{"record":{"id":"b5c162449fdab6ed","repo":"FlowiseAI/Flowise","slug":"failed-to-retrieve-secret-value","errorCode":null,"errorMessage":"Failed to retrieve secret value.","messagePattern":"Failed to retrieve secret value\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/components/src/utils.ts","lineNumber":621,"sourceCode":" * @param {string} encryptedData\n * @param {string} componentCredentialName\n * @param {IComponentCredentials} componentCredentials\n * @returns {Promise<ICommonObject>}\n */\nexport const decryptCredentialData = async (encryptedData: string): Promise<ICommonObject> => {\n    let decryptedDataStr: string\n\n    if (USE_AWS_SECRETS_MANAGER && secretsManagerClient) {\n        try {\n            if (encryptedData.startsWith('FlowiseCredential_')) {\n                const command = new GetSecretValueCommand({ SecretId: encryptedData })\n                const response = await secretsManagerClient.send(command)\n\n                if (response.SecretString) {\n                    const secretObj = JSON.parse(response.SecretString)\n                    decryptedDataStr = JSON.stringify(secretObj)\n                } else {\n                    throw new Error('Failed to retrieve secret value.')\n                }\n            } else {\n                const encryptKey = await getEncryptionKey()\n                const decryptedData = AES.decrypt(encryptedData, encryptKey)\n                decryptedDataStr = decryptedData.toString(enc.Utf8)\n            }\n        } catch (error) {\n            console.error(error)\n            throw new Error('Failed to decrypt credential data.')\n        }\n    } else {\n        // Fallback to existing code\n        const encryptKey = await getEncryptionKey()\n        const decryptedData = AES.decrypt(encryptedData, encryptKey)\n        decryptedDataStr = decryptedData.toString(enc.Utf8)\n    }\n\n    if (!decryptedDataStr) return {}","sourceCodeStart":603,"sourceCodeEnd":639,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/src/utils.ts#L603-L639","documentation":"Thrown inside the AWS Secrets Manager branch of decryptCredentialData when GetSecretValueCommand succeeds but response.SecretString is null/undefined/empty. This happens when the secret is stored as binary (SecretBinary) rather than a string, or the secret was deleted/rotated and the ARN/ID no longer points at a string-valued version.","triggerScenarios":"The FlowiseCredential_<id> secret in AWS Secrets Manager was created with binary data instead of a JSON string; the secret version was rotated to a binary stage; IAM grants read but the secret's only payload is in SecretBinary; the secret was partially deleted leaving an empty string stage.","commonSituations":"Importing credentials via infrastructure-as-code that writes binary blobs; AWS rotation lambda that switches to binary encoding; cross-account secret sharing where the KMS key decrypts but the payload is binary; migrating from local AES to Secrets Manager with a malformed payload.","solutions":["Inspect the secret in AWS console/CLI: aws secretsmanager get-secret-value --secret-id <FlowiseCredential_...> and confirm SecretString is populated.","If the secret is binary, re-store it as a JSON string matching the expected credential shape.","Verify the IAM role Flowise runs under has secretsmanager:GetSecretValue on that ARN.","Confirm the FlowiseCredential_ prefix convention is intact and the secret ID passed matches the real ARN/name."],"exampleFix":"// before\nconst response = await secretsManagerClient.send(command)\nif (response.SecretString) {\n  const secretObj = JSON.parse(response.SecretString)\n  decryptedDataStr = JSON.stringify(secretObj)\n} else {\n  throw new Error('Failed to retrieve secret value.')\n}\n\n// after — handle binary secret and surface AWS context\nconst response = await secretsManagerClient.send(command)\nif (response.SecretString) {\n  decryptedDataStr = response.SecretString\n} else if (response.SecretBinary) {\n  const b64 = typeof response.SecretBinary === 'string' ? response.SecretBinary : response.SecretBinary.toString('base64')\n  decryptedDataStr = Buffer.from(b64, 'base64').toString('utf8')\n} else {\n  throw new Error(`Failed to retrieve secret value for ${encryptedData}: secret has neither SecretString nor SecretBinary`)\n}","handlingStrategy":"validation","validationCode":"async function secretHasString(client: SecretsManagerClient, id: string): Promise<boolean> {\n  try {\n    const r = await client.send(new GetSecretValueCommand({ SecretId: id }))\n    return typeof r.SecretString === 'string' && r.SecretString.length > 0\n  } catch {\n    return false\n  }\n}","typeGuard":"function hasSecretString(r: GetSecretValueCommandOutput): r is GetSecretValueCommandOutput & { SecretString: string } {\n  return typeof r.SecretString === 'string' && r.SecretString.length > 0\n}","tryCatchPattern":"try {\n  const response = await secretsManagerClient.send(new GetSecretValueCommand({ SecretId: encryptedData }))\n  if (!hasSecretString(response)) throw new Error('Failed to retrieve secret value.')\n  decryptedDataStr = response.SecretString\n} catch (err) {\n  throw new Error(`Secret retrieval failed for ${encryptedData}: ${err instanceof Error ? err.message : String(err)}`)\n}","preventionTips":["Store FlowiseCredential secrets as JSON strings, not binary.","Verify IAM permissions include secretsmanager:GetSecretValue on the secret ARN.","Confirm the secret's region matches the client's configured region."],"tags":["aws","secrets-manager","credentials","config"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}