{"record":{"id":"b959185d441a13f1","repo":"Dokploy/dokploy","slug":"invalid-aws-secrets-manager-reference-ref-us","errorCode":null,"errorMessage":"Invalid AWS Secrets Manager reference \"${ref}\": use the secret name, not the ARN","messagePattern":"Invalid AWS Secrets Manager reference \"(.+?)\": use the secret name, not the ARN","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"warning","filePath":"packages/server/src/utils/vault/aws.ts","lineNumber":14,"sourceCode":"import {\n\tGetSecretValueCommand,\n\tListSecretsCommand,\n\tSecretsManagerClient,\n} from \"@aws-sdk/client-secrets-manager\";\nimport type { awsVaultConfigSchema } from \"@dokploy/server/db/schema\";\nimport type { z } from \"zod\";\nimport type { VaultClient } from \"./types\";\n\ntype AwsConfig = z.infer<typeof awsVaultConfigSchema>;\n\nconst parseRef = (ref: string) => {\n\tif (ref.startsWith(\"arn:\")) {\n\t\tthrow new Error(\n\t\t\t`Invalid AWS Secrets Manager reference \"${ref}\": use the secret name, not the ARN`,\n\t\t);\n\t}\n\tconst separatorIndex = ref.lastIndexOf(\":\");\n\tif (separatorIndex === -1) {\n\t\treturn { secretId: ref, field: null };\n\t}\n\treturn {\n\t\tsecretId: ref.slice(0, separatorIndex),\n\t\tfield: ref.slice(separatorIndex + 1),\n\t};\n};\n\nconst createClient = (config: AwsConfig) =>\n\tnew SecretsManagerClient({\n\t\tregion: config.region,\n\t\tcredentials: {\n\t\t\taccessKeyId: config.accessKeyId,","sourceCodeStart":1,"sourceCodeEnd":32,"githubUrl":"https://github.com/Dokploy/dokploy/blob/546686ea3587f12ec5652217dedd9f7960fb6d15/packages/server/src/utils/vault/aws.ts#L1-L32","documentation":"Dokploy's AWS vault expects secret references as 'secret-name' or 'secret-name:json-field', not full ARNs. parseRef rejects any ref starting with 'arn:' because the SDK call is made with the name and IAM policies are matched on it.","triggerScenarios":"Entering arn:aws:secretsmanager:us-east-1:123456789012:secret:mysecret-AbCdEf as the vault path in a project's secret mapping.","commonSituations":"Copy-pasting from the AWS console, which shows ARNs by default; migrating from a tool that accepts ARNs.","solutions":["Use just the secret name: mysecret, or name plus field: mysecret:password","If the name contains a colon (rare), remember only the last colon splits the field","For cross-account secrets, ensure the name is resolvable by the server's IAM role"],"exampleFix":"# before\narn:aws:secretsmanager:us-east-1:123456789012:secret:mysecret-AbCdEf\n\n# after\nmysecret","handlingStrategy":"validation","validationCode":"const isArn = (ref: string) => ref.startsWith('arn:');\nif (isArn(ref)) ref = ref.split(':').slice(-1)[0].replace(/-[A-Za-z0-9]{5}$/, ''); // or just reject","typeGuard":"const isSecretName = (ref: string): boolean =>\n  /^[a-zA-Z0-9/_+=.@-]+$/.test(ref) && !ref.startsWith('arn:');","tryCatchPattern":null,"preventionTips":["Enter the secret name only, not the console ARN","Document the name[:field] ref convention in team runbooks"],"tags":["aws","secrets-manager","arn","vault"],"backgroundTag":"invalid-secret-reference","analyzedSha":"546686ea3587f12ec5652217dedd9f7960fb6d15","analyzedAt":"2026-08-27T05:18:58.095Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}