getsops/sops · error

invalid region

Error message

invalid region %q: %w

What it means

createKMSClient resolves the Region string via kmsregion.SafeValueOf to obtain the KMS endpoint (hckms/keysource.go:281). If the region name is not recognized by the SDK's region catalog, this error wraps the lookup failure and no API call is made.

Solutions

1. Check the region part of the KeyID against HuaweiCloud's KMS region list and the SDK's region package
2. Correct the 'region:key-uuid' entry in .sops.yaml / file metadata
3. Upgrade huaweicloud-sdk-go-v3 so newer regions are included in the SDK's region catalog
4. Verify case/format: regions are lowercase names like 'tr-west-1', not ARNs or endpoints

Example fix

// before (.sops.yaml)
- hckms: us-east-1:1234abcd-12ab-34cd-56ef-1234567890ab
// after
- hckms: tr-west-1:1234abcd-12ab-34cd-56ef-1234567890ab

// Go: preflight the region string before encrypt/decrypt
r, err := kmsregion.SafeValueOf(key.Region)
if err != nil {
    return fmt.Errorf("region %q is not a known HuaweiCloud KMS region", key.Region)
}

if _, err := key.DecryptContext(ctx); err != nil {
    if strings.Contains(err.Error(), "invalid region") {
        return fmt.Errorf("fix the region part of the hckms 'region:key-uuid' entry")
    }
    return err
}

When it happens

Trigger: EncryptContext or DecryptContext runs with a MasterKey whose Region (the part before ':' in 'region:key-uuid') does not match any region in huaweicloud-sdk-go-v3/services/kms/v2/region — unknown name, wrong casing, or a region added to HuaweiCloud after your SDK version was released.

Common situations: Typo in the region in .sops.yaml (e.g. 'tr-west-0' vs 'tr-west-1'); copy-pasting an AWS-style region (us-east-1); newly launched HuaweiCloud region not present in an older pinned SDK version.

Related errors

• invalid key ID format: expected 'region:key-uuid', got
• key UUID cannot be empty in key ID
• region cannot be empty in key ID
• decryption response missing plaintext
• encryption response missing ciphertext

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/bd45671e21ff218a. Report an issue: GitHub.

Appendix: source

Thrown at hckms/keysource.go:281

func (key *MasterKey) createKMSClient(ctx context.Context) (*huaweikms.KmsClient, error) {
	var cred auth.ICredential
	var err error

	if key.credentials != nil {
		cred = key.credentials
	} else {
		// Use default credential provider chain (env -> profile -> metadata)
		credentialProviderChain := provider.BasicCredentialProviderChain()
		cred, err = credentialProviderChain.GetCredentials()
		if err != nil {
			return nil, fmt.Errorf("failed to get HuaweiCloud credentials: %w", err)
		}
	}

	// Get KMS region with endpoint
	reg, err := kmsregion.SafeValueOf(key.Region)
	if err != nil {
		return nil, fmt.Errorf("invalid region %q: %w", key.Region, err)
	}

	// Create HTTP client builder
	hcClientBuilder := core.NewHcHttpClientBuilder().
		WithCredential(cred).
		WithRegion(reg)

	hcClient := hcClientBuilder.Build()

	// Create KMS client
	kmsClient := huaweikms.NewKmsClient(hcClient)
	return kmsClient, nil
}

View on GitHub (pinned to 13442bb981)