{"record":{"id":"03ff88f7d2d06376","repo":"apache/beam","slug":"failed-to-retrieve-secret-bytes-for-secret-self-version-name","errorCode":null,"errorMessage":"Failed to retrieve secret bytes for secret {self._version_name} with exception {e}","messagePattern":"Failed to retrieve secret bytes for secret (.+?) with exception (.+?)","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"sdks/python/apache_beam/utils/secret.py","lineNumber":264,"sourceCode":"\n    if not project_id:\n      raise ValueError(\n          f\"Could not resolve GCP project ID for secret '{secret_id}'. \"\n          \"Please specify 'project' in the secret spec, set GOOGLE_CLOUD_PROJECT environment variable, \"\n          \"or configure Application Default Credentials.\")\n\n    return f\"projects/{project_id}/secrets/{secret_id}/versions/{version_id}\"\n\n  def get_secret_bytes(self) -> bytes:\n    try:\n      from google.cloud import secretmanager\n      client = secretmanager.SecretManagerServiceClient()\n      response = client.access_secret_version(\n          request={\"name\": self._version_name})\n      secret = response.payload.data\n      return secret\n    except Exception as e:\n      raise RuntimeError(\n          'Failed to retrieve secret bytes for secret '\n          f'{self._version_name} with exception {e}')\n\n  def __eq__(self, secret):\n    return self._version_name == getattr(secret, '_version_name', None)\n\n\nclass GcpHsmGeneratedSecret(Secret):\n  \"\"\"A secret manager implementation that generates a secret using a GCP HSM key\n  and stores it in Google Cloud Secret Manager. If the secret already exists,\n  it will be retrieved.\n  \"\"\"\n  def __init__(\n      self,\n      project_id: str,\n      location_id: str,\n      key_ring_id: str,\n      key_id: str,","sourceCodeStart":246,"sourceCodeEnd":282,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/python/apache_beam/utils/secret.py#L246-L282","documentation":"GcpSecret.get_secret_bytes calls the Google Secret Manager API (access_secret_version). Any failure — network error, missing secret/version, permission denied, malformed version path, or missing google-cloud-secret-manager dependency — is wrapped and re-raised as a RuntimeError including the version name and the original exception.","triggerScenarios":"Calling get_secret_bytes() when the secret does not exist, the caller lacks roles/secretmanager.secretAccessor, the version path is wrong, there is no network/auth, or the google-cloud-secret-manager package is not installed.","commonSituations":"Wrong project in the version path; secret deleted or version 'latest' with no versions; running on a service account without Secret Manager access; API not enabled on the project.","solutions":["Read the wrapped exception: fix the underlying cause (NotFound → check name/project/version; PermissionDenied → grant secretAccessor).","Verify the version_name format: projects/<proj>/secrets/<name>/versions/<version>.","Enable the Secret Manager API and install google-cloud-secret-manager.","Check ADC / workload identity credentials are valid for the project.","Retry on transient network errors with backoff."],"exampleFix":"// before\nbytes = secret.get_secret_bytes()  # fails: NotFound\n// after\n# ensure spec uses correct project/version\nsecret = GcpSecret.from_dict({'name': 'db-pass', 'project': 'my-proj', 'version': '1'})\nbytes = secret.get_secret_bytes()","handlingStrategy":"try-catch","validationCode":"from google.cloud import secretmanager_v1\nclient = secretmanager_v1.SecretManagerServiceClient()\nname = f'projects/{proj}/secrets/{sid}/versions/{ver}'\nclient.get_secret_version(request={'name': name})  # raises early if missing/no permission","typeGuard":"def secret_resource_path(proj, sid, ver='latest') -> str:\n    return f'projects/{proj}/secrets/{sid}/versions/{ver}'","tryCatchPattern":"try:\n    data = secret.get_secret_bytes()\nexcept RuntimeError as e:\n    logging.error('Secret fetch failed: %s', e)\n    if 'PermissionDenied' in str(e): grant_secret_accessor()\n    elif 'NotFound' in str(e): verify_secret_version()\n    else: raise\n","preventionTips":["Enable the Secret Manager API on the project","Grant roles/secretmanager.secretAccessor to the runtime service account","Verify version_name format before calling","Retry transient network errors with exponential backoff","Install and pin google-cloud-secret-manager"],"tags":["python","apache-beam","gcp","secret-manager","api-error","network"],"backgroundTag":"api-error-response","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-20T03:17:13.778Z"}