apache/beam · error · ValueError

Secret string must contain a valid type parameter

Error message

Secret string must contain a valid type parameter

What it means

Secret.parse_secret_option splits a secret string of the form 'type:<secret_type>;<param>:<value>' on ';' and ':'; no 'type' key appeared in the resulting map, so the parser cannot tell which Secret subclass (e.g. GcpSecret) to construct.

Solutions

1. Add the type parameter: 'type=GcpSecret;name=...;project=...'
2. Check spelling/case of the 'type' key (params are matched literally, value is lowercased)
3. Verify separators: each param must be 'key:value' separated by ';'

Example fix

// before
Secret.parse_secret_option('name=my-secret;project=my-proj')
// after
Secret.parse_secret_option('type=GcpSecret;name=my-secret;project=my-proj')

params = dict(p.split(':', 1) for p in spec.split(';') if ':' in p)
if 'type' not in params:
    raise ValueError("secret spec must include 'type=<GcpSecret|GcpHsmGeneratedSecret>'")

try:
    secret = Secret.parse_secret_option(spec)
except ValueError as e:
    logging.error('invalid secret spec: %s', e)
    raise

When it happens

Trigger: Calling parse_secret_option with a string like 'name=my-secret;project=my-proj' that omits the 'type=...' parameter.

Common situations: Copying an incomplete secret flag value; typos like 'Type=' or 'types='; building the string programmatically and skipping the type key; semicolons/colons misused so 'type' fails to parse (parts length != 2).

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• buffer_sec must be >= 0, got
• dimension must be one of 128, 256, 512, or 1408
• Either Write Statement or Table must be set.
• fuzz parameter expected to be in [0, 1] range.
• invalid manifest location

AI-assisted analysis of apache/beam@12126d8942 (2026-09-13). Data as JSON: /api/errors/758e9dfb7c2d3411. Report an issue: GitHub.

Appendix: source

Thrown at sdks/python/apache_beam/utils/secret.py:103

  @classmethod
  def parse_secret_option(cls, secret: str) -> 'Secret':
    """Parses a secret string and returns the appropriate secret type.

    The secret string should be formatted like:
    'type:<secret_type>;<secret_param>:<value>'

    For example, 'type:GcpSecret;version_name:my_secret/versions/latest'
    would return a GcpSecret initialized with 'my_secret/versions/latest'.
    """
    param_map = {}
    for param in secret.split(';'):
      parts = param.split(':')
      if len(parts) == 2:
        param_map[parts[0]] = parts[1]

    if 'type' not in param_map:
      raise ValueError('Secret string must contain a valid type parameter')

    raw_type = param_map.pop('type')
    secret_type = raw_type.lower()
    secret_manager = _SECRET_TYPE_TO_SECRET_MANAGER.get(secret_type)
    if not secret_manager:
      raise ValueError(
          f'Invalid secret type {secret_type}, currently only '
          'GcpSecret and GcpHsmGeneratedSecret are supported')

    return cls.from_json(json.dumps(param_map), secret_manager)

  @classmethod
  def from_json(
      cls, spec: str, secret_manager: Optional[str] = None) -> 'Secret':
    """Return a Secret instance based on secret_manager provider and secret specification.

    Args:
      spec: Secret string (raw secret or JSON specification string).

View on GitHub (pinned to 12126d8942)