getsops/sops · error

no valid ARN found in '%s'

Error message

no valid ARN found in '%s'

What it means

This error comes from sops' KMS key source when the `arn` field of a MasterKey does not match the expected AWS KMS ARN format. createKMSConfig validates the ARN with a regexp to extract the region; if the pattern does not match (nil matches), it refuses to build an AWS config. The ARN must look like arn:aws:kms:<region>:<account>:key/<key-id> (or alias form), possibly with extra text around it that the regex extracts from.

Source

Thrown at kms/keysource.go:396

			outcontext[k] = *v
		}
		out["context"] = outcontext
	}
	return out
}

// TypeToIdentifier returns the string identifier for the MasterKey type.
func (key *MasterKey) TypeToIdentifier() string {
	return KeyTypeIdentifier
}

// createKMSConfig returns an AWS config with the credentialsProvider of the
// MasterKey, or the default configuration sources.
func (key MasterKey) createKMSConfig(ctx context.Context) (*aws.Config, error) {
	re := regexp.MustCompile(arnRegex)
	matches := re.FindStringSubmatch(key.Arn)
	if matches == nil {
		return nil, fmt.Errorf("no valid ARN found in '%s'", key.Arn)
	}
	region := matches[1]

	cfg, err := config.LoadDefaultConfig(ctx, func(lo *config.LoadOptions) error {
		// Use the credentialsProvider if present, otherwise default to reading credentials
		// from the environment.
		if key.credentialsProvider != nil {
			lo.Credentials = key.credentialsProvider
		}
		if key.AwsProfile != "" {
			lo.SharedConfigProfile = key.AwsProfile
		}
		lo.Region = region
		if key.httpClient != nil {
			lo.HTTPClient = key.httpClient
		}
		return nil
	})

View on GitHub (pinned to 13442bb981)

Solutions

1. Print the offending key's Arn (it is quoted in the message) and correct it to a full AWS KMS ARN such as arn:aws:kms:us-east-1:123456789012:key/xxxx-xxxx or alias/xxx form.
2. Verify there are no stray characters (whitespace, quotes, CRLF) around the ARN in .sops.yaml or the code that sets it.
3. If using a non-default partition (aws-cn, aws-us-gov), confirm the regex arnRegex in kms/keysource.go accepts it; otherwise use the standard partition or update the regex.
4. Regenerate the creation rule with `sops --kms <arn>` or `sops updatekeys` instead of hand-editing.

Example fix

// before
kms:
  - arn: "arn:aws:kms::123456789012:key/abcd-1234"  # missing region
// after
kms:
  - arn: "arn:aws:kms:us-east-1:123456789012:key/abcd-1234"

// Go
var arnRegex = regexp.MustCompile(`^arn:(aws[a-zA-Z-]*):kms:([a-z0-9-]+):\d{12}:(key|alias)/.+$`)
func validKMSArn(arn string) bool { return arnRegex.MatchString(strings.TrimSpace(arn)) }
// call before building the key: if !validKMSArn(key.Arn) { return fmt.Errorf("bad KMS ARN: %q", key.Arn) }

func hasKMSArn(k kms.MasterKey) bool { return k.Arn != "" && strings.Contains(k.Arn, ":kms:") }

When it happens

Trigger: Calling EncryptContext or DecryptContext on a KMS MasterKey whose Arn field is empty, misspelled, points at another service (e.g. sqs, iam), lacks a region, or is otherwise malformed so the arnRegex FindStringSubmatch returns nil.

Common situations: Hand-edited sops .sops.yaml creation rules with a typo in the ARN; copying an ARN from another AWS service; forgetting the region segment; using an ARN of a KMS key from another partition (aws-cn, aws-gov) that the regex does not accept; leaving the arn field blank in code that constructs keys programmatically.

Related errors

• could not load AWS config: %w
• error loading config: cannot use more than one of encrypted_
• error loading config: more than one destinations were found
• can not compile regexp: %w
• no valid resource ID found in %q

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/93d11dd807a44fac. Report an issue: GitHub.