getsops/sops · error

failed to encrypt sops data key with Azure Key Vault key '%s

Error message

failed to encrypt sops data key with Azure Key Vault key '%s': %w

What it means

This error is raised by sops' Azure Key Vault keysource when the azkeys client's Encrypt call (RSA-OAEP-256) on the vault key fails while encrypting the SOPS data key during EncryptContext. The underlying Azure SDK error is wrapped, so the real cause (auth, network, permission, key state) is in the %w suffix.

Source

Thrown at azkv/keysource.go:224

	token, err := key.getTokenCredential()
	if err != nil {
		log.WithFields(logrus.Fields{"key": key.Name, "version": key.Version}).Info("Encryption failed")
		return fmt.Errorf("failed to get Azure token credential to encrypt data: %w", err)
	}

	c, err := azkeys.NewClient(key.VaultURL, token, key.clientOptions)
	if err != nil {
		log.WithFields(logrus.Fields{"key": key.Name, "version": key.Version}).Info("Encryption failed")
		return fmt.Errorf("failed to construct Azure Key Vault client to encrypt data: %w", err)
	}

	resp, err := c.Encrypt(ctx, key.Name, key.Version, azkeys.KeyOperationParameters{
		Algorithm: to.Ptr(azkeys.EncryptionAlgorithmRSAOAEP256),
		Value:     dataKey,
	}, nil)
	if err != nil {
		log.WithFields(logrus.Fields{"key": key.Name, "version": key.Version}).Info("Encryption failed")
		return fmt.Errorf("failed to encrypt sops data key with Azure Key Vault key '%s': %w", key.ToString(), err)
	}

	encodedEncryptedKey := base64.RawURLEncoding.EncodeToString(resp.KeyOperationResult.Result)
	key.SetEncryptedDataKey([]byte(encodedEncryptedKey))
	log.WithFields(logrus.Fields{"key": key.Name, "version": key.Version}).Info("Encryption succeeded")
	return nil
}

// EncryptedDataKey returns the encrypted data key this master key holds.
func (key *MasterKey) EncryptedDataKey() []byte {
	return []byte(key.EncryptedKey)
}

// SetEncryptedDataKey sets the encrypted data key for this master key.
func (key *MasterKey) SetEncryptedDataKey(enc []byte) {
	key.EncryptedKey = string(enc)
}

View on GitHub (pinned to 13442bb981)

Solutions

1. Run `az login` (or fix Managed Identity / AZURE_* env vars) and confirm `az keyvault key show --vault-name <vault> --name <key>` works
2. Grant the identity the Key Vault Crypto User role (or 'encrypt' access policy permission) on the vault
3. Verify key name and version in the Azure KV master key config match an enabled, non-expired key in the vault
4. Check network reachability to the vault URL (VPN, firewall, private endpoint DNS)

Example fix

// before
sops -e file.yaml  # fails with Azure KV key 'mykey' encrypt error
// after
az login
az role assignment create --assignee <user> --role 'Key Vault Crypto User' --scope /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.KeyVault/vaults/<vault>
sops -e file.yaml

// before calling Encrypt
import "os/exec"
func checkVaultKey(vault, name string) error {
	out, err := exec.Command("az", "keyvault", "key", "show", "--vault-name", vault, "--name", name).CombinedOutput()
	if err != nil { return fmt.Errorf("key not accessible: %s", out) }
	return nil
}

if err := key.Encrypt(); err != nil {
	var azErr *azcore.ResponseError
	if errors.As(err, &azErr) && azErr.StatusCode == http.StatusForbidden {
		// handle RBAC/access-policy denial: prompt to run az login or grant Crypto User
	}
	return fmt.Errorf("azure kv encrypt failed: %w", err)
}

When it happens

Trigger: Calling Encrypt/EncryptContext on an azkv.MasterKey where c.Encrypt returns an error: key name/version does not exist in the vault, the credential lacks the 'encrypt' key permission, the vault is unreachable, or the key is disabled/expired.

Common situations: Missing or expired Azure login (az login / Managed Identity unavailable), RBAC or access policy missing 'encrypt' (e.g. Key Vault Crypto User role not assigned), typo in key name or vault URL in .sops.yaml, key soft-deleted or purged, network/firewall blocking the vault endpoint.

Related errors

• failed to get Azure token credential to retrieve key version
• failed to get Azure token credential to encrypt data: %w
• failed to construct Azure Key Vault client to encrypt data:
• could not parse %q into a valid Azure Key Vault MasterKey %v
• failed to construct Azure Key Vault client to retrieve key v

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/7a678c661d7601a5. Report an issue: GitHub.