bytebase/bytebase · error

cannot found secret %s

Error message

cannot found secret %s

What it means

AWS Secrets Manager returned ResourceNotFoundException for GetSecretValue, meaning no secret exists with the given name/ARN in that account and region. Bytebase detects the exception string and wraps it as 'cannot found secret %s' with the configured SecretName.

Source

Thrown at backend/component/secret/aws.go:38

	// https://aws.github.io/aws-sdk-go-v2/docs/configuring-sdk/
	cfg, err := config.LoadDefaultConfig(ctx)
	if err != nil {
		return "", errors.Wrapf(err, "failed to init aws config: %v", err.Error())
	}

	client := secretsmanager.NewFromConfig(cfg)

	input := &secretsmanager.GetSecretValueInput{
		SecretId:     aws.String(externalSecret.SecretName),
		VersionStage: aws.String("AWSCURRENT"), // VersionStage defaults to AWSCURRENT if unspecified
	}

	secret, err := client.GetSecretValue(ctx, input)
	if err != nil {
		// For a list of exceptions thrown, see
		// https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html
		if strings.Contains(err.Error(), "ResourceNotFoundException") {
			return "", errors.Wrapf(err, "cannot found secret %s", externalSecret.SecretName)
		}
		return "", errors.Wrapf(err, "failed to get aws secret")
	}

	if secret.SecretString == nil {
		return "", errors.Errorf("empty secret string")
	}

	dataMap := make(map[string]any)
	if err := json.Unmarshal([]byte(*secret.SecretString), &dataMap); err != nil {
		return "", errors.Wrapf(err, "failed to unmarshal aws secret string")
	}
	val, ok := dataMap[externalSecret.PasswordKeyName].(string)
	if !ok {
		return "", errors.Errorf("cannot get value for %s, please make sure the secret exists", externalSecret.PasswordKeyName)
	}
	return val, nil
}

View on GitHub (pinned to 1870550677)

Solutions

1. Verify the SecretName in the Bytebase data source settings exactly matches the secret in AWS Secrets Manager
2. Confirm the AWS region resolved by the SDK matches the region where the secret lives
3. Check the secret was not deleted/renamed and you are in the right AWS account
4. Ensure the credentials' IAM policy allows secretsmanager:GetSecretValue on that secret ARN

Example fix

// before
SecretId: aws.String(externalSecret.SecretName) // "my-secret" but secret is in eu-west-1
// after
SecretId: aws.String("arn:aws:secretsmanager:eu-west-1:123456789012:secret:my-secret-AbCdEf")

// run before configuring the external secret:
aws secretsmanager get-secret-value --secret-id <SecretName> --region <Region>
// or programmatically:
desc, err := client.DescribeSecret(ctx, &secretsmanager.DescribeSecretInput{SecretId: aws.String(name)})
// err != nil => secret does not exist / not accessible in that region

if strings.Contains(err.Error(), "ResourceNotFoundException") {
	// surface a user-facing config error naming the secret and region; do not retry
	return fmt.Errorf("secret %q not found in region %s — verify name/region/account", name, region)
}

When it happens

Trigger: client.GetSecretValue(ctx, input) in getSecretFromAWS returns an error containing 'ResourceNotFoundException' — the external secret's SecretName does not match any secret in the target region/account.

Common situations: Typo in the secret name in the data source external-secret config; secret created in a different AWS region than the server's default; secret deleted or in a different AWS account; using a plain name where an ARN from another account is required (or vice versa).

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• failed to init aws config: %v
• cannot get value for %s, please make sure the secret exists
• NotFound
• failed to get aws secret
• empty secret string

AI-assisted analysis of bytebase/bytebase@1870550677 (2026-09-06). Data as JSON: /api/errors/ae3bfbed7afe394d. Report an issue: GitHub.