{"record":{"id":"cc1a38223e23b48b","repo":"semaphoreui/semaphore","slug":"failed-to-delete-some-secrets-v","errorCode":null,"errorMessage":"failed to delete some secrets: %v","messagePattern":"failed to delete some secrets: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"services/server/environment_svc.go","lineNumber":75,"sourceCode":"\t\tif err != nil {\n\t\t\treturn\n\t\t}\n\n\t\tif !storage.ReadOnly {\n\t\t\tfor _, secret := range secrets {\n\t\t\t\tif secret.Synchronized {\n\t\t\t\t\tcontinue\n\t\t\t\t}\n\t\t\t\terr = s.encryptionService.DeleteSecret(&secret)\n\t\t\t\tif err != nil {\n\t\t\t\t\terrors = append(errors, err)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\tif len(errors) > 0 {\n\t\terr = fmt.Errorf(\"failed to delete some secrets: %v\", errors)\n\t\treturn\n\t}\n\n\treturn\n}\n","sourceCodeStart":57,"sourceCodeEnd":81,"githubUrl":"https://github.com/semaphoreui/semaphore/blob/1774ccb71a0a8b82eb74ea24c23ac9ab713de2fa/services/server/environment_svc.go#L57-L81","documentation":"During environment deletion, the service also deletes secrets associated with the environment from external secret stores. Individual per-secret deletion failures are collected rather than aborting; if any failed, Delete returns this aggregated error listing them, so the caller knows the environment may be gone but some secrets remain orphaned in the storage backend.","triggerScenarios":"Calling Delete on an environment whose secret cleanup against external storage (AWS SM / Azure KV) partially fails — network errors, missing permissions, already-deleted secrets, throttling.","commonSituations":"Secret store IAM credentials lacking delete permission; network connectivity issues to AWS/Azure; secrets removed out-of-band causing not-found errors; rate limits during bulk deletion.","solutions":["Read the %v details in the error to see which secrets failed and why (permissions vs network).","Grant the secret-storage credentials delete permissions on the affected store, then retry deletion.","Manually remove leftover secrets in AWS SM / Azure KV if the environment deletion must not be re-run.","Check connectivity/quotas of the secret storage backend and re-delete the environment."],"exampleFix":"// before: service account lacks sm:DeleteSecret\n{\"secret-1\": \"AccessDenied: ...\"}\n// after: attach a policy allowing secretsmanager:DeleteSecret, then retry\nenvSvc.Delete(projectID, environmentID)","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := envSvc.Delete(projectID, environmentID); err != nil && strings.Contains(err.Error(), \"failed to delete some secrets\") { // parse aggregated per-secret failures\n    // fix permissions/network for the listed secrets and clean up leftovers\n}","preventionTips":["Grant the secret-storage service account delete permissions (e.g. secretsmanager:DeleteSecret).","Monitor secret-store connectivity and quotas before bulk environment deletions.","Reconcile leftover secrets in AWS SM/Azure KV after failed deletions."],"tags":["go","secrets","cleanup","aggregated-errors","aws","azure"],"backgroundTag":"partial-deletion-failure","analyzedSha":"1774ccb71a0a8b82eb74ea24c23ac9ab713de2fa","analyzedAt":"2026-09-07T11:00:33.293Z","contentChangedAt":"2026-09-07T11:00:33.293Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}