{"record":{"id":"9cf944c0f0184479","repo":"apache/beam","slug":"invalid-secret-type-secret-type-currently-only-gcpsecret-and","errorCode":null,"errorMessage":"Invalid secret type {secret_type}, currently only GcpSecret and GcpHsmGeneratedSecret are supported","messagePattern":"Invalid secret type (.+?), currently only GcpSecret and GcpHsmGeneratedSecret are supported","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"sdks/python/apache_beam/utils/secret.py","lineNumber":109,"sourceCode":"    'type:<secret_type>;<secret_param>:<value>'\n\n    For example, 'type:GcpSecret;version_name:my_secret/versions/latest'\n    would return a GcpSecret initialized with 'my_secret/versions/latest'.\n    \"\"\"\n    param_map = {}\n    for param in secret.split(';'):\n      parts = param.split(':')\n      if len(parts) == 2:\n        param_map[parts[0]] = parts[1]\n\n    if 'type' not in param_map:\n      raise ValueError('Secret string must contain a valid type parameter')\n\n    raw_type = param_map.pop('type')\n    secret_type = raw_type.lower()\n    secret_manager = _SECRET_TYPE_TO_SECRET_MANAGER.get(secret_type)\n    if not secret_manager:\n      raise ValueError(\n          f'Invalid secret type {secret_type}, currently only '\n          'GcpSecret and GcpHsmGeneratedSecret are supported')\n\n    return cls.from_json(json.dumps(param_map), secret_manager)\n\n  @classmethod\n  def from_json(\n      cls, spec: str, secret_manager: Optional[str] = None) -> 'Secret':\n    \"\"\"Return a Secret instance based on secret_manager provider and secret specification.\n\n    Args:\n      spec: Secret string (raw secret or JSON specification string).\n      secret_manager: Secret manager string (e.g. 'GoogleCloudSecretManager').\n\n    Returns:\n      An instance of Secret.\n    \"\"\"\n    if not isinstance(spec, str):","sourceCodeStart":91,"sourceCodeEnd":127,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/python/apache_beam/utils/secret.py#L91-L127","documentation":"After extracting the 'type' parameter, parse_secret_option looks it up in _SECRET_TYPE_TO_SECRET_MANAGER. If the (lowercased) type is not one of the supported managers — GcpSecret or GcpHsmGeneratedSecret — it raises ValueError listing the supported types.","triggerScenarios":"Calling parse_secret_option with 'type=aws-secrets-manager', 'type=gcp', or any type string other than gcpsecret / gcphsmgeneratedsecret (case-insensitive).","commonSituations":"Assuming AWS/Azure/Vault secret managers are supported; abbreviating 'gcp' instead of 'GcpSecret'; docs from other frameworks leaking in.","solutions":["Use type=GcpSecret or type=GcpHsmGeneratedSecret (case-insensitive)","Check _SECRET_TYPE_TO_SECRET_MANAGER in apache_beam/utils/secret.py for the exact supported set for your Beam version","Upgrade Beam if a newer secret manager type was added upstream"],"exampleFix":"// before\nSecret.parse_secret_option('type=aws;name=secret')\n// after\nSecret.parse_secret_option('type=GcpSecret;name=secret;project=my-proj')","handlingStrategy":"validation","validationCode":"allowed = {'gcpsecret', 'gcphsmgeneratedsecret'}\nt = spec.split('type:')[1].split(';')[0].lower() if 'type:' in spec else None\nif t not in allowed:\n    raise ValueError(f'unsupported secret type {t}')","typeGuard":null,"tryCatchPattern":"try:\n    secret = Secret.parse_secret_option(spec)\nexcept ValueError as e:\n    logging.error('unsupported secret type: %s', e)\n    raise","preventionTips":["Use only GcpSecret or GcpHsmGeneratedSecret types","Check _SECRET_TYPE_TO_SECRET_MANAGER for the supported set in your Beam version","Never abbreviate types (no 'gcp', no 'aws')"],"tags":["secrets","config","gcp","invalid-enum"],"backgroundTag":"invalid-enum-value","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-20T03:17:13.778Z"}