apache/beam · error · IllegalArgumentException

Invalid secret parameter %s

Error message

Invalid secret parameter %s

What it means

GcpHsmGeneratedSecret.fromMap validates that the secret spec map only contains the allowed keys (project_id, location_id, key_ring_id, key_id, job_name, plus base keys). Any unknown key causes an IllegalArgumentException listing the invalid parameters sorted alphabetically. This protects against typos in Cloud KMS/HSM-backed secret specs.

Source

Thrown at sdks/java/extensions/google-cloud-platform-core/src/main/java/org/apache/beam/sdk/extensions/gcp/util/GcpHsmGeneratedSecret.java:85

      String projectId, String locationId, String keyRingId, String keyId, String jobName) {
    this.projectId = projectId;
    this.locationId = locationId;
    this.keyRingId = keyRingId;
    this.keyId = keyId;
    this.secretId = "HsmGeneratedSecret_" + jobName;
  }

  /** Initialize GcpHsmGeneratedSecret from a map specification. */
  static GcpHsmGeneratedSecret fromMap(Map<String, String> specMap) {
    Set<String> allowedKeys =
        new HashSet<>(
            Arrays.asList("project_id", "location_id", "key_ring_id", "key_id", "job_name"));
    Set<String> invalid = new HashSet<>(specMap.keySet());
    invalid.removeAll(allowedKeys);
    if (!invalid.isEmpty()) {
      List<String> sortedInvalid = new ArrayList<>(invalid);
      Collections.sort(sortedInvalid);
      throw new IllegalArgumentException(
          "Invalid secret parameter " + String.join(", ", sortedInvalid));
    }
    String locationId =
        Preconditions.checkNotNull(
            specMap.get("location_id"),
            "location_id must contain a valid value for locationId parameter");
    String keyRingId =
        Preconditions.checkNotNull(
            specMap.get("key_ring_id"),
            "key_ring_id must contain a valid value for keyRingId parameter");
    String keyId =
        Preconditions.checkNotNull(
            specMap.get("key_id"), "key_id must contain a valid value for keyId parameter");
    String jobName =
        Preconditions.checkNotNull(
            specMap.get("job_name"), "job_name must contain a valid value for jobName parameter");
    String projectId =
        GcpSecret.resolveGcpProjectId(specMap.get("project_id"), "job '" + jobName + "'");

View on GitHub (pinned to 12126d8942)

Solutions

1. Remove or rename the listed invalid keys
2. Use exactly: project_id, location_id, key_ring_id, key_id, job_name
3. If using a plain Secret Manager secret, switch to GcpSecret.fromMap whose key set differs

Example fix

// before
Map<String,String> spec = Map.of("project_id","p","location","us-central1","key_ring_id","kr","key_id","k");
// after
Map<String,String> spec = Map.of("project_id","p","location_id","us-central1","key_ring_id","kr","key_id","k");

Set<String> allowed = Set.of("project_id","location_id","key_ring_id","key_id","job_name");
if (!allowed.containsAll(specMap.keySet())) {
  Set<String> bad = new HashSet<>(specMap.keySet()); bad.removeAll(allowed);
  throw new IllegalArgumentException("Unknown HSM secret keys: " + bad);
}

try { secret = GcpHsmGeneratedSecret.fromMap(spec); }
catch (IllegalArgumentException e) { LOG.error("Bad HSM secret spec: " + e.getMessage()); throw e; }

When it happens

Trigger: Calling GcpHsmGeneratedSecret.fromMap with a spec map containing misspelled or unsupported keys (e.g. 'location' instead of 'location_id', 'projectId' instead of 'project_id').

Common situations: Copy-pasting spec examples between GcpSecret and GcpHsmGeneratedSecret (they allow different keys); typos in camelCase vs snake_case key names.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• Failed to retrieve or create secret bytes
• Invalid secret parameter %s
• Error constructing default value for gcpTempLocation: tempLo
• The key '%s' in GCS custom audit entries exceeds the %d-char
• The value '%s' in GCS custom audit entries exceeds the %d-ch

AI-assisted analysis of apache/beam@12126d8942 (2026-09-13). Data as JSON: /api/errors/3bb6a623be29cb52. Report an issue: GitHub.