Dokploy/dokploy · error · Error

AWS Secrets Manager: secret "${secretId}" has no string valu

Error message

AWS Secrets Manager: secret "${secretId}" has no string value (binary secrets are not supported)

What it means

getSecrets calls GetSecretValue and requires SecretString; AWS returns SecretString undefined when the secret was stored as SecretBinary (e.g. a key/certificate uploaded as binary). Dokploy only handles string secrets and throws here.

Source

Thrown at packages/server/src/utils/vault/aws.ts:50

			accessKeyId: config.accessKeyId,
			secretAccessKey: config.secretAccessKey,
		},
		...(config.endpoint && { endpoint: config.endpoint }),
	});

export const awsClient: VaultClient<AwsConfig> = {
	async getSecrets(config, refs) {
		const client = createClient(config);
		const secretIds = [...new Set(refs.map((ref) => parseRef(ref).secretId))];

		const secretStrings = new Map<string, string>();
		await Promise.all(
			secretIds.map(async (secretId) => {
				const response = await client.send(
					new GetSecretValueCommand({ SecretId: secretId }),
				);
				if (response.SecretString === undefined) {
					throw new Error(
						`AWS Secrets Manager: secret "${secretId}" has no string value (binary secrets are not supported)`,
					);
				}
				secretStrings.set(secretId, response.SecretString);
			}),
		);

		const result: Record<string, string> = {};
		for (const ref of refs) {
			const { secretId, field } = parseRef(ref);
			const secretString = secretStrings.get(secretId) as string;
			if (field === null) {
				result[ref] = secretString;
				continue;
			}
			let parsed: Record<string, unknown>;
			try {
				parsed = JSON.parse(secretString);

View on GitHub (pinned to 546686ea35)

Solutions

Re-create the secret as a string: aws secretsmanager put-secret-value --secret-id X --secret-string '...'
Store binary values base64-encoded in a string secret
If it's a JSON of fields, store the JSON as the secret string

Example fix

# before (binary)
aws secretsmanager put-secret-value --secret-id mysecret --secret-binary fileb://key.pem

# after (string)
aws secretsmanager put-secret-value --secret-id mysecret --secret-string "$(base64 -w0 key.pem)"

Defensive patterns

Strategy: validation

Validate before calling

const resp = await client.send(new DescribeSecretCommand({ SecretId }));
// no reliable precheck — validate on write instead: always use --secret-string

Try / catch

try {
  secrets = await vault.getSecrets(ids);
} catch (e) {
  if (/binary secrets are not supported/.test(String(e))) {
    // rewrite the secret as a string value, then retry
  }
}

Prevention

Always create secrets with secret-string
Base64-encode binary payloads into string secrets

When it happens

Trigger: Creating a secret via AWS CLI/terraform with a binary payload (SecretBinary), or an RDS-managed secret edge case where the value comes back binary.

Common situations: Storing TLS certs/keys as binary blobs; tooling that defaults to binary for non-UTF8 data.

Related errors

AI-assisted analysis of Dokploy/dokploy@546686ea35 (2026-08-27). Data as JSON: /api/errors/7a4f18559b203b9d. Report an issue: GitHub.