{"record":{"id":"4f04dfa47bdf4c9e","repo":"bytebase/bytebase","slug":"failed-to-get-aws-secret","errorCode":null,"errorMessage":"failed to get aws secret","messagePattern":"failed to get aws secret","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"backend/component/secret/aws.go","lineNumber":40,"sourceCode":"\tif err != nil {\n\t\treturn \"\", errors.Wrapf(err, \"failed to init aws config: %v\", err.Error())\n\t}\n\n\tclient := secretsmanager.NewFromConfig(cfg)\n\n\tinput := &secretsmanager.GetSecretValueInput{\n\t\tSecretId:     aws.String(externalSecret.SecretName),\n\t\tVersionStage: aws.String(\"AWSCURRENT\"), // VersionStage defaults to AWSCURRENT if unspecified\n\t}\n\n\tsecret, err := client.GetSecretValue(ctx, input)\n\tif err != nil {\n\t\t// For a list of exceptions thrown, see\n\t\t// https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html\n\t\tif strings.Contains(err.Error(), \"ResourceNotFoundException\") {\n\t\t\treturn \"\", errors.Wrapf(err, \"cannot found secret %s\", externalSecret.SecretName)\n\t\t}\n\t\treturn \"\", errors.Wrapf(err, \"failed to get aws secret\")\n\t}\n\n\tif secret.SecretString == nil {\n\t\treturn \"\", errors.Errorf(\"empty secret string\")\n\t}\n\n\tdataMap := make(map[string]any)\n\tif err := json.Unmarshal([]byte(*secret.SecretString), &dataMap); err != nil {\n\t\treturn \"\", errors.Wrapf(err, \"failed to unmarshal aws secret string\")\n\t}\n\tval, ok := dataMap[externalSecret.PasswordKeyName].(string)\n\tif !ok {\n\t\treturn \"\", errors.Errorf(\"cannot get value for %s, please make sure the secret exists\", externalSecret.PasswordKeyName)\n\t}\n\treturn val, nil\n}\n","sourceCodeStart":22,"sourceCodeEnd":57,"githubUrl":"https://github.com/bytebase/bytebase/blob/1870550677fe08f0d2a78c07acd27541464eb945/backend/component/secret/aws.go#L22-L57","documentation":"The AWS Secrets Manager GetSecretValue call failed with an exception other than ResourceNotFoundException. Bytebase wraps any such error generically as 'failed to get aws secret', so the root cause (auth, permission, network, throttling, invalid request) is in the wrapped SDK error.","triggerScenarios":"client.GetSecretValue(ctx, input) in getSecretFromAWS returns an error whose message does NOT contain 'ResourceNotFoundException' — e.g. AccessDeniedException, InvalidRequestException, UnrecognizedClientException, throttling, or network failure.","commonSituations":"IAM role/policy lacks secretsmanager:GetSecretValue; expired or invalid credentials (UnrecognizedClientException); KMS key access denied for a secret encrypted with a customer-managed key; SDK throttling under load; server has no network egress to Secrets Manager.","solutions":["Read the wrapped inner error to identify the exact AWS exception code","If AccessDenied, attach secretsmanager:GetSecretValue (and kms:Decrypt for CMK secrets) to the server's IAM identity","Refresh/rotate expired AWS credentials used by the Bytebase server","Retry on throttling; check VPC/network egress to secretsmanager.<region>.amazonaws.com"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"var opErr *smithy.OperationError\nif errors.As(err, &opErr) {\n\t// inspect inner AWS error type\n}\nif retryable(err) { // throttling/5xx/timeouts\n\t// exponential backoff, max 3 attempts\n} else if strings.Contains(err.Error(), \"AccessDenied\") {\n\t// non-retryable: fix IAM policy\n}","preventionTips":["Grant the server identity secretsmanager:GetSecretValue and kms:Decrypt on the target secrets","Enable SDK retry defaults and request-level timeouts","Monitor IAM/CloudTrail AccessDenied events for the Bytebase principal","Ensure network egress to secretsmanager.<region>.amazonaws.com"],"tags":["aws","secrets-manager","iam","api-error"],"backgroundTag":"api-error-response","analyzedSha":"1870550677fe08f0d2a78c07acd27541464eb945","analyzedAt":"2026-09-06T21:16:13.665Z","contentChangedAt":"2026-09-06T21:16:13.665Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}