apache/beam · error · RuntimeError

Failed to retrieve secret bytes for secret

Error message

Failed to retrieve secret bytes for secret {self._version_name} with exception {e}

What it means

GcpSecret.get_secret_bytes calls the Google Secret Manager API (access_secret_version). Any failure — network error, missing secret/version, permission denied, malformed version path, or missing google-cloud-secret-manager dependency — is wrapped and re-raised as a RuntimeError including the version name and the original exception.

Solutions

  1. Read the wrapped exception: fix the underlying cause (NotFound → check name/project/version; PermissionDenied → grant secretAccessor).
  2. Verify the version_name format: projects/<proj>/secrets/<name>/versions/<version>.
  3. Enable the Secret Manager API and install google-cloud-secret-manager.
  4. Check ADC / workload identity credentials are valid for the project.
  5. Retry on transient network errors with backoff.

Example fix

// before
bytes = secret.get_secret_bytes()  # fails: NotFound
// after
# ensure spec uses correct project/version
secret = GcpSecret.from_dict({'name': 'db-pass', 'project': 'my-proj', 'version': '1'})
bytes = secret.get_secret_bytes()
Defensive patterns

Strategy: try-catch

Validate before calling

from google.cloud import secretmanager_v1
client = secretmanager_v1.SecretManagerServiceClient()
name = f'projects/{proj}/secrets/{sid}/versions/{ver}'
client.get_secret_version(request={'name': name})  # raises early if missing/no permission

Type guard

def secret_resource_path(proj, sid, ver='latest') -> str:
    return f'projects/{proj}/secrets/{sid}/versions/{ver}'

Try / catch

try:
    data = secret.get_secret_bytes()
except RuntimeError as e:
    logging.error('Secret fetch failed: %s', e)
    if 'PermissionDenied' in str(e): grant_secret_accessor()
    elif 'NotFound' in str(e): verify_secret_version()
    else: raise

Prevention

When it happens

Trigger: Calling get_secret_bytes() when the secret does not exist, the caller lacks roles/secretmanager.secretAccessor, the version path is wrong, there is no network/auth, or the google-cloud-secret-manager package is not installed.

Common situations: Wrong project in the version path; secret deleted or version 'latest' with no versions; running on a service account without Secret Manager access; API not enabled on the project.

Related errors

AI-assisted analysis of apache/beam@12126d8942 (2026-09-13). Data as JSON: /api/errors/03ff88f7d2d06376. Report an issue: GitHub.

Appendix: source

Thrown at sdks/python/apache_beam/utils/secret.py:264

    if not project_id:
      raise ValueError(
          f"Could not resolve GCP project ID for secret '{secret_id}'. "
          "Please specify 'project' in the secret spec, set GOOGLE_CLOUD_PROJECT environment variable, "
          "or configure Application Default Credentials.")

    return f"projects/{project_id}/secrets/{secret_id}/versions/{version_id}"

  def get_secret_bytes(self) -> bytes:
    try:
      from google.cloud import secretmanager
      client = secretmanager.SecretManagerServiceClient()
      response = client.access_secret_version(
          request={"name": self._version_name})
      secret = response.payload.data
      return secret
    except Exception as e:
      raise RuntimeError(
          'Failed to retrieve secret bytes for secret '
          f'{self._version_name} with exception {e}')

  def __eq__(self, secret):
    return self._version_name == getattr(secret, '_version_name', None)


class GcpHsmGeneratedSecret(Secret):
  """A secret manager implementation that generates a secret using a GCP HSM key
  and stores it in Google Cloud Secret Manager. If the secret already exists,
  it will be retrieved.
  """
  def __init__(
      self,
      project_id: str,
      location_id: str,
      key_ring_id: str,
      key_id: str,

View on GitHub (pinned to 12126d8942)