CLIENT_SECRET (or AZURE_AUTHORITY_HOST / certificate paths) are set.","commonSituations":"CI jobs without service-principal secrets, running sops inside a container without the az config volume mounted, expired SP credentials, AZURE_CLIENT_CERTIFICATE_PATH missing, azidentity DefaultAzureCredential chain exhausted.","solutions":["Run `az login` locally, or set AZURE_TENANT_ID, AZURE_CLIENT_ID and AZURE_CLIENT_SECRET for a service principal","Ensure Managed Identity is enabled when running on Azure VMs/App Service/AKS","When in a container/CI, mount ~/.azure or provide the service principal env vars","Check azidentity error in the wrapped message for which credential in the chain failed and why"],"exampleFix":"// before\nsops -d file.yaml  # failed to get Azure token credential\n// after\nexport AZURE_TENANT_ID=... AZURE_CLIENT_ID=... AZURE_CLIENT_SECRET=...\nsops -d file.yaml","handlingStrategy":"validation","validationCode":"// verify a credential is obtainable before decrypting\ncred, err := azidentity.NewDefaultAzureCredential(nil)\nif err != nil {\n\treturn fmt.Errorf(\"no Azure credential available: run 'az login' or set AZURE_TENANT_ID/AZURE_CLIENT_ID/AZURE_CLIENT_SECRET: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"defer func() {\n\tif r := recover(); r != nil { /* not applicable in Go, use error check */ }\n}()\nout, err := cmd.Output()\nif err != nil && strings.Contains(string(out), \"failed to get Azure token credential\") {\n\treturn fmt.Errorf(\"authenticate first: az login, or set AZURE_* service-principal env vars\")\n}","preventionTips":["Always run `az login` before local sops decrypt operations","In CI, provision AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET as secrets/env","Use Managed Identity when running inside Azure (VMs, AKS, App Service)","Check SP secret/cert expiration dates and rotate ahead of time"],"tags":["azure","authentication","credentials","decryption"],"backgroundTag":"missing-azure-credentials","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}