{"record":{"id":"39c8ceadc5d4d255","repo":"dutchcoders/transfer.sh","slug":"secret-key-not-set","errorCode":null,"errorMessage":"secret-key not set.","messagePattern":"secret-key not set\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/cmd.go","lineNumber":490,"sourceCode":"\t\t\tipFilterOptions.AllowedIPs = strings.Split(ipWhitelist, \",\")\n\t\t\tipFilterOptions.BlockByDefault = true\n\t\t}\n\n\t\tif ipBlacklist := c.String(\"ip-blacklist\"); ipBlacklist != \"\" {\n\t\t\tapplyIPFilter = true\n\t\t\tipFilterOptions.BlockedIPs = strings.Split(ipBlacklist, \",\")\n\t\t}\n\n\t\tif applyIPFilter {\n\t\t\toptions = append(options, server.FilterOptions(ipFilterOptions))\n\t\t}\n\n\t\tswitch provider := c.String(\"provider\"); provider {\n\t\tcase \"s3\":\n\t\t\tif accessKey := c.String(\"aws-access-key\"); accessKey == \"\" {\n\t\t\t\treturn errors.New(\"access-key not set.\")\n\t\t\t} else if secretKey := c.String(\"aws-secret-key\"); secretKey == \"\" {\n\t\t\t\treturn errors.New(\"secret-key not set.\")\n\t\t\t} else if bucket := c.String(\"bucket\"); bucket == \"\" {\n\t\t\t\treturn errors.New(\"bucket not set.\")\n\t\t\t} else if store, err := storage.NewS3Storage(c.Context, accessKey, secretKey, bucket, purgeDays, c.String(\"s3-region\"), c.String(\"s3-endpoint\"), c.Bool(\"s3-no-multipart\"), c.Bool(\"s3-path-style\"), logger); err != nil {\n\t\t\t\treturn err\n\t\t\t} else {\n\t\t\t\toptions = append(options, server.UseStorage(store))\n\t\t\t}\n\t\tcase \"gdrive\":\n\t\t\tchunkSize := c.Int(\"gdrive-chunk-size\") * 1024 * 1024\n\n\t\t\tif clientJSONFilepath := c.String(\"gdrive-client-json-filepath\"); clientJSONFilepath == \"\" {\n\t\t\t\treturn errors.New(\"gdrive-client-json-filepath not set.\")\n\t\t\t} else if localConfigPath := c.String(\"gdrive-local-config-path\"); localConfigPath == \"\" {\n\t\t\t\treturn errors.New(\"gdrive-local-config-path not set.\")\n\t\t\t} else if basedir := c.String(\"basedir\"); basedir == \"\" {\n\t\t\t\treturn errors.New(\"basedir not set.\")\n\t\t\t} else if store, err := storage.NewGDriveStorage(c.Context, clientJSONFilepath, localConfigPath, basedir, chunkSize, logger); err != nil {\n\t\t\t\treturn err","sourceCodeStart":472,"sourceCodeEnd":508,"githubUrl":"https://github.com/dutchcoders/transfer.sh/blob/c37bfd95797fd6da8a6da53fc13d191994b3f687/cmd/cmd.go#L472-L508","documentation":"Thrown by the transfer.sh CLI when --provider s3 is chosen and --aws-access-key is present but --aws-secret-key is empty. The secret key pairs with the access key to sign S3 requests, so the startup code rejects a credential set with only half the key pair. Validation runs before any S3 connection is attempted.","triggerScenarios":"Running with --provider s3 --aws-access-key X but without --aws-secret-key — e.g. the secret was stored in a secret manager and never injected into the flag, or a config template dropped it.","commonSituations":"Secrets kept out of repo configs (correctly) but the injection step into the CLI arguments is missing; Kubernetes/Docker secret mounted as a file but not passed to the flag; access key updated while the secret line was accidentally deleted.","solutions":["Add --aws-secret-key <secret> to the command line","If the secret lives in a file or env var, interpolate it, e.g. --aws-secret-key \"$(cat /run/secrets/aws_secret)\"","Ensure --bucket is also set, as it is validated next","Double-check shell quoting of the secret (leading/trailing special characters can break naive interpolation)"],"exampleFix":"// before\ntransfer.sh --provider s3 --aws-access-key AKIAXXXXXXXX --bucket uploads\n// after\ntransfer.sh --provider s3 --aws-access-key AKIAXXXXXXXX --aws-secret-key \"$AWS_SECRET_ACCESS_KEY\" --bucket uploads","handlingStrategy":"validation","validationCode":"# ensure the secret is non-empty before interpolation\n: \"${AWS_SECRET_ACCESS_KEY:?aws secret key required}\"\nargs+=(--aws-secret-key \"$AWS_SECRET_ACCESS_KEY\")","typeGuard":null,"tryCatchPattern":"if err := cmd.Root.Execute(); err != nil {\n  if strings.Contains(err.Error(), \"secret-key not set\") {\n    log.Fatalf(\"S3 provider selected but --aws-secret-key is missing\")\n  }\n  os.Exit(1)\n}","preventionTips":["Store the secret in a secret manager and interpolate it into the flag, never an empty placeholder","Check that shell quoting preserves special characters in the secret","Validate the full s3 flag set (access key, secret key, bucket) in deploy scripts"],"tags":["cli","configuration","s3","aws","credentials","startup-validation"],"backgroundTag":"missing-required-flag","analyzedSha":"c37bfd95797fd6da8a6da53fc13d191994b3f687","analyzedAt":"2026-09-05T10:21:07.548Z","contentChangedAt":"2026-09-05T10:21:07.548Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}