{"record":{"id":"975dde0d752ca845","repo":"dagger/dagger","slug":"secret-not-found-q","errorCode":null,"errorMessage":"secret not found: %q","messagePattern":"secret not found: %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"engine/client/secretprovider/aws.go","lineNumber":244,"sourceCode":"\t\treturn []byte(v), nil\n\tcase nil:\n\t\treturn []byte{}, nil\n\tdefault:\n\t\t// For numbers, booleans, and nested objects, return JSON representation\n\t\tjsonValue, err := json.Marshal(v)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to marshal field value: %w\", err)\n\t\t}\n\t\treturn jsonValue, nil\n\t}\n}\n\nfunc mapAWSError(err error, name, resourceType string) error {\n\tvar apiErr smithy.APIError\n\tif errors.As(err, &apiErr) {\n\t\tswitch apiErr.ErrorCode() {\n\t\tcase \"ResourceNotFoundException\":\n\t\t\treturn fmt.Errorf(\"secret not found: %q\", name)\n\t\tcase \"ParameterNotFound\":\n\t\t\treturn fmt.Errorf(\"parameter not found: %q\", name)\n\t\tcase \"AccessDeniedException\":\n\t\t\treturn fmt.Errorf(\"access denied to %s %q: check IAM permissions\", resourceType, name)\n\t\tcase \"DecryptionFailure\":\n\t\t\treturn fmt.Errorf(\"failed to decrypt %s %q: check KMS permissions\", resourceType, name)\n\t\tcase \"InvalidRequestException\":\n\t\t\treturn fmt.Errorf(\"invalid request for %s %q: %s\", resourceType, name, apiErr.ErrorMessage())\n\t\t}\n\t}\n\treturn fmt.Errorf(\"failed to retrieve %s %q: %w\", resourceType, name, err)\n}\n","sourceCodeStart":226,"sourceCodeEnd":257,"githubUrl":"https://github.com/dagger/dagger/blob/82ba2681dbe30d3547a1dc50ea495900ab5b6047/engine/client/secretprovider/aws.go#L226-L257","documentation":"AWS Secrets Manager returned ResourceNotFoundException for GetSecretValue, remapped by mapAWSError into a clear 'secret not found' message. The SDK's raw error was opaque, so the provider translates well-known AWS error codes into actionable messages.","triggerScenarios":"GetSecretValue called with a SecretId that does not exist in the current region/account, or one the caller cannot describe (AWS also returns ResourceNotFound for secrets the identity has no DescribeSecret grant on, and for replicas before promotion).","commonSituations":"Typo or wrong path in secret name/ARN; secret exists in another region; secret deleted (or pending deletion window); wrong AWS account/credentials; missing secretsmanager:DescribeSecret permission (masked as not-found).","solutions":["Run `aws secretsmanager get-secret-value --secret-id <name>` with the same credentials/region to reproduce","Check AWS_REGION / region config matches where the secret lives","Use the full ARN if the secret lives in another account or region","Verify the secret is not in a pending-deletion state (`aws secretsmanager describe-secret`) and restore if needed","Check IAM policy includes secretsmanager:DescribeSecret and GetSecretValue"],"exampleFix":"// before\nsecret://aws/prod/db-creds  (region: us-east-1, secret lives in eu-west-1)\n// after\nsecret://aws/arn:aws:secretsmanager:eu-west-1:123456789012:secret:prod/db-creds-AbCdEf","handlingStrategy":"retry","validationCode":"func secretExists(ctx context.Context, c *secretsmanager.Client, name string) error {\n  _, err := c.DescribeSecret(ctx, &secretsmanager.DescribeSecretInput{SecretId: aws.String(name)})\n  return err // nil means safe to GetSecretValue\n}","typeGuard":null,"tryCatchPattern":"val, err := client.Secret(ctx, \"aws\", name, \"\")\nif err != nil {\n  if strings.Contains(err.Error(), \"secret not found\") {\n    if av, e2 := client.Secret(ctx, \"aws\", fallbackName, \"\"); e2 == nil {\n      return av, nil // env-specific fallback\n    }\n  }\n  return nil, err\n}","preventionTips":["Pin the region explicitly (AWS_REGION / client config) rather than relying on ambient defaults","Use full ARNs for cross-account or cross-region secrets","Check for pending deletion before removing secrets in cleanup jobs","Grant secretsmanager:DescribeSecret so genuine not-found vs permission masking stays clear","Validate secret names in config with a startup preflight"],"tags":["aws","secrets-manager","not-found","config"],"backgroundTag":"secret-not-found","analyzedSha":"82ba2681dbe30d3547a1dc50ea495900ab5b6047","analyzedAt":"2026-09-05T07:21:37.930Z","contentChangedAt":"2026-09-05T07:21:37.930Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}