{"record":{"id":"6acf01ca624ec570","repo":"warpdotdev/warp","slug":"bedrock-api-key-secrets-cannot-be-updated-via-v","errorCode":null,"errorMessage":"Bedrock API key secrets cannot be updated via `--value`; re-create the secret instead","messagePattern":"Bedrock API key secrets cannot be updated via `--value`; re-create the secret instead","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"app/src/ai/agent_sdk/secret.rs","lineNumber":602,"sourceCode":"fn make_secret_value_from_gql_type(\n    gql_type: ManagedSecretType,\n    raw: &str,\n) -> Result<ManagedSecretValue> {\n    match gql_type {\n        ManagedSecretType::RawValue | ManagedSecretType::Dotenvx => {\n            Ok(ManagedSecretValue::raw_value(raw))\n        }\n        ManagedSecretType::AnthropicApiKey => Ok(ManagedSecretValue::anthropic_api_key(raw)),\n        ManagedSecretType::AnthropicBedrockAccessKey => {\n            // Bedrock access key secrets cannot be updated through the generic raw-string path.\n            Err(anyhow::anyhow!(\n                \"Bedrock access key secrets cannot be updated via `--value`; re-create the secret instead\"\n            ))\n        }\n        ManagedSecretType::AnthropicBedrockApiKey => {\n            // Bedrock secrets cannot be updated through the generic raw-string path.\n            // The caller should use the dedicated Bedrock creation flow instead.\n            Err(anyhow::anyhow!(\n                \"Bedrock API key secrets cannot be updated via `--value`; re-create the secret instead\"\n            ))\n        }\n        ManagedSecretType::OpenaiApiKey => Ok(ManagedSecretValue::openai_api_key(raw, None)),\n    }\n}\n\n/// Read an OpenAI API key secret from CLI flags or interactive prompts.\n///\n/// The API key value is read from `--value-file`, stdin, or an interactive password prompt (in\n/// that order), matching the behavior of other simple secret types.\n///\n/// `base_url` is optional. When `--base-url` is provided we use it verbatim (an empty value is\n/// treated as \"no base URL\"). When it is not provided and we are running interactively, we\n/// prompt for it; pressing Enter at the prompt skips the base URL. In non-interactive mode we\n/// silently default to no base URL, since the vast majority of users use the provider's default\n/// endpoint.\nfn read_openai_api_key_secret_value(","sourceCodeStart":584,"sourceCodeEnd":620,"githubUrl":"https://github.com/warpdotdev/warp/blob/e72fd7aacbbb2236d9b3be2aad7e7178fe94b4bc/app/src/ai/agent_sdk/secret.rs#L584-L620","documentation":"Same generic-update gate as the access-key case, but for secrets whose server type is AnthropicBedrockApiKey: the raw-string path cannot construct the structured Bedrock API-key value. The comment notes the caller should use the dedicated Bedrock creation flow, so update-with---value is permanently unsupported for this type.","triggerScenarios":"oz secret update <name> --value ... on a secret whose server-reported type is AnthropicBedrockApiKey.","commonSituations":"Rotating a Bedrock API key with the same command used for raw secrets; secrets originally created through the dedicated bedrock create flow.","solutions":["Delete and re-create the secret with the dedicated Bedrock flags: --bedrock-api-key and --region (both required non-interactively)","Automate rotation as delete+create rather than update for Bedrock secrets"],"exampleFix":"# before\noz secret update bedrock-key --value $KEY\n# Error: Bedrock API key secrets cannot be updated via `--value`; re-create the secret instead\n\n# after\noz secret delete bedrock-key --force\noz secret create bedrock-key --bedrock-api-key $KEY --region us-east-1","handlingStrategy":"type-guard","validationCode":"let t = find_secret_type(&secrets, &name, &owner).context(\"secret not found\")?;\nif matches!(t, ManagedSecretType::AnthropicBedrockApiKey | ManagedSecretType::AnthropicBedrockAccessKey) {\n    anyhow::bail!(\"'{name}' is a Bedrock secret: rotate via delete + re-create with --bedrock-api-key/--region\");\n}","typeGuard":"fn updatable_via_value(t: ManagedSecretType) -> bool {\n    !matches!(\n        t,\n        ManagedSecretType::AnthropicBedrockApiKey | ManagedSecretType::AnthropicBedrockAccessKey\n    )\n}","tryCatchPattern":"match update_secret(name, value).await {\n    Err(e) if e.to_string().contains(\"re-create the secret\") => {\n        delete_secret(name, Force(true)).await?;\n        create_bedrock_api_key_secret(name, key, region).await?;\n    }\n    rest => rest?,\n}","preventionTips":["Branch rotation logic on ManagedSecretType before updating","Keep Bedrock key material in a vault so re-creation is cheap","Never reuse the generic --value flow for structured secret types"],"tags":["agent-sdk","secrets","bedrock","unsupported-update"],"backgroundTag":null,"analyzedSha":"e72fd7aacbbb2236d9b3be2aad7e7178fe94b4bc","analyzedAt":"2026-08-16T08:27:25.381Z","schemaVersion":2},"datasetVersion":"2026-08-16T13:17:31.715Z"}