{"record":{"id":"7a4f18559b203b9d","repo":"Dokploy/dokploy","slug":"aws-secrets-manager-secret-secretid-has-no-s","errorCode":null,"errorMessage":"AWS Secrets Manager: secret \"${secretId}\" has no string value (binary secrets are not supported)","messagePattern":"AWS Secrets Manager: secret \"(.+?)\" has no string value \\(binary secrets are not supported\\)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/server/src/utils/vault/aws.ts","lineNumber":50,"sourceCode":"\t\t\taccessKeyId: config.accessKeyId,\n\t\t\tsecretAccessKey: config.secretAccessKey,\n\t\t},\n\t\t...(config.endpoint && { endpoint: config.endpoint }),\n\t});\n\nexport const awsClient: VaultClient<AwsConfig> = {\n\tasync getSecrets(config, refs) {\n\t\tconst client = createClient(config);\n\t\tconst secretIds = [...new Set(refs.map((ref) => parseRef(ref).secretId))];\n\n\t\tconst secretStrings = new Map<string, string>();\n\t\tawait Promise.all(\n\t\t\tsecretIds.map(async (secretId) => {\n\t\t\t\tconst response = await client.send(\n\t\t\t\t\tnew GetSecretValueCommand({ SecretId: secretId }),\n\t\t\t\t);\n\t\t\t\tif (response.SecretString === undefined) {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`AWS Secrets Manager: secret \"${secretId}\" has no string value (binary secrets are not supported)`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tsecretStrings.set(secretId, response.SecretString);\n\t\t\t}),\n\t\t);\n\n\t\tconst result: Record<string, string> = {};\n\t\tfor (const ref of refs) {\n\t\t\tconst { secretId, field } = parseRef(ref);\n\t\t\tconst secretString = secretStrings.get(secretId) as string;\n\t\t\tif (field === null) {\n\t\t\t\tresult[ref] = secretString;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tlet parsed: Record<string, unknown>;\n\t\t\ttry {\n\t\t\t\tparsed = JSON.parse(secretString);","sourceCodeStart":32,"sourceCodeEnd":68,"githubUrl":"https://github.com/Dokploy/dokploy/blob/546686ea3587f12ec5652217dedd9f7960fb6d15/packages/server/src/utils/vault/aws.ts#L32-L68","documentation":"getSecrets calls GetSecretValue and requires SecretString; AWS returns SecretString undefined when the secret was stored as SecretBinary (e.g. a key/certificate uploaded as binary). Dokploy only handles string secrets and throws here.","triggerScenarios":"Creating a secret via AWS CLI/terraform with a binary payload (SecretBinary), or an RDS-managed secret edge case where the value comes back binary.","commonSituations":"Storing TLS certs/keys as binary blobs; tooling that defaults to binary for non-UTF8 data.","solutions":["Re-create the secret as a string: aws secretsmanager put-secret-value --secret-id X --secret-string '...'","Store binary values base64-encoded in a string secret","If it's a JSON of fields, store the JSON as the secret string"],"exampleFix":"# before (binary)\naws secretsmanager put-secret-value --secret-id mysecret --secret-binary fileb://key.pem\n\n# after (string)\naws secretsmanager put-secret-value --secret-id mysecret --secret-string \"$(base64 -w0 key.pem)\"","handlingStrategy":"validation","validationCode":"const resp = await client.send(new DescribeSecretCommand({ SecretId }));\n// no reliable precheck — validate on write instead: always use --secret-string","typeGuard":null,"tryCatchPattern":"try {\n  secrets = await vault.getSecrets(ids);\n} catch (e) {\n  if (/binary secrets are not supported/.test(String(e))) {\n    // rewrite the secret as a string value, then retry\n  }\n}","preventionTips":["Always create secrets with secret-string","Base64-encode binary payloads into string secrets"],"tags":["aws","secrets-manager","binary","vault"],"backgroundTag":"secret-value-unsupported-format","analyzedSha":"546686ea3587f12ec5652217dedd9f7960fb6d15","analyzedAt":"2026-08-27T05:18:58.095Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}