{"record":{"id":"e1f9262ae5f53eb2","repo":"Dokploy/dokploy","slug":"aws-secrets-manager-field-field-not-found-in","errorCode":null,"errorMessage":"AWS Secrets Manager: field \"${field}\" not found in secret \"${secretId}\"","messagePattern":"AWS Secrets Manager: field \"(.+?)\" not found in secret \"(.+?)\"","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/server/src/utils/vault/aws.ts","lineNumber":76,"sourceCode":"\t\tconst result: Record<string, string> = {};\n\t\tfor (const ref of refs) {\n\t\t\tconst { secretId, field } = parseRef(ref);\n\t\t\tconst secretString = secretStrings.get(secretId) as string;\n\t\t\tif (field === null) {\n\t\t\t\tresult[ref] = secretString;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tlet parsed: Record<string, unknown>;\n\t\t\ttry {\n\t\t\t\tparsed = JSON.parse(secretString);\n\t\t\t} catch {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`AWS Secrets Manager: secret \"${secretId}\" is not JSON, cannot extract field \"${field}\"`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst value = parsed[field];\n\t\t\tif (value === undefined || value === null) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`AWS Secrets Manager: field \"${field}\" not found in secret \"${secretId}\"`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tresult[ref] = typeof value === \"string\" ? value : JSON.stringify(value);\n\t\t}\n\t\treturn result;\n\t},\n\n\tasync testConnection(config) {\n\t\tconst client = createClient(config);\n\t\tawait client.send(new ListSecretsCommand({ MaxResults: 1 }));\n\t},\n\n\tasync listSecretNames(config) {\n\t\tconst client = createClient(config);\n\t\tconst names: string[] = [];\n\t\tlet nextToken: string | undefined;\n\t\tdo {","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/Dokploy/dokploy/blob/546686ea3587f12ec5652217dedd9f7960fb6d15/packages/server/src/utils/vault/aws.ts#L58-L94","documentation":"The secret parsed as JSON but the requested key is missing or null. getSecrets extracts parsed[field] and throws when it's undefined/null, distinguishing 'wrong field name' from 'not JSON' (the preceding error).","triggerScenarios":"Ref 'db:password' when the secret JSON is {\"pass\":\"...\"} — typo or renamed key; key present but explicitly null.","commonSituations":"Field renamed in the secret without updating refs; case mismatch (Password vs password); copying a field name from a different secret.","solutions":["Check the secret's JSON keys: aws secretsmanager get-secret-value --secret-id X --query SecretString and fix the ref to match exactly (case-sensitive)","Update the secret to include the missing key if it should exist","Remove :field from the ref if you want the whole JSON"],"exampleFix":"# before\nsecret: {\"pass\":\"s3cr3t!\"}\nref:  db:password\n\n# after\nsecret: {\"password\":\"s3cr3t!\"}\nref:  db:password","handlingStrategy":"validation","validationCode":"const parsed = JSON.parse(await getSecretString(secretId));\nif (!(field in parsed)) throw new Error(`Field ${field} not in secret — fix ref`);","typeGuard":"const hasField = (obj: unknown, field: string): obj is Record<string, unknown> & Record<field, unknown> =>\n  typeof obj === 'object' && obj !== null && field in obj;","tryCatchPattern":"try {\n  await vault.getSecrets([`db:${field}`]);\n} catch (e) {\n  if (/not found in secret/.test(String(e))) {\n    // compare field spelling/case against the secret's actual keys\n  }\n}","preventionTips":["Use exact, case-sensitive field names matching the JSON keys","Codify secret schemas so refs and values stay in sync"],"tags":["aws","secrets-manager","json-field","vault"],"backgroundTag":"secret-field-not-found","analyzedSha":"546686ea3587f12ec5652217dedd9f7960fb6d15","analyzedAt":"2026-08-27T05:18:58.095Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}