{"record":{"id":"91f8e2bca22b56ab","repo":"BerriAI/litellm","slug":"aws-kms-encrypted-value-of-key-secret-name-is-91f8e2","errorCode":null,"errorMessage":"AWS KMS - Encrypted Value of Key={secret_name} is None","messagePattern":"AWS KMS - Encrypted Value of Key=(.+?) is None","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"litellm/secret_managers/secret_manager_handler.py","lineNumber":84,"sourceCode":"        else:\n            raise ValueError(\n                \"Google KMS requires the encrypted secret to be encoded in base64\"\n            )  # fix for this vulnerability https://huntr.com/bounties/ae623c2f-b64b-4245-9ed4-f13a0a5824ce\n        response = client.decrypt(\n            request={\n                \"name\": litellm._google_kms_resource_name,\n                \"ciphertext\": ciphertext,\n            }\n        )\n        secret = response.plaintext.decode(\"utf-8\")  # assumes the original value was encoded with utf-8\n\n    elif key_manager == KeyManagementSystem.AWS_KMS.value:\n        \"\"\"\n        Only check the tokens which start with 'aws_kms/'. This prevents latency impact caused by checking all keys.\n        \"\"\"\n        encrypted_value: Final = os.getenv(secret_name, None)\n        if encrypted_value is None:\n            raise Exception(f\"AWS KMS - Encrypted Value of Key={secret_name} is None\")\n        # Decode the base64 encoded ciphertext\n        ciphertext_blob: Final = base64.b64decode(encrypted_value)\n\n        # Set up the parameters for the decrypt call\n        params: Final = {\"CiphertextBlob\": ciphertext_blob}\n        # Perform the decryption\n        response = client.decrypt(**params)\n\n        # Extract and decode the plaintext\n        plaintext: Final = response[\"Plaintext\"]\n        secret = plaintext.decode(\"utf-8\")\n        if isinstance(secret, str):\n            secret = secret.strip()\n\n    elif key_manager == KeyManagementSystem.AWS_SECRET_MANAGER.value:\n        from litellm.secret_managers.aws_secret_manager_v2 import (\n            AWSSecretsManagerV2,\n        )","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/secret_managers/secret_manager_handler.py#L66-L102","documentation":"AWS KMS decryption guard in the secret manager handler: the environment variable holding the ciphertext for secret_name resolved to None, so there is no encrypted blob to pass to the KMS decrypt call. The base64-vs-raw encoding was already validated; this is strictly a missing-value failure.","triggerScenarios":"Thrown at litellm/secret_managers/secret_manager_handler.py:84 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ensure the env var for {secret_name} contains a non-empty base64 ciphertext.","Re-encrypt with aws kms encrypt and set the CiphertextBlob value."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}