Dokploy/dokploy · error · Error

AWS Secrets Manager: secret "${secretId}" is not JSON, canno

Error message

AWS Secrets Manager: secret "${secretId}" is not JSON, cannot extract field "${field}"

What it means

When a vault ref includes a field (mysecret:password), getSecrets must JSON.parse the secret string to extract it. If the secret isn't valid JSON (plain text, YAML, base64), parsing fails and this error is thrown.

Source

Thrown at packages/server/src/utils/vault/aws.ts:70

					);
				}
				secretStrings.set(secretId, response.SecretString);
			}),
		);

		const result: Record<string, string> = {};
		for (const ref of refs) {
			const { secretId, field } = parseRef(ref);
			const secretString = secretStrings.get(secretId) as string;
			if (field === null) {
				result[ref] = secretString;
				continue;
			}
			let parsed: Record<string, unknown>;
			try {
				parsed = JSON.parse(secretString);
			} catch {
				throw new Error(
					`AWS Secrets Manager: secret "${secretId}" is not JSON, cannot extract field "${field}"`,
				);
			}
			const value = parsed[field];
			if (value === undefined || value === null) {
				throw new Error(
					`AWS Secrets Manager: field "${field}" not found in secret "${secretId}"`,
				);
			}
			result[ref] = typeof value === "string" ? value : JSON.stringify(value);
		}
		return result;
	},

	async testConnection(config) {
		const client = createClient(config);
		await client.send(new ListSecretsCommand({ MaxResults: 1 }));
	},

View on GitHub (pinned to 546686ea35)

Solutions

  1. Store the secret as a JSON object: {"password":"s3cr3t!"} and keep the :password field ref
  2. Or drop the field suffix and reference the whole secret by name if it's a single value

Example fix

# before
aws secretsmanager put-secret-value --secret-id db --secret-string 's3cr3t!'
# ref: db:password

# after
aws secretsmanager put-secret-value --secret-id db --secret-string '{"password":"s3cr3t!"}'
# ref: db:password
Defensive patterns

Strategy: validation

Validate before calling

const probe = JSON.parse(await getSecretString(secretId)); // fails early with clear cause
if (typeof probe !== 'object') throw new Error('Secret must be a JSON object to use field refs');

Type guard

const isJsonObjectSecret = (s: string): boolean => {
  try { return typeof JSON.parse(s) === 'object' && JSON.parse(s) !== null; } catch { return false; }
};

Try / catch

try {
  await vault.getSecrets([`mysecret:field`]);
} catch (e) {
  if (/is not JSON/.test(String(e))) {
    // rewrite secret as JSON object, or drop the :field suffix
  }
}

Prevention

When it happens

Trigger: Setting ref 'db:password' where secret 'db' contains 's3cr3t!' (plain string, not JSON object).

Common situations: Storing a single password as plain text but referencing it with a :field suffix; storing YAML/env-file formatted secrets.

Related errors

AI-assisted analysis of Dokploy/dokploy@546686ea35 (2026-08-27). Data as JSON: /api/errors/b7e642bfc830a185. Report an issue: GitHub.