{"record":{"id":"8987e35602db0261","repo":"apache/beam","slug":"could-not-resolve-gcp-project-id-for-secret-secret-id-please","errorCode":null,"errorMessage":"Could not resolve GCP project ID for secret '{secret_id}'. Please specify 'project' in the secret spec, set GOOGLE_CLOUD_PROJECT environment variable, or configure Application Default Credentials.","messagePattern":"Could not resolve GCP project ID for secret '(.+?)'\\. Please specify 'project' in the secret spec, set GOOGLE_CLOUD_PROJECT environment variable, or configure Application Default Credentials\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"sdks/python/apache_beam/utils/secret.py","lineNumber":248,"sourceCode":"    if not secret_id:\n      raise ValueError(\"Secret name must be specified in secret spec.\")\n\n    # Resolve project ID from spec, environment variables, or Application Default Credentials\n    project_id = (\n        spec_dict.get(\"project\") or os.environ.get(\"GOOGLE_CLOUD_PROJECT\") or\n        os.environ.get(\"GCP_PROJECT\"))\n\n    if not project_id:\n      try:\n        import google.auth\n        _, project_id = google.auth.default()\n      except Exception:\n        pass\n\n    version_id = spec_dict.get(\"version\", \"latest\")\n\n    if not project_id:\n      raise ValueError(\n          f\"Could not resolve GCP project ID for secret '{secret_id}'. \"\n          \"Please specify 'project' in the secret spec, set GOOGLE_CLOUD_PROJECT environment variable, \"\n          \"or configure Application Default Credentials.\")\n\n    return f\"projects/{project_id}/secrets/{secret_id}/versions/{version_id}\"\n\n  def get_secret_bytes(self) -> bytes:\n    try:\n      from google.cloud import secretmanager\n      client = secretmanager.SecretManagerServiceClient()\n      response = client.access_secret_version(\n          request={\"name\": self._version_name})\n      secret = response.payload.data\n      return secret\n    except Exception as e:\n      raise RuntimeError(\n          'Failed to retrieve secret bytes for secret '\n          f'{self._version_name} with exception {e}')","sourceCodeStart":230,"sourceCodeEnd":266,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/python/apache_beam/utils/secret.py#L230-L266","documentation":"To build 'projects/<project>/secrets/<name>/versions/<version>', GcpSecret._parse_version_name must resolve a GCP project ID. It checks spec 'project', then GOOGLE_CLOUD_PROJECT and GCP_PROJECT env vars, then Application Default Credentials. If all fail, this ValueError is raised.","triggerScenarios":"GcpSecret.from_dict({'name': 'db-pass'}) with no 'project' key, no GOOGLE_CLOUD_PROJECT/GCP_PROJECT env var set, and no ADC available (e.g. running locally without gcloud auth, or in a container without a service account).","commonSituations":"Local development without `gcloud auth application-default login`; CI runners lacking project metadata; Docker/K8s images without workload identity or env vars.","solutions":["Add 'project': '<gcp-project-id>' to the secret spec dict.","Export GOOGLE_CLOUD_PROJECT=<project-id> in the environment.","Set up Application Default Credentials (gcloud auth application-default login) so the project can be inferred.","Pass 'version_name' with the fully-qualified path to skip project resolution entirely."],"exampleFix":"// before\nsecret = GcpSecret.from_dict({'name': 'db-pass'})\n// after\nsecret = GcpSecret.from_dict({'name': 'db-pass', 'project': 'my-gcp-project'})","handlingStrategy":"fallback","validationCode":"import os\nproject = spec.get('project') or os.environ.get('GOOGLE_CLOUD_PROJECT') or os.environ.get('GCP_PROJECT')\nif not project:\n    raise ValueError('No GCP project resolvable for secret; set GOOGLE_CLOUD_PROJECT')","typeGuard":"def can_resolve_project(spec) -> bool:\n    import os\n    return bool(spec.get('project') or os.environ.get('GOOGLE_CLOUD_PROJECT') or os.environ.get('GCP_PROJECT'))","tryCatchPattern":"try:\n    secret = GcpSecret.from_dict(spec)\nexcept ValueError as e:\n    raise ConfigError('Set GOOGLE_CLOUD_PROJECT or pass project in spec') from e\n","preventionTips":["Always pass 'project' explicitly in the spec","Export GOOGLE_CLOUD_PROJECT in CI and container images","Run gcloud auth application-default login locally","Set the env var in Kubernetes/Docker deployment manifests"],"tags":["python","apache-beam","gcp","secret","missing-env-var","credentials"],"backgroundTag":"missing-env-var","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-20T03:17:13.778Z"}