bytebase/bytebase · error

failed to get aws secret

Error message

failed to get aws secret

What it means

The AWS Secrets Manager GetSecretValue call failed with an exception other than ResourceNotFoundException. Bytebase wraps any such error generically as 'failed to get aws secret', so the root cause (auth, permission, network, throttling, invalid request) is in the wrapped SDK error.

Source

Thrown at backend/component/secret/aws.go:40

	if err != nil {
		return "", errors.Wrapf(err, "failed to init aws config: %v", err.Error())
	}

	client := secretsmanager.NewFromConfig(cfg)

	input := &secretsmanager.GetSecretValueInput{
		SecretId:     aws.String(externalSecret.SecretName),
		VersionStage: aws.String("AWSCURRENT"), // VersionStage defaults to AWSCURRENT if unspecified
	}

	secret, err := client.GetSecretValue(ctx, input)
	if err != nil {
		// For a list of exceptions thrown, see
		// https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html
		if strings.Contains(err.Error(), "ResourceNotFoundException") {
			return "", errors.Wrapf(err, "cannot found secret %s", externalSecret.SecretName)
		}
		return "", errors.Wrapf(err, "failed to get aws secret")
	}

	if secret.SecretString == nil {
		return "", errors.Errorf("empty secret string")
	}

	dataMap := make(map[string]any)
	if err := json.Unmarshal([]byte(*secret.SecretString), &dataMap); err != nil {
		return "", errors.Wrapf(err, "failed to unmarshal aws secret string")
	}
	val, ok := dataMap[externalSecret.PasswordKeyName].(string)
	if !ok {
		return "", errors.Errorf("cannot get value for %s, please make sure the secret exists", externalSecret.PasswordKeyName)
	}
	return val, nil
}

View on GitHub (pinned to 1870550677)

Solutions

1. Read the wrapped inner error to identify the exact AWS exception code
2. If AccessDenied, attach secretsmanager:GetSecretValue (and kms:Decrypt for CMK secrets) to the server's IAM identity
3. Refresh/rotate expired AWS credentials used by the Bytebase server
4. Retry on throttling; check VPC/network egress to secretsmanager.<region>.amazonaws.com

var opErr *smithy.OperationError
if errors.As(err, &opErr) {
	// inspect inner AWS error type
}
if retryable(err) { // throttling/5xx/timeouts
	// exponential backoff, max 3 attempts
} else if strings.Contains(err.Error(), "AccessDenied") {
	// non-retryable: fix IAM policy
}

When it happens

Trigger: client.GetSecretValue(ctx, input) in getSecretFromAWS returns an error whose message does NOT contain 'ResourceNotFoundException' — e.g. AccessDeniedException, InvalidRequestException, UnrecognizedClientException, throttling, or network failure.

Common situations: IAM role/policy lacks secretsmanager:GetSecretValue; expired or invalid credentials (UnrecognizedClientException); KMS key access denied for a secret encrypted with a customer-managed key; SDK throttling under load; server has no network egress to Secrets Manager.

Related errors

• failed to init aws config: %v
• cannot found secret %s
• empty secret string
• failed to unmarshal aws secret string
• cannot get value for %s, please make sure the secret exists

AI-assisted analysis of bytebase/bytebase@1870550677 (2026-09-06). Data as JSON: /api/errors/4f04dfa47bdf4c9e. Report an issue: GitHub.