{"record":{"id":"3bb6a623be29cb52","repo":"apache/beam","slug":"invalid-secret-parameter-s","errorCode":null,"errorMessage":"Invalid secret parameter %s","messagePattern":"Invalid secret parameter (.+?)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"sdks/java/extensions/google-cloud-platform-core/src/main/java/org/apache/beam/sdk/extensions/gcp/util/GcpHsmGeneratedSecret.java","lineNumber":85,"sourceCode":"      String projectId, String locationId, String keyRingId, String keyId, String jobName) {\n    this.projectId = projectId;\n    this.locationId = locationId;\n    this.keyRingId = keyRingId;\n    this.keyId = keyId;\n    this.secretId = \"HsmGeneratedSecret_\" + jobName;\n  }\n\n  /** Initialize GcpHsmGeneratedSecret from a map specification. */\n  static GcpHsmGeneratedSecret fromMap(Map<String, String> specMap) {\n    Set<String> allowedKeys =\n        new HashSet<>(\n            Arrays.asList(\"project_id\", \"location_id\", \"key_ring_id\", \"key_id\", \"job_name\"));\n    Set<String> invalid = new HashSet<>(specMap.keySet());\n    invalid.removeAll(allowedKeys);\n    if (!invalid.isEmpty()) {\n      List<String> sortedInvalid = new ArrayList<>(invalid);\n      Collections.sort(sortedInvalid);\n      throw new IllegalArgumentException(\n          \"Invalid secret parameter \" + String.join(\", \", sortedInvalid));\n    }\n    String locationId =\n        Preconditions.checkNotNull(\n            specMap.get(\"location_id\"),\n            \"location_id must contain a valid value for locationId parameter\");\n    String keyRingId =\n        Preconditions.checkNotNull(\n            specMap.get(\"key_ring_id\"),\n            \"key_ring_id must contain a valid value for keyRingId parameter\");\n    String keyId =\n        Preconditions.checkNotNull(\n            specMap.get(\"key_id\"), \"key_id must contain a valid value for keyId parameter\");\n    String jobName =\n        Preconditions.checkNotNull(\n            specMap.get(\"job_name\"), \"job_name must contain a valid value for jobName parameter\");\n    String projectId =\n        GcpSecret.resolveGcpProjectId(specMap.get(\"project_id\"), \"job '\" + jobName + \"'\");","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/java/extensions/google-cloud-platform-core/src/main/java/org/apache/beam/sdk/extensions/gcp/util/GcpHsmGeneratedSecret.java#L67-L103","documentation":"GcpHsmGeneratedSecret.fromMap validates that the secret spec map only contains the allowed keys (project_id, location_id, key_ring_id, key_id, job_name, plus base keys). Any unknown key causes an IllegalArgumentException listing the invalid parameters sorted alphabetically. This protects against typos in Cloud KMS/HSM-backed secret specs.","triggerScenarios":"Calling GcpHsmGeneratedSecret.fromMap with a spec map containing misspelled or unsupported keys (e.g. 'location' instead of 'location_id', 'projectId' instead of 'project_id').","commonSituations":"Copy-pasting spec examples between GcpSecret and GcpHsmGeneratedSecret (they allow different keys); typos in camelCase vs snake_case key names.","solutions":["Remove or rename the listed invalid keys","Use exactly: project_id, location_id, key_ring_id, key_id, job_name","If using a plain Secret Manager secret, switch to GcpSecret.fromMap whose key set differs"],"exampleFix":"// before\nMap<String,String> spec = Map.of(\"project_id\",\"p\",\"location\",\"us-central1\",\"key_ring_id\",\"kr\",\"key_id\",\"k\");\n// after\nMap<String,String> spec = Map.of(\"project_id\",\"p\",\"location_id\",\"us-central1\",\"key_ring_id\",\"kr\",\"key_id\",\"k\");","handlingStrategy":"validation","validationCode":"Set<String> allowed = Set.of(\"project_id\",\"location_id\",\"key_ring_id\",\"key_id\",\"job_name\");\nif (!allowed.containsAll(specMap.keySet())) {\n  Set<String> bad = new HashSet<>(specMap.keySet()); bad.removeAll(allowed);\n  throw new IllegalArgumentException(\"Unknown HSM secret keys: \" + bad);\n}","typeGuard":null,"tryCatchPattern":"try { secret = GcpHsmGeneratedSecret.fromMap(spec); }\ncatch (IllegalArgumentException e) { LOG.error(\"Bad HSM secret spec: \" + e.getMessage()); throw e; }","preventionTips":["Keep a single shared constant list of allowed spec keys","Copy examples only from the GcpHsmGeneratedSecret javadoc, not GcpSecret","Use snake_case exactly as documented"],"tags":["gcp","kms","secret-manager","validation","java"],"backgroundTag":"schema-validation-failed","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}