{"record":{"id":"596e4a305a5e39cb","repo":"warpdotdev/warp","slug":"bedrock-access-key-secrets-cannot-be-updated-via","errorCode":null,"errorMessage":"Bedrock access key secrets cannot be updated via `--value`; re-create the secret instead","messagePattern":"Bedrock access key secrets cannot be updated via `--value`; re-create the secret instead","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"app/src/ai/agent_sdk/secret.rs","lineNumber":595,"sourceCode":"            unreachable!(\"OpenAI API key secrets should not go through make_simple_secret_value\")\n        }\n    }\n}\n\n/// Constructs the appropriate [`ManagedSecretValue`] for the given GraphQL secret type.\n/// Used when updating an existing secret whose type is fetched from the server.\nfn make_secret_value_from_gql_type(\n    gql_type: ManagedSecretType,\n    raw: &str,\n) -> Result<ManagedSecretValue> {\n    match gql_type {\n        ManagedSecretType::RawValue | ManagedSecretType::Dotenvx => {\n            Ok(ManagedSecretValue::raw_value(raw))\n        }\n        ManagedSecretType::AnthropicApiKey => Ok(ManagedSecretValue::anthropic_api_key(raw)),\n        ManagedSecretType::AnthropicBedrockAccessKey => {\n            // Bedrock access key secrets cannot be updated through the generic raw-string path.\n            Err(anyhow::anyhow!(\n                \"Bedrock access key secrets cannot be updated via `--value`; re-create the secret instead\"\n            ))\n        }\n        ManagedSecretType::AnthropicBedrockApiKey => {\n            // Bedrock secrets cannot be updated through the generic raw-string path.\n            // The caller should use the dedicated Bedrock creation flow instead.\n            Err(anyhow::anyhow!(\n                \"Bedrock API key secrets cannot be updated via `--value`; re-create the secret instead\"\n            ))\n        }\n        ManagedSecretType::OpenaiApiKey => Ok(ManagedSecretValue::openai_api_key(raw, None)),\n    }\n}\n\n/// Read an OpenAI API key secret from CLI flags or interactive prompts.\n///\n/// The API key value is read from `--value-file`, stdin, or an interactive password prompt (in\n/// that order), matching the behavior of other simple secret types.","sourceCodeStart":577,"sourceCodeEnd":613,"githubUrl":"https://github.com/warpdotdev/warp/blob/e72fd7aacbbb2236d9b3be2aad7e7178fe94b4bc/app/src/ai/agent_sdk/secret.rs#L577-L613","documentation":"make_secret_value_from_gql_type maps a fetched secret's GraphQL type to a value constructor for the generic --value update path. Bedrock access-key secrets hold structured AWS credentials (access key id, secret access key, optional session token, region) that a single raw string cannot represent, so the generic update path refuses and directs you to re-create the secret with the dedicated flags.","triggerScenarios":"oz secret update <name> --value ... on a secret whose server-reported type is AnthropicBedrockAccessKey.","commonSituations":"Credential-rotation scripts that use the same --value flow as raw/API-key secrets; discovering only at update time that the secret was created via the Bedrock access-key flow.","solutions":["Delete the secret (add --force in non-interactive contexts) and re-create it with the dedicated Bedrock access-key flags: --access-key-id, --secret-access-key, optional --session-token, and --region","For rotation, script the delete+create pair as one step since update is unsupported for this type"],"exampleFix":"# before\noz secret update aws-prod --value $KEY\n# Error: Bedrock access key secrets cannot be updated via `--value`; re-create the secret instead\n\n# after\noz secret delete aws-prod --force\noz secret create aws-prod --access-key-id $AKID --secret-access-key $SK --region us-east-1","handlingStrategy":"type-guard","validationCode":"let secrets = list_secrets(&owner).await?;\nlet t = find_secret_type(&secrets, &name, &owner).context(\"secret not found\")?;\nif matches!(t, ManagedSecretType::AnthropicBedrockAccessKey | ManagedSecretType::AnthropicBedrockApiKey) {\n    anyhow::bail!(\"'{name}' is a Bedrock secret: rotate via delete + re-create\");\n}","typeGuard":"fn updatable_via_value(t: ManagedSecretType) -> bool {\n    !matches!(\n        t,\n        ManagedSecretType::AnthropicBedrockAccessKey | ManagedSecretType::AnthropicBedrockApiKey\n    )\n}","tryCatchPattern":"match update_secret(name, value).await {\n    Err(e) if e.to_string().contains(\"re-create the secret\") => {\n        rotate_bedrock_by_recreate(name).await?; // delete + create with dedicated flags\n    }\n    rest => rest?,\n}","preventionTips":["Check the secret's type before choosing the update path","Automate Bedrock rotation as delete+create, never --value","Tag Bedrock secrets in naming conventions so operators know"],"tags":["agent-sdk","secrets","bedrock","unsupported-update"],"backgroundTag":null,"analyzedSha":"e72fd7aacbbb2236d9b3be2aad7e7178fe94b4bc","analyzedAt":"2026-08-16T08:27:25.381Z","schemaVersion":2},"datasetVersion":"2026-08-16T13:17:31.715Z"}