BerriAI/litellm · error · Exception

AWS KMS - Encrypted Value of Key={secret_name} is None

Error message

AWS KMS - Encrypted Value of Key={secret_name} is None

What it means

AWS KMS decryption guard in the secret manager handler: the environment variable holding the ciphertext for secret_name resolved to None, so there is no encrypted blob to pass to the KMS decrypt call. The base64-vs-raw encoding was already validated; this is strictly a missing-value failure.

Source

Thrown at litellm/secret_managers/secret_manager_handler.py:84

        else:
            raise ValueError(
                "Google KMS requires the encrypted secret to be encoded in base64"
            )  # fix for this vulnerability https://huntr.com/bounties/ae623c2f-b64b-4245-9ed4-f13a0a5824ce
        response = client.decrypt(
            request={
                "name": litellm._google_kms_resource_name,
                "ciphertext": ciphertext,
            }
        )
        secret = response.plaintext.decode("utf-8")  # assumes the original value was encoded with utf-8

    elif key_manager == KeyManagementSystem.AWS_KMS.value:
        """
        Only check the tokens which start with 'aws_kms/'. This prevents latency impact caused by checking all keys.
        """
        encrypted_value: Final = os.getenv(secret_name, None)
        if encrypted_value is None:
            raise Exception(f"AWS KMS - Encrypted Value of Key={secret_name} is None")
        # Decode the base64 encoded ciphertext
        ciphertext_blob: Final = base64.b64decode(encrypted_value)

        # Set up the parameters for the decrypt call
        params: Final = {"CiphertextBlob": ciphertext_blob}
        # Perform the decryption
        response = client.decrypt(**params)

        # Extract and decode the plaintext
        plaintext: Final = response["Plaintext"]
        secret = plaintext.decode("utf-8")
        if isinstance(secret, str):
            secret = secret.strip()

    elif key_manager == KeyManagementSystem.AWS_SECRET_MANAGER.value:
        from litellm.secret_managers.aws_secret_manager_v2 import (
            AWSSecretsManagerV2,
        )

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Ensure the env var for {secret_name} contains a non-empty base64 ciphertext.
2. Re-encrypt with aws kms encrypt and set the CiphertextBlob value.

When it happens

Trigger: Thrown at litellm/secret_managers/secret_manager_handler.py:84 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/91f8e2bca22b56ab. Report an issue: GitHub.