getsops/sops · error

failed to get Azure token credential to decrypt: %w

Error message

failed to get Azure token credential to decrypt: %w

What it means

Raised at the start of DecryptContext when getTokenCredential cannot produce an Azure token credential (azidentity fails to build a DefaultAzureCredential or similar). Decryption cannot even start without a credential, so the error is returned with the underlying azidentity cause wrapped.

Source

Thrown at azkv/keysource.go:266

	}
	return nil
}

// Decrypt decrypts the EncryptedKey field with Azure Key Vault and returns
// the result.
//
// Consider using DecryptContext instead.
func (key *MasterKey) Decrypt() ([]byte, error) {
	return key.DecryptContext(context.Background())
}

// DecryptContext decrypts the EncryptedKey field with Azure Key Vault and returns
// the result.
func (key *MasterKey) DecryptContext(ctx context.Context) ([]byte, error) {
	token, err := key.getTokenCredential()
	if err != nil {
		log.WithFields(logrus.Fields{"key": key.Name, "version": key.Version}).Info("Decryption failed")
		return nil, fmt.Errorf("failed to get Azure token credential to decrypt: %w", err)
	}

	rawEncryptedKey, err := base64.RawURLEncoding.DecodeString(key.EncryptedKey)
	if err != nil {
		log.WithFields(logrus.Fields{"key": key.Name, "version": key.Version}).Info("Decryption failed")
		return nil, fmt.Errorf("failed to base64 decode Azure Key Vault encrypted key: %w", err)
	}

	c, err := azkeys.NewClient(key.VaultURL, token, key.clientOptions)
	if err != nil {
		log.WithFields(logrus.Fields{"key": key.Name, "version": key.Version}).Info("Decryption failed")
		return nil, fmt.Errorf("failed to construct Azure Key Vault client to decrypt data: %w", err)
	}

	resp, err := c.Decrypt(ctx, key.Name, key.Version, azkeys.KeyOperationParameters{
		Algorithm: to.Ptr(azkeys.EncryptionAlgorithmRSAOAEP256),
		Value:     rawEncryptedKey,
	}, nil)

View on GitHub (pinned to 13442bb981)

Solutions

1. Run `az login` locally, or set AZURE_TENANT_ID, AZURE_CLIENT_ID and AZURE_CLIENT_SECRET for a service principal
2. Ensure Managed Identity is enabled when running on Azure VMs/App Service/AKS
3. When in a container/CI, mount ~/.azure or provide the service principal env vars
4. Check azidentity error in the wrapped message for which credential in the chain failed and why

Example fix

// before
sops -d file.yaml  # failed to get Azure token credential
// after
export AZURE_TENANT_ID=... AZURE_CLIENT_ID=... AZURE_CLIENT_SECRET=...
sops -d file.yaml

// verify a credential is obtainable before decrypting
cred, err := azidentity.NewDefaultAzureCredential(nil)
if err != nil {
	return fmt.Errorf("no Azure credential available: run 'az login' or set AZURE_TENANT_ID/AZURE_CLIENT_ID/AZURE_CLIENT_SECRET: %w", err)
}

defer func() {
	if r := recover(); r != nil { /* not applicable in Go, use error check */ }
}()
out, err := cmd.Output()
if err != nil && strings.Contains(string(out), "failed to get Azure token credential") {
	return fmt.Errorf("authenticate first: az login, or set AZURE_* service-principal env vars")
}

When it happens

Trigger: Calling Decrypt on an Azure KV MasterKey when no credential source is available: not logged in with az CLI, no Managed Identity, and none of AZURE_TENANT_ID/AZURE_CLIENT_ID/AZURE_CLIENT_SECRET (or AZURE_AUTHORITY_HOST / certificate paths) are set.

Common situations: CI jobs without service-principal secrets, running sops inside a container without the az config volume mounted, expired SP credentials, AZURE_CLIENT_CERTIFICATE_PATH missing, azidentity DefaultAzureCredential chain exhausted.

Related errors

• failed to get Azure token credential to retrieve key version
• failed to get Azure token credential to encrypt data: %w
• failed to encrypt sops data key with Azure Key Vault key '%s
• failed to base64 decode Azure Key Vault encrypted key: %w
• failed to decrypt sops data key with Azure Key Vault key '%s

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/ff44ca41f584a55c. Report an issue: GitHub.