Dokploy/dokploy · error · Error

AWS Secrets Manager: field "${field}" not found in secret "$

Error message

AWS Secrets Manager: field "${field}" not found in secret "${secretId}"

What it means

The secret parsed as JSON but the requested key is missing or null. getSecrets extracts parsed[field] and throws when it's undefined/null, distinguishing 'wrong field name' from 'not JSON' (the preceding error).

Source

Thrown at packages/server/src/utils/vault/aws.ts:76

		const result: Record<string, string> = {};
		for (const ref of refs) {
			const { secretId, field } = parseRef(ref);
			const secretString = secretStrings.get(secretId) as string;
			if (field === null) {
				result[ref] = secretString;
				continue;
			}
			let parsed: Record<string, unknown>;
			try {
				parsed = JSON.parse(secretString);
			} catch {
				throw new Error(
					`AWS Secrets Manager: secret "${secretId}" is not JSON, cannot extract field "${field}"`,
				);
			}
			const value = parsed[field];
			if (value === undefined || value === null) {
				throw new Error(
					`AWS Secrets Manager: field "${field}" not found in secret "${secretId}"`,
				);
			}
			result[ref] = typeof value === "string" ? value : JSON.stringify(value);
		}
		return result;
	},

	async testConnection(config) {
		const client = createClient(config);
		await client.send(new ListSecretsCommand({ MaxResults: 1 }));
	},

	async listSecretNames(config) {
		const client = createClient(config);
		const names: string[] = [];
		let nextToken: string | undefined;
		do {

View on GitHub (pinned to 546686ea35)

Solutions

Check the secret's JSON keys: aws secretsmanager get-secret-value --secret-id X --query SecretString and fix the ref to match exactly (case-sensitive)
Update the secret to include the missing key if it should exist
Remove :field from the ref if you want the whole JSON

Example fix

# before
secret: {"pass":"s3cr3t!"}
ref:  db:password

# after
secret: {"password":"s3cr3t!"}
ref:  db:password

Defensive patterns

Strategy: validation

Validate before calling

const parsed = JSON.parse(await getSecretString(secretId));
if (!(field in parsed)) throw new Error(`Field ${field} not in secret — fix ref`);

Type guard

const hasField = (obj: unknown, field: string): obj is Record<string, unknown> & Record<field, unknown> =>
  typeof obj === 'object' && obj !== null && field in obj;

Try / catch

try {
  await vault.getSecrets([`db:${field}`]);
} catch (e) {
  if (/not found in secret/.test(String(e))) {
    // compare field spelling/case against the secret's actual keys
  }
}

Prevention

Use exact, case-sensitive field names matching the JSON keys
Codify secret schemas so refs and values stay in sync

When it happens

Trigger: Ref 'db:password' when the secret JSON is {"pass":"..."} — typo or renamed key; key present but explicitly null.

Common situations: Field renamed in the secret without updating refs; case mismatch (Password vs password); copying a field name from a different secret.

Related errors

AI-assisted analysis of Dokploy/dokploy@546686ea35 (2026-08-27). Data as JSON: /api/errors/e1f9262ae5f53eb2. Report an issue: GitHub.