{"record":{"id":"ae3bfbed7afe394d","repo":"bytebase/bytebase","slug":"cannot-found-secret-s","errorCode":null,"errorMessage":"cannot found secret %s","messagePattern":"cannot found secret (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"backend/component/secret/aws.go","lineNumber":38,"sourceCode":"\t// https://aws.github.io/aws-sdk-go-v2/docs/configuring-sdk/\n\tcfg, err := config.LoadDefaultConfig(ctx)\n\tif err != nil {\n\t\treturn \"\", errors.Wrapf(err, \"failed to init aws config: %v\", err.Error())\n\t}\n\n\tclient := secretsmanager.NewFromConfig(cfg)\n\n\tinput := &secretsmanager.GetSecretValueInput{\n\t\tSecretId:     aws.String(externalSecret.SecretName),\n\t\tVersionStage: aws.String(\"AWSCURRENT\"), // VersionStage defaults to AWSCURRENT if unspecified\n\t}\n\n\tsecret, err := client.GetSecretValue(ctx, input)\n\tif err != nil {\n\t\t// For a list of exceptions thrown, see\n\t\t// https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html\n\t\tif strings.Contains(err.Error(), \"ResourceNotFoundException\") {\n\t\t\treturn \"\", errors.Wrapf(err, \"cannot found secret %s\", externalSecret.SecretName)\n\t\t}\n\t\treturn \"\", errors.Wrapf(err, \"failed to get aws secret\")\n\t}\n\n\tif secret.SecretString == nil {\n\t\treturn \"\", errors.Errorf(\"empty secret string\")\n\t}\n\n\tdataMap := make(map[string]any)\n\tif err := json.Unmarshal([]byte(*secret.SecretString), &dataMap); err != nil {\n\t\treturn \"\", errors.Wrapf(err, \"failed to unmarshal aws secret string\")\n\t}\n\tval, ok := dataMap[externalSecret.PasswordKeyName].(string)\n\tif !ok {\n\t\treturn \"\", errors.Errorf(\"cannot get value for %s, please make sure the secret exists\", externalSecret.PasswordKeyName)\n\t}\n\treturn val, nil\n}","sourceCodeStart":20,"sourceCodeEnd":56,"githubUrl":"https://github.com/bytebase/bytebase/blob/1870550677fe08f0d2a78c07acd27541464eb945/backend/component/secret/aws.go#L20-L56","documentation":"AWS Secrets Manager returned ResourceNotFoundException for GetSecretValue, meaning no secret exists with the given name/ARN in that account and region. Bytebase detects the exception string and wraps it as 'cannot found secret %s' with the configured SecretName.","triggerScenarios":"client.GetSecretValue(ctx, input) in getSecretFromAWS returns an error containing 'ResourceNotFoundException' — the external secret's SecretName does not match any secret in the target region/account.","commonSituations":"Typo in the secret name in the data source external-secret config; secret created in a different AWS region than the server's default; secret deleted or in a different AWS account; using a plain name where an ARN from another account is required (or vice versa).","solutions":["Verify the SecretName in the Bytebase data source settings exactly matches the secret in AWS Secrets Manager","Confirm the AWS region resolved by the SDK matches the region where the secret lives","Check the secret was not deleted/renamed and you are in the right AWS account","Ensure the credentials' IAM policy allows secretsmanager:GetSecretValue on that secret ARN"],"exampleFix":"// before\nSecretId: aws.String(externalSecret.SecretName) // \"my-secret\" but secret is in eu-west-1\n// after\nSecretId: aws.String(\"arn:aws:secretsmanager:eu-west-1:123456789012:secret:my-secret-AbCdEf\")","handlingStrategy":"validation","validationCode":"// run before configuring the external secret:\naws secretsmanager get-secret-value --secret-id <SecretName> --region <Region>\n// or programmatically:\ndesc, err := client.DescribeSecret(ctx, &secretsmanager.DescribeSecretInput{SecretId: aws.String(name)})\n// err != nil => secret does not exist / not accessible in that region","typeGuard":null,"tryCatchPattern":"if strings.Contains(err.Error(), \"ResourceNotFoundException\") {\n\t// surface a user-facing config error naming the secret and region; do not retry\n\treturn fmt.Errorf(\"secret %q not found in region %s — verify name/region/account\", name, region)\n}","preventionTips":["Store full secret ARNs in configuration instead of bare names to pin region and account","Validate the secret exists (DescribeSecret) when saving the data source settings","Keep secret names in a consistent naming convention and document the region"],"tags":["aws","secrets-manager","not-found","configuration"],"backgroundTag":"resource-not-found","analyzedSha":"1870550677fe08f0d2a78c07acd27541464eb945","analyzedAt":"2026-09-06T21:16:13.665Z","contentChangedAt":"2026-09-06T21:16:13.665Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}