apache/beam · error · IllegalArgumentException

Invalid secret type %s, currently supported types: %s

Error message

Invalid secret type %s, currently supported types: %s

What it means

parseSecretOption looks up the lowercased type string in the SECRET_FACTORIES registry. If no factory is registered for that type, the type is not a supported secret manager and IllegalArgumentException is thrown listing the currently supported types. This is thrown from parseSecretOption (the string-form API); the JSON form throws its own variant at line 276.

Source

Thrown at sdks/java/core/src/main/java/org/apache/beam/sdk/util/Secret.java:228

      String[] parts = param.split(":", 2);
      if (parts.length == 2) {
        paramMap.put(parts[0], parts[1]);
      }
    }

    if (!paramMap.containsKey("type")) {
      throw new IllegalArgumentException("Secret string must contain a valid type parameter");
    }

    String rawType = paramMap.remove("type");
    if (rawType == null || rawType.isEmpty()) {
      throw new IllegalArgumentException("Secret string must contain a valid type parameter");
    }

    String secretType = rawType.toLowerCase();
    SecretRegistrar.SecretFactory factory = SECRET_FACTORIES.get(secretType);
    if (factory == null) {
      throw new IllegalArgumentException(
          String.format(
              "Invalid secret type %s, currently supported types: %s", rawType, SUPPORTED_TYPES));
    }

    try {
      return factory.createSecret(paramMap);
    } catch (Exception e) {
      if (e instanceof IllegalArgumentException) {
        throw (IllegalArgumentException) e;
      }
      if (e instanceof NullPointerException) {
        throw (NullPointerException) e;
      }
      throw new RuntimeException("Failed to parse secret option", e);
    }
  }

  /**

View on GitHub (pinned to 12126d8942)

Solutions

1. Use one of the supported types listed in the exception message (check SUPPORTED_TYPES), e.g. 'type:GcpSecret'.
2. Fix casing/spelling — lookup is on the lowercased type, so a type not registered at all will fail regardless of case.
3. If you need a custom provider, register its factory via SecretRegistrar before parsing, or upgrade Beam to a version that supports the desired secret manager.

Example fix

// before
Secret s = Secret.parseSecretOption("type:AwsSecretManager;name:my_secret");
// after
Secret s = Secret.parseSecretOption("type:GcpSecret;version_name:my_secret/versions/latest");

// check before parsing
if (!java.util.Set.of("gcpsecret").contains(secretType.toLowerCase())) { throw new IllegalArgumentException("unsupported secret type: " + secretType); }

try { Secret s = Secret.parseSecretOption(opt); } catch (IllegalArgumentException e) { LOG.error("unsupported secret type in {}: {}", opt, e.getMessage()); throw e; }

When it happens

Trigger: Calling Secret.parseSecretOption with a type value not in the registry, e.g. 'type:AwsSecret' or 'type:vault' when only GcpSecret is registered.

Common situations: Misspelled secret manager names ('gcpsecret' vs registered casing after lowercase), using a secret provider from a different library, or running against a Beam version that does not register the type you specified.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• Secret option string cannot be null
• Secret string must contain a valid type parameter
• Failed to parse secret option
• Unsupported secret manager: '%s'. Currently supported option
• Unrecognized value for stable unique names:

AI-assisted analysis of apache/beam@12126d8942 (2026-09-13). Data as JSON: /api/errors/ad6abcb64ff5d26c. Report an issue: GitHub.