getsops/sops · error

invalid region %q: %w

Error message

invalid region %q: %w

What it means

createKMSClient resolves the Region string via kmsregion.SafeValueOf to obtain the KMS endpoint (hckms/keysource.go:281). If the region name is not recognized by the SDK's region catalog, this error wraps the lookup failure and no API call is made.

Source

Thrown at hckms/keysource.go:281

func (key *MasterKey) createKMSClient(ctx context.Context) (*huaweikms.KmsClient, error) {
	var cred auth.ICredential
	var err error

	if key.credentials != nil {
		cred = key.credentials
	} else {
		// Use default credential provider chain (env -> profile -> metadata)
		credentialProviderChain := provider.BasicCredentialProviderChain()
		cred, err = credentialProviderChain.GetCredentials()
		if err != nil {
			return nil, fmt.Errorf("failed to get HuaweiCloud credentials: %w", err)
		}
	}

	// Get KMS region with endpoint
	reg, err := kmsregion.SafeValueOf(key.Region)
	if err != nil {
		return nil, fmt.Errorf("invalid region %q: %w", key.Region, err)
	}

	// Create HTTP client builder
	hcClientBuilder := core.NewHcHttpClientBuilder().
		WithCredential(cred).
		WithRegion(reg)

	hcClient := hcClientBuilder.Build()

	// Create KMS client
	kmsClient := huaweikms.NewKmsClient(hcClient)
	return kmsClient, nil
}

View on GitHub (pinned to 13442bb981)

Solutions

1. Check the region part of the KeyID against HuaweiCloud's KMS region list and the SDK's region package
2. Correct the 'region:key-uuid' entry in .sops.yaml / file metadata
3. Upgrade huaweicloud-sdk-go-v3 so newer regions are included in the SDK's region catalog
4. Verify case/format: regions are lowercase names like 'tr-west-1', not ARNs or endpoints

Example fix

// before (.sops.yaml)
- hckms: us-east-1:1234abcd-12ab-34cd-56ef-1234567890ab
// after
- hckms: tr-west-1:1234abcd-12ab-34cd-56ef-1234567890ab

// Go: preflight the region string before encrypt/decrypt
r, err := kmsregion.SafeValueOf(key.Region)
if err != nil {
    return fmt.Errorf("region %q is not a known HuaweiCloud KMS region", key.Region)
}

if _, err := key.DecryptContext(ctx); err != nil {
    if strings.Contains(err.Error(), "invalid region") {
        return fmt.Errorf("fix the region part of the hckms 'region:key-uuid' entry")
    }
    return err
}

When it happens

Trigger: EncryptContext or DecryptContext runs with a MasterKey whose Region (the part before ':' in 'region:key-uuid') does not match any region in huaweicloud-sdk-go-v3/services/kms/v2/region — unknown name, wrong casing, or a region added to HuaweiCloud after your SDK version was released.

Common situations: Typo in the region in .sops.yaml (e.g. 'tr-west-0' vs 'tr-west-1'); copy-pasting an AWS-style region (us-east-1); newly launched HuaweiCloud region not present in an older pinned SDK version.

Related errors

• invalid key ID format: expected 'region:key-uuid', got %q
• region cannot be empty in key ID: %q
• key UUID cannot be empty in key ID: %q
• no valid resource ID found in %q
• failed to create HuaweiCloud KMS client: %w

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/bd45671e21ff218a. Report an issue: GitHub.