{"record":{"id":"758e9dfb7c2d3411","repo":"apache/beam","slug":"secret-string-must-contain-a-valid-type-parameter-758e9d","errorCode":null,"errorMessage":"Secret string must contain a valid type parameter","messagePattern":"Secret string must contain a valid type parameter","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"sdks/python/apache_beam/utils/secret.py","lineNumber":103,"sourceCode":"\n  @classmethod\n  def parse_secret_option(cls, secret: str) -> 'Secret':\n    \"\"\"Parses a secret string and returns the appropriate secret type.\n\n    The secret string should be formatted like:\n    'type:<secret_type>;<secret_param>:<value>'\n\n    For example, 'type:GcpSecret;version_name:my_secret/versions/latest'\n    would return a GcpSecret initialized with 'my_secret/versions/latest'.\n    \"\"\"\n    param_map = {}\n    for param in secret.split(';'):\n      parts = param.split(':')\n      if len(parts) == 2:\n        param_map[parts[0]] = parts[1]\n\n    if 'type' not in param_map:\n      raise ValueError('Secret string must contain a valid type parameter')\n\n    raw_type = param_map.pop('type')\n    secret_type = raw_type.lower()\n    secret_manager = _SECRET_TYPE_TO_SECRET_MANAGER.get(secret_type)\n    if not secret_manager:\n      raise ValueError(\n          f'Invalid secret type {secret_type}, currently only '\n          'GcpSecret and GcpHsmGeneratedSecret are supported')\n\n    return cls.from_json(json.dumps(param_map), secret_manager)\n\n  @classmethod\n  def from_json(\n      cls, spec: str, secret_manager: Optional[str] = None) -> 'Secret':\n    \"\"\"Return a Secret instance based on secret_manager provider and secret specification.\n\n    Args:\n      spec: Secret string (raw secret or JSON specification string).","sourceCodeStart":85,"sourceCodeEnd":121,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/python/apache_beam/utils/secret.py#L85-L121","documentation":"Secret.parse_secret_option splits a secret string of the form 'type:<secret_type>;<param>:<value>' on ';' and ':'; no 'type' key appeared in the resulting map, so the parser cannot tell which Secret subclass (e.g. GcpSecret) to construct.","triggerScenarios":"Calling parse_secret_option with a string like 'name=my-secret;project=my-proj' that omits the 'type=...' parameter.","commonSituations":"Copying an incomplete secret flag value; typos like 'Type=' or 'types='; building the string programmatically and skipping the type key; semicolons/colons misused so 'type' fails to parse (parts length != 2).","solutions":["Add the type parameter: 'type=GcpSecret;name=...;project=...'","Check spelling/case of the 'type' key (params are matched literally, value is lowercased)","Verify separators: each param must be 'key:value' separated by ';'"],"exampleFix":"// before\nSecret.parse_secret_option('name=my-secret;project=my-proj')\n// after\nSecret.parse_secret_option('type=GcpSecret;name=my-secret;project=my-proj')","handlingStrategy":"validation","validationCode":"params = dict(p.split(':', 1) for p in spec.split(';') if ':' in p)\nif 'type' not in params:\n    raise ValueError(\"secret spec must include 'type=<GcpSecret|GcpHsmGeneratedSecret>'\")","typeGuard":null,"tryCatchPattern":"try:\n    secret = Secret.parse_secret_option(spec)\nexcept ValueError as e:\n    logging.error('invalid secret spec: %s', e)\n    raise","preventionTips":["Always include type= in secret flag values","Use consistent 'key:value;key:value' formatting","Copy spec templates from Beam docs, not ad hoc"],"tags":["secrets","config","validation"],"backgroundTag":"missing-required-config-field","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-20T03:17:13.778Z"}