opentofu/opentofu · error

invalid key vault name: Azure requires a key vault name cons

Error message

invalid key vault name: Azure requires a key vault name consists of 3-24 letters, numbers, and hyphens only. It must start with a letter and cannot end with a hyphen. See documentation here: https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/resource-name-rules#microsoftkeyvault

What it means

The subdomain of the parsed vault_uri hostname must match ^[a-zA-Z][0-9a-zA-Z-]{1,22}[0-9a-zA-Z]$, i.e. 3-24 characters, starting with a letter, ending with a letter/digit, containing only alphanumerics and hyphens. This mirrors Azure's Key Vault naming rules and is checked in Config.Build() before contacting Azure, wrapped as ErrInvalidConfiguration.

Source

Thrown at internal/encryption/keyprovider/azure_vault/config.go:230

	keyNamePattern := regexp.MustCompile(`^[0-9a-zA-Z\-]{1,127}$`)
	vaultPattern := regexp.MustCompile(`^[a-zA-Z][0-9a-zA-Z\-]{1,22}[0-9a-zA-Z]$`)
	hyphenPattern := regexp.MustCompile(`\-\-`)
	if !keyNamePattern.Match([]byte(keyName)) {
		return errors.New("invalid key name: Azure requires a key name consists of 1-127 letters, numbers, or hyphens. See documentation here: https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/resource-name-rules#microsoftkeyvault")
	}
	// Break apart the URL into parts
	u, err := url.Parse(vaultUrl)
	if err != nil {
		return fmt.Errorf("invalid key vault URL: %w", err)
	}
	hostname := u.Hostname()
	hostParts := strings.Split(hostname, ".")
	if len(hostParts) == 0 {
		return errors.New("invalid vault host name: no subdomain found")
	}
	vaultName := hostParts[0]
	if !vaultPattern.Match([]byte(vaultName)) {
		return errors.New("invalid key vault name: Azure requires a key vault name consists of 3-24 letters, numbers, and hyphens only. It must start with a letter and cannot end with a hyphen. See documentation here: https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/resource-name-rules#microsoftkeyvault")
	}
	if hyphenPattern.Match([]byte(vaultName)) {
		return errors.New("invalid key vault name: Hyphens in a key vault name must be nonconsecutive. See documentation here: https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/resource-name-rules#microsoftkeyvault")
	}
	return nil
}

View on GitHub (pinned to 3561785c48)

Solutions

1. Set vault_uri to the 'DNS Name' value from the vault's Overview page in the Azure portal (https://<vault-name>.vault.azure.net)
2. Check the vault name is 3-24 chars, starts with a letter, ends with a letter/digit, and uses only alphanumerics and hyphens
3. For non-public clouds, use the correct domain suffix (e.g. vault.azure.us, vault.microsoftazure.de) with the vault name as subdomain

Example fix

// before
vault_uri = "https://vault.azure.net/"

// after
vault_uri = "https://my-vault-2024.vault.azure.net/"

var reVault = regexp.MustCompile(`^[a-zA-Z][0-9a-zA-Z-]{1,22}[0-9a-zA-Z]$`)
u, _ := url.Parse(cfg.VaultURI)
name := strings.Split(u.Hostname(), ".")[0]
if !reVault.MatchString(name) {
    return fmt.Errorf("vault name %q must be 3-24 chars, start with a letter, end with a letter/digit", name)
}

When it happens

Trigger: A vault_uri whose first hostname label violates the pattern: name starting with a digit, ending with a hyphen, containing underscores, being 1-2 or 25+ characters, or an empty hostname (e.g. 'https://vault.azure.net' where the subdomain 'vault' is a placeholder, or an empty host which yields vaultName "").

Common situations: Using the generic docs example URL, omitting the vault name, pasting a management-plane or portal URL instead of the vault DNS name, or a vault name with underscore typed by mistake.

Related errors

• invalid key name: Azure requires a key name consists of 1-12
• invalid key vault name: Hyphens in a key vault name must be
• invalid vault host name: no subdomain found
• error downloading azure blob: %w
• CPK: failed to decode base64 key %w

AI-assisted analysis of opentofu/opentofu@3561785c48 (2026-08-15). Data as JSON: /api/errors/00d2c78fbefabc6e. Report an issue: GitHub.