{"record":{"id":"7d7b386825bd73cb","repo":"apache/beam","slug":"unsupported-secret-manager-secret-manager-name-currently","errorCode":null,"errorMessage":"Unsupported secret manager: '{secret_manager_name}'. Currently supported options: 'GoogleCloudSecretManager', 'GoogleCloudHsmGeneratedSecretManager'.","messagePattern":"Unsupported secret manager: '(.+?)'\\. Currently supported options: 'GoogleCloudSecretManager', 'GoogleCloudHsmGeneratedSecretManager'\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"sdks/python/apache_beam/utils/secret.py","lineNumber":163,"sourceCode":"          spec_dict = None\n      except Exception:\n        pass\n\n    if secret_manager_name:\n      secret_cls_entry = _SECRET_CLASSES.get(secret_manager_name.lower())\n      if secret_cls_entry:\n        if isinstance(secret_cls_entry, str):\n          secret_cls = globals().get(secret_cls_entry, secret_cls_entry)\n        else:\n          secret_cls = secret_cls_entry\n        if isinstance(spec_dict, dict) and hasattr(secret_cls, 'from_dict'):\n          return secret_cls.from_dict(spec_dict)\n        elif isinstance(spec_dict, dict):\n          return secret_cls(**spec_dict)\n        else:\n          return secret_cls(spec)\n      else:\n        raise ValueError(\n            f\"Unsupported secret manager: '{secret_manager_name}'. Currently supported options: 'GoogleCloudSecretManager', 'GoogleCloudHsmGeneratedSecretManager'.\"\n        )\n\n    # If secret_manager is not set or empty, check if spec is a JSON specification dict\n    if spec_dict is not None:\n      msg = (\n          \"The 'spec' parameter appears to be a JSON specification, but \"\n          \"'secret_manager' is not set. Defaulting to Raw.\")\n      _LOGGER.warning(msg)\n      warnings.warn(msg, UserWarning)\n\n    return RawSecret(spec)\n\n\nclass RawSecret(Secret):\n  \"\"\"Secret implementation wrapping a raw secret string or bytes directly.\"\"\"\n  def __init__(self, secret: Union[str, bytes]):\n    super().__init__()","sourceCodeStart":145,"sourceCodeEnd":181,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/python/apache_beam/utils/secret.py#L145-L181","documentation":"Secret.from_json in apache_beam/utils/secret.py resolves a secret spec string to a registered Secret subclass. Only two secret manager names are accepted: 'GoogleCloudSecretManager' (mapped from 'gcpsecret') and 'GoogleCloudHsmGeneratedSecretManager' (mapped from 'gcphsmgeneratedsecret'). If the spec names any other manager, a ValueError is raised listing the supported options.","triggerScenarios":"Calling Secret.from_json (directly or via parse_secret_option) with a spec string whose secret_manager name is misspelled, has different casing, or is a manager type Beam does not implement, e.g. Secret.from_json('{\"secret_manager\": \"AWSParameterStore\", ...}') or 'HashiCorpVault'.","commonSituations":"Typo in the secret manager name in pipeline options (e.g. 'GoogleCloudsecretManager', 'gcp_secret'); copy-pasting a secret spec from another framework; assuming other cloud providers' secret managers are supported.","solutions":["Set secret_manager to exactly 'GoogleCloudSecretManager' for GCP Secret Manager secrets.","Use 'GoogleCloudHsmGeneratedSecretManager' for HSM-backed secrets (spec type 'gcphsmgeneratedsecret').","Check spelling and casing against the message's supported list; the lookup is by exact registered name.","If you need another provider, either pre-fetch the secret outside Beam or implement and register a custom Secret subclass."],"exampleFix":"// before\nSecret.from_json('{\"secret_manager\": \"GoogleSecretManager\", \"config\": {\"name\": \"my-secret\"}}')\n// after\nSecret.from_json('{\"secret_manager\": \"GoogleCloudSecretManager\", \"config\": {\"name\": \"my-secret\"}}')","handlingStrategy":"validation","validationCode":"SUPPORTED = {'GoogleCloudSecretManager', 'GoogleCloudHsmGeneratedSecretManager'}\nassert spec.get('secret_manager') in SUPPORTED, f\"unsupported secret_manager: {spec.get('secret_manager')!r}\"","typeGuard":"def is_supported_secret_manager(name) -> bool:\n    return isinstance(name, str) and name in {'GoogleCloudSecretManager', 'GoogleCloudHsmGeneratedSecretManager'}","tryCatchPattern":"try:\n    secret = Secret.from_json(spec)\nexcept ValueError as e:\n    logging.error('Bad secret manager spec %s: %s', spec, e)\n    raise\n","preventionTips":["Copy the manager name exactly from the supported list","Centralize secret specs in one module with constants","Validate pipeline options at startup before submitting the job"],"tags":["python","apache-beam","secret-manager","invalid-argument-value","configuration"],"backgroundTag":"invalid-enum-value","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-20T03:17:13.778Z"}