{"record":{"id":"23d7cc23f5e45b43","repo":"FlowiseAI/Flowise","slug":"failed-to-decrypt-credential-data","errorCode":null,"errorMessage":"Failed to decrypt credential data.","messagePattern":"Failed to decrypt credential data\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/components/src/utils.ts","lineNumber":630,"sourceCode":"        try {\n            if (encryptedData.startsWith('FlowiseCredential_')) {\n                const command = new GetSecretValueCommand({ SecretId: encryptedData })\n                const response = await secretsManagerClient.send(command)\n\n                if (response.SecretString) {\n                    const secretObj = JSON.parse(response.SecretString)\n                    decryptedDataStr = JSON.stringify(secretObj)\n                } else {\n                    throw new Error('Failed to retrieve secret value.')\n                }\n            } else {\n                const encryptKey = await getEncryptionKey()\n                const decryptedData = AES.decrypt(encryptedData, encryptKey)\n                decryptedDataStr = decryptedData.toString(enc.Utf8)\n            }\n        } catch (error) {\n            console.error(error)\n            throw new Error('Failed to decrypt credential data.')\n        }\n    } else {\n        // Fallback to existing code\n        const encryptKey = await getEncryptionKey()\n        const decryptedData = AES.decrypt(encryptedData, encryptKey)\n        decryptedDataStr = decryptedData.toString(enc.Utf8)\n    }\n\n    if (!decryptedDataStr) return {}\n    try {\n        return JSON.parse(decryptedDataStr)\n    } catch (e) {\n        console.error(e)\n        throw new Error('Credentials could not be decrypted.')\n    }\n}\n\n/**","sourceCodeStart":612,"sourceCodeEnd":648,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/src/utils.ts#L612-L648","documentation":"Catch-all thrown by the AWS Secrets Manager branch of decryptCredentialData. It wraps any exception raised during GetSecretValueCommand.send(), JSON.parse of the secret, or AES.decrypt of a non-FlowiseCredential_ payload. The original error is console.error'd but not re-thrown verbatim, so the real cause is hidden behind this generic message.","triggerScenarios":"AWS SDK throws (throttling, network, AccessDeniedException, KMS key disabled); JSON.parse fails because the stored SecretString is not valid JSON; AES.decrypt throws because the encryption key mismatched the payload (e.g. FLOWISE_ENCRYPTION_KEY changed); secretsManagerClient.send rejects due to an expired AWS session token.","commonSituations":"Rotating FLOWISE_ENCRYPTION_KEY after credentials were encrypted with the old key; AWS temporary credentials expiring mid-session; KMS key used to encrypt the secret was scheduled for deletion; Secrets Manager service throttling under load; region misconfiguration where the client targets a different region than the secret.","solutions":["Read the console.error output in the logs to find the underlying cause (AccessDenied, DecryptionFailure, Throttling, etc.).","If AES path: confirm FLOWISE_ENCRYPTION_KEY / encryption key file matches the key used when credentials were originally encrypted.","If AWS path: verify IAM permissions (secretsmanager:GetSecretValue + kms:Decrypt) and that the secret's region matches the client config.","Re-encrypt credentials via the Flowise credential UI after rotating keys so they align with the current encryption key.","If the secret payload isn't JSON, re-store it as a valid JSON object."],"exampleFix":"// before — original error swallowed\n} catch (error) {\n  console.error(error)\n  throw new Error('Failed to decrypt credential data.')\n}\n\n// after — preserve the original error as cause\n} catch (error) {\n  console.error(error)\n  throw new Error(`Failed to decrypt credential data: ${error instanceof Error ? error.message : String(error)}`, { cause: error })\n}","handlingStrategy":"try-catch","validationCode":"// Verify AWS client config and key presence before decrypting\nfunction assertSecretsManagerReady(client: SecretsManagerClient | undefined) {\n  if (!client) throw new Error('Secrets Manager client is not initialised')\n}","typeGuard":"function isAwsSdkError(e: unknown): e is { name: string; message: string; Code?: string } {\n  return typeof e === 'object' && e !== null && 'name' in e\n}","tryCatchPattern":"try {\n  // ... decryption logic\n} catch (error) {\n  console.error('decryptCredentialData failure:', error)\n  throw new Error(`Failed to decrypt credential data: ${error instanceof Error ? error.message : String(error)}`, { cause: error })\n}","preventionTips":["Keep FLOWISE_ENCRYPTION_KEY stable; rotate via a re-encryption migration, not a swap.","Preserve the original error (cause) so operators can distinguish KMS, IAM, and key-mismatch failures.","Alert on AccessDenied/DecryptionFailure from the AWS SDK."],"tags":["aws","secrets-manager","credentials","encryption","error-wrapping"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}