{"record":{"id":"9cc1b01ebb763c42","repo":"apache/beam","slug":"could-not-resolve-gcp-project-id-s-please-specify-project-in","errorCode":null,"errorMessage":"Could not resolve GCP project ID%s. Please specify 'project' in the secret spec, set GOOGLE_CLOUD_PROJECT environment variable, or configure Application Default Credentials.","messagePattern":"Could not resolve GCP project ID(.+?)\\. Please specify 'project' in the secret spec, set GOOGLE_CLOUD_PROJECT environment variable, or configure Application Default Credentials\\.","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"sdks/java/extensions/google-cloud-platform-core/src/main/java/org/apache/beam/sdk/extensions/gcp/util/GcpSecret.java","lineNumber":119,"sourceCode":"    if (!Strings.isNullOrEmpty(envProject)) {\n      return Preconditions.checkNotNull(envProject);\n    }\n    envProject = System.getenv(\"GCP_PROJECT\");\n    if (!Strings.isNullOrEmpty(envProject)) {\n      return Preconditions.checkNotNull(envProject);\n    }\n    try {\n      Class<?> clazz = Class.forName(\"com.google.cloud.ServiceOptions\");\n      java.lang.reflect.Method method = clazz.getMethod(\"getDefaultProjectId\");\n      @SuppressWarnings(\"nullness\")\n      Object result = method.invoke(null);\n      if (result != null && !Strings.isNullOrEmpty(result.toString())) {\n        return result.toString();\n      }\n    } catch (Throwable e) {\n      LOG.debug(\"Could not resolve GCP project via ServiceOptions reflection\", e);\n    }\n    throw new IllegalArgumentException(\n        String.format(\n            \"Could not resolve GCP project ID%s. \"\n                + \"Please specify 'project' in the secret spec, set GOOGLE_CLOUD_PROJECT environment variable, \"\n                + \"or configure Application Default Credentials.\",\n            context != null ? \" for \" + context : \"\"));\n  }\n\n  /**\n   * Returns the secret as a byte array. Assumes that the current active service account has\n   * permissions to read the secret.\n   *\n   * @return The secret as a byte array.\n   */\n  @Override\n  public byte[] getSecretBytes() {\n    try (SecretManagerServiceClient client = SecretManagerServiceClient.create()) {\n      SecretVersionName secretVersionName = SecretVersionName.parse(versionName);\n      AccessSecretVersionResponse response = client.accessSecretVersion(secretVersionName);","sourceCodeStart":101,"sourceCodeEnd":137,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/java/extensions/google-cloud-platform-core/src/main/java/org/apache/beam/sdk/extensions/gcp/util/GcpSecret.java#L101-L137","documentation":"GcpSecret.resolveGcpProjectId resolves the GCP project when the spec lacks 'project': it tries the GOOGLE_CLOUD_PROJECT env var, Application Default Credentials, and ServiceOptions via reflection. If all fail it throws IllegalArgumentException instructing the user how to specify the project. The context suffix names which secret was being resolved.","triggerScenarios":"Calling GcpSecret.fromMap without 'project' in the spec on a machine with no GOOGLE_CLOUD_PROJECT env var, no gcloud ADC setup, and no ServiceOptions default project available.","commonSituations":"Running locally before gcloud auth application-default login; running in a non-GCP environment (CI, laptop) without explicit project config; containers lacking metadata-server access.","solutions":["Add \"project\": \"<project-id>\" to the secret spec","Set the GOOGLE_CLOUD_PROJECT environment variable","Run gcloud auth application-default login to establish ADC with a quota project","When running on GCP (GCE/GKE/Cloud Run), attach a service account so the metadata server supplies the project"],"exampleFix":"// before\nGcpSecret.fromMap(Map.of(\"name\",\"my-secret\"));\n// after\nGcpSecret.fromMap(Map.of(\"name\",\"my-secret\",\"project\",\"my-project\"));","handlingStrategy":"validation","validationCode":"String project = spec.get(\"project\") != null ? spec.get(\"project\") : System.getenv(\"GOOGLE_CLOUD_PROJECT\");\nif (project == null) throw new IllegalArgumentException(\"Set 'project' in spec or GOOGLE_CLOUD_PROJECT before resolving secrets\");","typeGuard":null,"tryCatchPattern":"try { GcpSecret.fromMap(spec); }\ncatch (IllegalArgumentException e) {\n  if (e.getMessage().contains(\"Could not resolve GCP project\")) {\n    LOG.error(\"Set GOOGLE_CLOUD_PROJECT or add 'project' to the spec\");\n  }\n  throw e;\n}","preventionTips":["Always set 'project' explicitly in secret specs for non-GCP environments","Set GOOGLE_CLOUD_PROJECT in CI and container images","Run gcloud auth application-default login locally before running pipelines"],"tags":["gcp","project-id","credentials","java"],"backgroundTag":"missing-config-value","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}