{"record":{"id":"867f8da585e3250a","repo":"apache/beam","slug":"the-spec-parameter-appears-to-be-a-json-specification-but","errorCode":null,"errorMessage":"The 'spec' parameter appears to be a JSON specification, but 'secret_manager' is not set. Defaulting to Raw.","messagePattern":"The 'spec' parameter appears to be a JSON specification, but 'secret_manager' is not set\\. Defaulting to Raw\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"sdks/python/apache_beam/utils/secret.py","lineNumber":173,"sourceCode":"          secret_cls = secret_cls_entry\n        if isinstance(spec_dict, dict) and hasattr(secret_cls, 'from_dict'):\n          return secret_cls.from_dict(spec_dict)\n        elif isinstance(spec_dict, dict):\n          return secret_cls(**spec_dict)\n        else:\n          return secret_cls(spec)\n      else:\n        raise ValueError(\n            f\"Unsupported secret manager: '{secret_manager_name}'. Currently supported options: 'GoogleCloudSecretManager', 'GoogleCloudHsmGeneratedSecretManager'.\"\n        )\n\n    # If secret_manager is not set or empty, check if spec is a JSON specification dict\n    if spec_dict is not None:\n      msg = (\n          \"The 'spec' parameter appears to be a JSON specification, but \"\n          \"'secret_manager' is not set. Defaulting to Raw.\")\n      _LOGGER.warning(msg)\n      warnings.warn(msg, UserWarning)\n\n    return RawSecret(spec)\n\n\nclass RawSecret(Secret):\n  \"\"\"Secret implementation wrapping a raw secret string or bytes directly.\"\"\"\n  def __init__(self, secret: Union[str, bytes]):\n    super().__init__()\n    if isinstance(secret, str):\n      self._secret = secret.encode(\"utf-8\")\n    else:\n      self._secret = secret\n\n  def get_secret_bytes(self) -> bytes:\n    return self._secret\n\n  def __eq__(self, other: Any) -> bool:\n    if not isinstance(other, RawSecret):","sourceCodeStart":155,"sourceCodeEnd":191,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/python/apache_beam/utils/secret.py#L155-L191","documentation":"Secret.from_json (via parse_secret_option) parses secret options. If a 'spec' parameter looks like a JSON specification dict but no 'secret_manager' was set, the code cannot build a managed secret and falls back to RawSecret, logging and warning that it 'Defaulting to Raw'.","triggerScenarios":"Passing a JSON-shaped 'spec' secret option (e.g. --secret=spec='{...}') without also setting secret_manager, e.g. a malformed/mistyped option string where the manager key was omitted or misspelled.","commonSituations":"Users intending to use GCP Secret Manager / AWS / HashiVault secrets but forgetting the secret_manager option, or hand-writing the secret option string instead of the documented format, so the raw secret string gets embedded in the pipeline instead of a manager-backed reference.","solutions":["Set the secret_manager option (e.g. gcpmanager/awsmanager/vaultmanager) alongside spec so the correct managed Secret is constructed.","Use the documented secret option format: --secret=<manager>:<project>:<secret_name>:<version>.","Verify the option string is not accidentally interpreted as a JSON spec (quote/escape correctly on the CLI).","If raw is actually intended, suppress the warning or pass the secret directly without the JSON-spec shape."],"exampleFix":"// before\n--secret='{\"secret_id\": \"my-secret\"}'\n// after\n--secret=gcpmanager:my-project:my-secret:latest","handlingStrategy":"validation","validationCode":"spec = pipeline_options.get_all_options().get('secret')\nif spec and spec.lstrip().startswith('{') and 'secret_manager' not in spec:\n    raise ValueError('secret spec looks like JSON but secret_manager is missing')","typeGuard":null,"tryCatchPattern":"import warnings\nwith warnings.catch_warnings(record=True) as w:\n    warnings.simplefilter('always')\n    secret = Secret.from_json(spec)\n    if any('Defaulting to Raw' in str(x.message) for x in w):\n        raise ValueError('secret fell back to Raw; set secret_manager')","preventionTips":["Use the documented --secret=<manager>:<project>:<name>:<version> format","Never hand-build secret JSON specs","Fail fast in pipelines if secrets resolve to Raw unexpectedly (security review)"],"tags":["secrets","configuration","security","fallback"],"backgroundTag":"missing-required-config-field","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-20T03:17:13.778Z"}