apache/beam · error · IllegalArgumentException

Unsupported secret manager: '%s'. Currently supported option

Error message

Unsupported secret manager: '%s'. Currently supported options: %s.

What it means

fromJson resolves the secret manager from the JSON's secret_manager field by looking it up in SECRET_FACTORIES. If the field is present but no factory is registered for that name, IllegalArgumentException is thrown listing supported options. Unlike parseSecretOption, this is the JSON-parsing path.

Source

Thrown at sdks/java/core/src/main/java/org/apache/beam/sdk/util/Secret.java:275

    }

    Map<String, String> specMap = null;
    if (spec != null && !spec.isEmpty()) {
      try {
        ObjectMapper mapper = new ObjectMapper();
        mapper.configure(com.fasterxml.jackson.core.JsonParser.Feature.ALLOW_SINGLE_QUOTES, true);
        specMap = mapper.readValue(spec, new TypeReference<Map<String, String>>() {});
      } catch (Exception e) {
        LOG.debug("Failed to parse secret spec as JSON map", e);
      }
    }

    if (smManager != null) {
      SecretRegistrar.SecretFactory factory = SECRET_FACTORIES.get(smManager.toLowerCase());
      if (factory != null) {
        return factory.createSecret(specMap != null ? specMap : Collections.emptyMap());
      }
      throw new IllegalArgumentException(
          String.format(
              "Unsupported secret manager: '%s'. Currently supported options: %s.",
              smManager, SUPPORTED_TYPES));
    }

    if (specMap != null) {
      LOG.warn(
          "The 'spec' parameter appears to be a JSON specification, but 'secret_manager' is not set. Defaulting to Raw.");
    }

    return new RawSecret(spec != null ? spec : "");
  }

  /**
   * Return a Secret instance with default raw secret handling.
   *
   * @param spec Secret string (raw secret or JSON specification string).
   * @return An instance of Secret.

View on GitHub (pinned to 12126d8942)

Solutions

1. Change the secret_manager field to one of the supported values shown in the error message.
2. Check spelling/casing — lookup is done on the lowercased manager name against the registry.
3. Register a custom SecretRegistrar.SecretFactory for your manager before calling fromJson, or upgrade Beam if support was added later.

Example fix

// before
Secret s = Secret.fromJson("{\"secret_manager\":\"vault\",\"path\":\"secret/foo\"}");
// after
Secret s = Secret.fromJson("{\"secret_manager\":\"GcpSecret\",\"version_name\":\"my_secret/versions/latest\"}");

String mgr = specJson.get("secret_manager").asText();
if (!java.util.Set.of("gcpsecret").contains(mgr.toLowerCase())) { throw new IllegalArgumentException("unsupported secret_manager: " + mgr); }

try { Secret s = Secret.fromJson(json); } catch (IllegalArgumentException e) { LOG.error("bad secret spec json: {}", e.getMessage()); throw e; }

When it happens

Trigger: Calling Secret.fromJson with a JSON object containing a secret_manager (smManager) value that is not a registered type, e.g. {"secret_manager": "HashiCorpVault", ...}.

Common situations: Hand-written secret specification JSON using a provider name from another platform, misspelled manager names, or Beam versions lacking support for the requested manager.

Related errors

• Invalid secret type %s, currently supported types: %s
• TODO: Add support for reading the timestamp from the encoded
• Value "{value}" is out of range for the type of the field de
• Secret option string cannot be null
• Secret string must contain a valid type parameter

AI-assisted analysis of apache/beam@12126d8942 (2026-09-13). Data as JSON: /api/errors/77065bbf3ae0f685. Report an issue: GitHub.