{"record":{"id":"b5521fca1272248c","repo":"apache/beam","slug":"invalid-secret-parameter-s-gcpsecret","errorCode":null,"errorMessage":"Invalid secret parameter %s","messagePattern":"Invalid secret parameter (.+?)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"sdks/java/extensions/google-cloud-platform-core/src/main/java/org/apache/beam/sdk/extensions/gcp/util/GcpSecret.java","lineNumber":66,"sourceCode":"   *\n   * @param versionName The full version name of the secret in Google Cloud Secret Manager. For\n   *     example: projects/<id>/secrets/<secret_name>/versions/1. For more info, see\n   *     https://cloud.google.com/python/docs/reference/secretmanager/latest/google.cloud.secretmanager_v1beta1.services.secret_manager_service.SecretManagerServiceClient#google_cloud_secretmanager_v1beta1_services_secret_manager_service_SecretManagerServiceClient_access_secret_version\n   */\n  public GcpSecret(String versionName) {\n    this.versionName = versionName;\n  }\n\n  /** Initialize GcpSecret from a map specification. */\n  static GcpSecret fromMap(Map<String, String> specMap) {\n    Set<String> allowedKeys =\n        new HashSet<>(Arrays.asList(\"version_name\", \"name\", \"project\", \"version\"));\n    Set<String> invalidKeys = new HashSet<>(specMap.keySet());\n    invalidKeys.removeAll(allowedKeys);\n    if (!invalidKeys.isEmpty()) {\n      List<String> sortedInvalid = new ArrayList<>(invalidKeys);\n      Collections.sort(sortedInvalid);\n      throw new IllegalArgumentException(\n          \"Invalid secret parameter \" + String.join(\", \", sortedInvalid));\n    }\n    String versionName = parseVersionName(specMap);\n    return new GcpSecret(versionName);\n  }\n\n  /** Parses the version name from a specification dictionary. */\n  private static String parseVersionName(Map<String, String> specMap) {\n    String versionNameParam = specMap.get(\"version_name\");\n    if (!Strings.isNullOrEmpty(versionNameParam)) {\n      return Preconditions.checkNotNull(\n          versionNameParam, \"version_name must contain a valid value for versionName parameter\");\n    }\n    String secretId = specMap.get(\"name\");\n    if (Strings.isNullOrEmpty(secretId)) {\n      throw new IllegalArgumentException(\"Secret name must be specified in secret spec.\");\n    }\n    String projectId = resolveGcpProjectId(specMap.get(\"project\"), \"secret '\" + secretId + \"'\");","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/java/extensions/google-cloud-platform-core/src/main/java/org/apache/beam/sdk/extensions/gcp/util/GcpSecret.java#L48-L84","documentation":"GcpSecret.fromMap validates the secret spec map against the allowed keys (version_name, name, project, version). Unknown keys trigger IllegalArgumentException 'Invalid secret parameter <keys>'. This catches typos before any Secret Manager call is made.","triggerScenarios":"Calling GcpSecret.fromMap with keys like 'versionId', 'secret_name', 'project_id', or leftover keys intended for GcpHsmGeneratedSecret.","commonSituations":"Confusing the two secret spec schemas (GcpSecret vs GcpHsmGeneratedSecret); typo'd snake_case/camelCase keys; stale specs after a library update changed the allowed set.","solutions":["Remove or rename the reported invalid keys","Allowed keys are only: version_name, name, project, version","Prefer supplying version_name directly (projects/p/secrets/s/versions/v) to skip name/project/version resolution"],"exampleFix":"// before\nMap<String,String> spec = Map.of(\"project_id\",\"p\",\"name\",\"my-secret\");\n// after\nMap<String,String> spec = Map.of(\"project\",\"p\",\"name\",\"my-secret\");","handlingStrategy":"validation","validationCode":"Set<String> allowed = Set.of(\"version_name\",\"name\",\"project\",\"version\");\nif (!allowed.containsAll(specMap.keySet())) {\n  Set<String> bad = new HashSet<>(specMap.keySet()); bad.removeAll(allowed);\n  throw new IllegalArgumentException(\"Unknown GcpSecret keys: \" + bad);\n}","typeGuard":null,"tryCatchPattern":"try { secret = GcpSecret.fromMap(spec); }\ncatch (IllegalArgumentException e) { LOG.error(\"Invalid secret spec: \" + e.getMessage()); throw e; }","preventionTips":["Validate spec maps at configuration load time, before pipeline construction","Keep GcpSecret and GcpHsmGeneratedSecret specs in clearly separated config sections","Prefer version_name to minimize keys"],"tags":["gcp","secret-manager","validation","java"],"backgroundTag":"schema-validation-failed","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}