apache/beam · error · ValueError

Invalid secret type , currently only GcpSecret and…

Error message

Invalid secret type {secret_type}, currently only GcpSecret and GcpHsmGeneratedSecret are supported

What it means

After extracting the 'type' parameter, parse_secret_option looks it up in _SECRET_TYPE_TO_SECRET_MANAGER. If the (lowercased) type is not one of the supported managers — GcpSecret or GcpHsmGeneratedSecret — it raises ValueError listing the supported types.

Solutions

Use type=GcpSecret or type=GcpHsmGeneratedSecret (case-insensitive)
Check _SECRET_TYPE_TO_SECRET_MANAGER in apache_beam/utils/secret.py for the exact supported set for your Beam version
Upgrade Beam if a newer secret manager type was added upstream

Example fix

// before
Secret.parse_secret_option('type=aws;name=secret')
// after
Secret.parse_secret_option('type=GcpSecret;name=secret;project=my-proj')

Defensive patterns

Strategy: validation

Validate before calling

allowed = {'gcpsecret', 'gcphsmgeneratedsecret'}
t = spec.split('type:')[1].split(';')[0].lower() if 'type:' in spec else None
if t not in allowed:
    raise ValueError(f'unsupported secret type {t}')

Try / catch

try:
    secret = Secret.parse_secret_option(spec)
except ValueError as e:
    logging.error('unsupported secret type: %s', e)
    raise

Prevention

Use only GcpSecret or GcpHsmGeneratedSecret types
Check _SECRET_TYPE_TO_SECRET_MANAGER for the supported set in your Beam version
Never abbreviate types (no 'gcp', no 'aws')

When it happens

Trigger: Calling parse_secret_option with 'type=aws-secrets-manager', 'type=gcp', or any type string other than gcpsecret / gcphsmgeneratedsecret (case-insensitive).

Common situations: Assuming AWS/Azure/Vault secret managers are supported; abbreviating 'gcp' instead of 'GcpSecret'; docs from other frameworks leaking in.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

AI-assisted analysis of apache/beam@12126d8942 (2026-09-13). Data as JSON: /api/errors/9cf944c0f0184479. Report an issue: GitHub.

Appendix: source

Thrown at sdks/python/apache_beam/utils/secret.py:109

    'type:<secret_type>;<secret_param>:<value>'

    For example, 'type:GcpSecret;version_name:my_secret/versions/latest'
    would return a GcpSecret initialized with 'my_secret/versions/latest'.
    """
    param_map = {}
    for param in secret.split(';'):
      parts = param.split(':')
      if len(parts) == 2:
        param_map[parts[0]] = parts[1]

    if 'type' not in param_map:
      raise ValueError('Secret string must contain a valid type parameter')

    raw_type = param_map.pop('type')
    secret_type = raw_type.lower()
    secret_manager = _SECRET_TYPE_TO_SECRET_MANAGER.get(secret_type)
    if not secret_manager:
      raise ValueError(
          f'Invalid secret type {secret_type}, currently only '
          'GcpSecret and GcpHsmGeneratedSecret are supported')

    return cls.from_json(json.dumps(param_map), secret_manager)

  @classmethod
  def from_json(
      cls, spec: str, secret_manager: Optional[str] = None) -> 'Secret':
    """Return a Secret instance based on secret_manager provider and secret specification.

    Args:
      spec: Secret string (raw secret or JSON specification string).
      secret_manager: Secret manager string (e.g. 'GoogleCloudSecretManager').

    Returns:
      An instance of Secret.
    """
    if not isinstance(spec, str):

View on GitHub (pinned to 12126d8942)