Dokploy/dokploy · warning · Error

Invalid AWS Secrets Manager reference "${ref}": use the secr

Error message

Invalid AWS Secrets Manager reference "${ref}": use the secret name, not the ARN

What it means

Dokploy's AWS vault expects secret references as 'secret-name' or 'secret-name:json-field', not full ARNs. parseRef rejects any ref starting with 'arn:' because the SDK call is made with the name and IAM policies are matched on it.

Source

Thrown at packages/server/src/utils/vault/aws.ts:14

import {
	GetSecretValueCommand,
	ListSecretsCommand,
	SecretsManagerClient,
} from "@aws-sdk/client-secrets-manager";
import type { awsVaultConfigSchema } from "@dokploy/server/db/schema";
import type { z } from "zod";
import type { VaultClient } from "./types";

type AwsConfig = z.infer<typeof awsVaultConfigSchema>;

const parseRef = (ref: string) => {
	if (ref.startsWith("arn:")) {
		throw new Error(
			`Invalid AWS Secrets Manager reference "${ref}": use the secret name, not the ARN`,
		);
	}
	const separatorIndex = ref.lastIndexOf(":");
	if (separatorIndex === -1) {
		return { secretId: ref, field: null };
	}
	return {
		secretId: ref.slice(0, separatorIndex),
		field: ref.slice(separatorIndex + 1),
	};
};

const createClient = (config: AwsConfig) =>
	new SecretsManagerClient({
		region: config.region,
		credentials: {
			accessKeyId: config.accessKeyId,

View on GitHub (pinned to 546686ea35)

Solutions

1. Use just the secret name: mysecret, or name plus field: mysecret:password
2. If the name contains a colon (rare), remember only the last colon splits the field
3. For cross-account secrets, ensure the name is resolvable by the server's IAM role

Example fix

# before
arn:aws:secretsmanager:us-east-1:123456789012:secret:mysecret-AbCdEf

# after
mysecret

const isArn = (ref: string) => ref.startsWith('arn:');
if (isArn(ref)) ref = ref.split(':').slice(-1)[0].replace(/-[A-Za-z0-9]{5}$/, ''); // or just reject

const isSecretName = (ref: string): boolean =>
  /^[a-zA-Z0-9/_+=.@-]+$/.test(ref) && !ref.startsWith('arn:');

When it happens

Trigger: Entering arn:aws:secretsmanager:us-east-1:123456789012:secret:mysecret-AbCdEf as the vault path in a project's secret mapping.

Common situations: Copy-pasting from the AWS console, which shows ARNs by default; migrating from a tool that accepts ARNs.

Related errors

• AWS Secrets Manager: secret "${secretId}" has no string valu
• AWS Secrets Manager: secret "${secretId}" is not JSON, canno
• AWS Secrets Manager: field "${field}" not found in secret "$
• BAD_REQUEST
• UNAUTHORIZED

AI-assisted analysis of Dokploy/dokploy@546686ea35 (2026-08-27). Data as JSON: /api/errors/b959185d441a13f1. Report an issue: GitHub.