apache/beam · error · IllegalArgumentException

Invalid secret parameter %s

Error message

Invalid secret parameter %s

What it means

GcpSecret.fromMap validates the secret spec map against the allowed keys (version_name, name, project, version). Unknown keys trigger IllegalArgumentException 'Invalid secret parameter <keys>'. This catches typos before any Secret Manager call is made.

Source

Thrown at sdks/java/extensions/google-cloud-platform-core/src/main/java/org/apache/beam/sdk/extensions/gcp/util/GcpSecret.java:66

   *
   * @param versionName The full version name of the secret in Google Cloud Secret Manager. For
   *     example: projects/<id>/secrets/<secret_name>/versions/1. For more info, see
   *     https://cloud.google.com/python/docs/reference/secretmanager/latest/google.cloud.secretmanager_v1beta1.services.secret_manager_service.SecretManagerServiceClient#google_cloud_secretmanager_v1beta1_services_secret_manager_service_SecretManagerServiceClient_access_secret_version
   */
  public GcpSecret(String versionName) {
    this.versionName = versionName;
  }

  /** Initialize GcpSecret from a map specification. */
  static GcpSecret fromMap(Map<String, String> specMap) {
    Set<String> allowedKeys =
        new HashSet<>(Arrays.asList("version_name", "name", "project", "version"));
    Set<String> invalidKeys = new HashSet<>(specMap.keySet());
    invalidKeys.removeAll(allowedKeys);
    if (!invalidKeys.isEmpty()) {
      List<String> sortedInvalid = new ArrayList<>(invalidKeys);
      Collections.sort(sortedInvalid);
      throw new IllegalArgumentException(
          "Invalid secret parameter " + String.join(", ", sortedInvalid));
    }
    String versionName = parseVersionName(specMap);
    return new GcpSecret(versionName);
  }

  /** Parses the version name from a specification dictionary. */
  private static String parseVersionName(Map<String, String> specMap) {
    String versionNameParam = specMap.get("version_name");
    if (!Strings.isNullOrEmpty(versionNameParam)) {
      return Preconditions.checkNotNull(
          versionNameParam, "version_name must contain a valid value for versionName parameter");
    }
    String secretId = specMap.get("name");
    if (Strings.isNullOrEmpty(secretId)) {
      throw new IllegalArgumentException("Secret name must be specified in secret spec.");
    }
    String projectId = resolveGcpProjectId(specMap.get("project"), "secret '" + secretId + "'");

View on GitHub (pinned to 12126d8942)

Solutions

1. Remove or rename the reported invalid keys
2. Allowed keys are only: version_name, name, project, version
3. Prefer supplying version_name directly (projects/p/secrets/s/versions/v) to skip name/project/version resolution

Example fix

// before
Map<String,String> spec = Map.of("project_id","p","name","my-secret");
// after
Map<String,String> spec = Map.of("project","p","name","my-secret");

Set<String> allowed = Set.of("version_name","name","project","version");
if (!allowed.containsAll(specMap.keySet())) {
  Set<String> bad = new HashSet<>(specMap.keySet()); bad.removeAll(allowed);
  throw new IllegalArgumentException("Unknown GcpSecret keys: " + bad);
}

try { secret = GcpSecret.fromMap(spec); }
catch (IllegalArgumentException e) { LOG.error("Invalid secret spec: " + e.getMessage()); throw e; }

When it happens

Trigger: Calling GcpSecret.fromMap with keys like 'versionId', 'secret_name', 'project_id', or leftover keys intended for GcpHsmGeneratedSecret.

Common situations: Confusing the two secret spec schemas (GcpSecret vs GcpHsmGeneratedSecret); typo'd snake_case/camelCase keys; stale specs after a library update changed the allowed set.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• Invalid secret parameter %s
• Error constructing default value for gcpTempLocation: tempLo
• The key '%s' in GCS custom audit entries exceeds the %d-char
• The value '%s' in GCS custom audit entries exceeds the %d-ch
• The maximum allowed number of GCS custom audit entries (incl

AI-assisted analysis of apache/beam@12126d8942 (2026-09-13). Data as JSON: /api/errors/b5521fca1272248c. Report an issue: GitHub.