getsops/sops · error

invalid key ID format: expected 'region:key-uuid', got %q

Error message

invalid key ID format: expected 'region:key-uuid', got %q

What it means

HuaweiCloud KMS key IDs in SOPS must be 'region:key-uuid'. parseKeyID splits on ':' and requires exactly two non-empty parts; when the input has no colon at all, this error is returned with the offending key ID quoted.

Source

Thrown at hckms/keysource.go:103

		s = strings.TrimSpace(s)
		if s == "" {
			continue
		}
		k, err := NewMasterKey(s)
		if err != nil {
			return nil, err
		}
		keys = append(keys, k)
	}
	return keys, nil
}

// parseKeyID parses a key ID in format "region:key-uuid" and returns the region and UUID.
func parseKeyID(keyID string) (string, string, error) {
	keyID = strings.TrimSpace(keyID)
	parts := strings.SplitN(keyID, ":", 2)
	if len(parts) != 2 {
		return "", "", fmt.Errorf("invalid key ID format: expected 'region:key-uuid', got %q", keyID)
	}
	region := strings.TrimSpace(parts[0])
	keyUUID := strings.TrimSpace(parts[1])
	if region == "" {
		return "", "", fmt.Errorf("region cannot be empty in key ID: %q", keyID)
	}
	if keyUUID == "" {
		return "", "", fmt.Errorf("key UUID cannot be empty in key ID: %q", keyID)
	}
	return region, keyUUID, nil
}

// Credentials is a wrapper around auth.ICredential used for authentication
// towards HuaweiCloud KMS.
type Credentials struct {
	credential auth.ICredential
}

View on GitHub (pinned to 13442bb981)

Solutions

1. Format the key ID as region:key-uuid, e.g. 'eu-west-0:12345678-90ab-cdef-1234-567890abcdef'.
2. Check the region prefix matches your KMS endpoint region (e.g. eu-west-0, ap-southeast-1).
3. Ensure the ':' separator exists — a bare UUID without region also triggers this error.
4. Quote the value in YAML if it contains characters your parser mangles.

Example fix

// before
// huawei://9a8b7c6d-1234-5678-9abc-def012345678
// after
// huawei://eu-west-0:9a8b7c6d-1234-5678-9abc-def012345678

func validHwKeyID(id string) bool {
    parts := strings.SplitN(strings.TrimSpace(id), ":", 2)
    return len(parts) == 2 && strings.TrimSpace(parts[0]) != "" && strings.TrimSpace(parts[1]) != ""
}

null

null

When it happens

Trigger: NewMasterKey (or parsing keys from .sops.yaml huawei kms entries) given an ID like 'arn:...'-style string, a bare UUID, or a whitespace-only string with no ':' separator.

Common situations: Copying the raw KMS key UUID from the HuaweiCloud console without prefixing the region; pasting a full CMK ARN-like identifier; YAML entry missing the region part after an edit.

Related errors

• region cannot be empty in key ID: %q
• key UUID cannot be empty in key ID: %q
• no valid resource ID found in %q
• invalid region %q: %w
• failed to create HuaweiCloud KMS client: %w

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/fc8172dbb9a9deff. Report an issue: GitHub.