{"record":{"id":"b7e642bfc830a185","repo":"Dokploy/dokploy","slug":"aws-secrets-manager-secret-secretid-is-not-j","errorCode":null,"errorMessage":"AWS Secrets Manager: secret \"${secretId}\" is not JSON, cannot extract field \"${field}\"","messagePattern":"AWS Secrets Manager: secret \"(.+?)\" is not JSON, cannot extract field \"(.+?)\"","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/server/src/utils/vault/aws.ts","lineNumber":70,"sourceCode":"\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tsecretStrings.set(secretId, response.SecretString);\n\t\t\t}),\n\t\t);\n\n\t\tconst result: Record<string, string> = {};\n\t\tfor (const ref of refs) {\n\t\t\tconst { secretId, field } = parseRef(ref);\n\t\t\tconst secretString = secretStrings.get(secretId) as string;\n\t\t\tif (field === null) {\n\t\t\t\tresult[ref] = secretString;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tlet parsed: Record<string, unknown>;\n\t\t\ttry {\n\t\t\t\tparsed = JSON.parse(secretString);\n\t\t\t} catch {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`AWS Secrets Manager: secret \"${secretId}\" is not JSON, cannot extract field \"${field}\"`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst value = parsed[field];\n\t\t\tif (value === undefined || value === null) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`AWS Secrets Manager: field \"${field}\" not found in secret \"${secretId}\"`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tresult[ref] = typeof value === \"string\" ? value : JSON.stringify(value);\n\t\t}\n\t\treturn result;\n\t},\n\n\tasync testConnection(config) {\n\t\tconst client = createClient(config);\n\t\tawait client.send(new ListSecretsCommand({ MaxResults: 1 }));\n\t},","sourceCodeStart":52,"sourceCodeEnd":88,"githubUrl":"https://github.com/Dokploy/dokploy/blob/546686ea3587f12ec5652217dedd9f7960fb6d15/packages/server/src/utils/vault/aws.ts#L52-L88","documentation":"When a vault ref includes a field (mysecret:password), getSecrets must JSON.parse the secret string to extract it. If the secret isn't valid JSON (plain text, YAML, base64), parsing fails and this error is thrown.","triggerScenarios":"Setting ref 'db:password' where secret 'db' contains 's3cr3t!' (plain string, not JSON object).","commonSituations":"Storing a single password as plain text but referencing it with a :field suffix; storing YAML/env-file formatted secrets.","solutions":["Store the secret as a JSON object: {\"password\":\"s3cr3t!\"} and keep the :password field ref","Or drop the field suffix and reference the whole secret by name if it's a single value"],"exampleFix":"# before\naws secretsmanager put-secret-value --secret-id db --secret-string 's3cr3t!'\n# ref: db:password\n\n# after\naws secretsmanager put-secret-value --secret-id db --secret-string '{\"password\":\"s3cr3t!\"}'\n# ref: db:password","handlingStrategy":"validation","validationCode":"const probe = JSON.parse(await getSecretString(secretId)); // fails early with clear cause\nif (typeof probe !== 'object') throw new Error('Secret must be a JSON object to use field refs');","typeGuard":"const isJsonObjectSecret = (s: string): boolean => {\n  try { return typeof JSON.parse(s) === 'object' && JSON.parse(s) !== null; } catch { return false; }\n};","tryCatchPattern":"try {\n  await vault.getSecrets([`mysecret:field`]);\n} catch (e) {\n  if (/is not JSON/.test(String(e))) {\n    // rewrite secret as JSON object, or drop the :field suffix\n  }\n}","preventionTips":["Standardize on JSON object secrets","Avoid :field refs for single-value plain-text secrets"],"tags":["aws","secrets-manager","json","vault"],"backgroundTag":"secret-parse-failed","analyzedSha":"546686ea3587f12ec5652217dedd9f7960fb6d15","analyzedAt":"2026-08-27T05:18:58.095Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}