What causes "parameter not found: %q" in dagger/dagger?

List actual names: `aws ssm describe-parameters --filters Key=Name,Option=BeginsWith,Values=/app`

parameter not found: %q

Error message

parameter not found: %q

What it means

AWS SSM returned ParameterNotFound for GetParameter, remapped by mapAWSError into a clear message. Unlike secrets manager, this code is unambiguous: no parameter with that exact name (including the leading slash) exists for this identity/region.

Source

Thrown at engine/client/secretprovider/aws.go:246

		return []byte{}, nil
	default:
		// For numbers, booleans, and nested objects, return JSON representation
		jsonValue, err := json.Marshal(v)
		if err != nil {
			return nil, fmt.Errorf("failed to marshal field value: %w", err)
		}
		return jsonValue, nil
	}
}

func mapAWSError(err error, name, resourceType string) error {
	var apiErr smithy.APIError
	if errors.As(err, &apiErr) {
		switch apiErr.ErrorCode() {
		case "ResourceNotFoundException":
			return fmt.Errorf("secret not found: %q", name)
		case "ParameterNotFound":
			return fmt.Errorf("parameter not found: %q", name)
		case "AccessDeniedException":
			return fmt.Errorf("access denied to %s %q: check IAM permissions", resourceType, name)
		case "DecryptionFailure":
			return fmt.Errorf("failed to decrypt %s %q: check KMS permissions", resourceType, name)
		case "InvalidRequestException":
			return fmt.Errorf("invalid request for %s %q: %s", resourceType, name, apiErr.ErrorMessage())
		}
	}
	return fmt.Errorf("failed to retrieve %s %q: %w", resourceType, name, err)
}

View on GitHub (pinned to 82ba2681db)

Solutions

List actual names: `aws ssm describe-parameters --filters Key=Name,Option=BeginsWith,Values=/app`
Fix the name — it must match exactly including the leading slash and case
Verify region/account configuration matches where the parameter was created
Check IaC (Terraform/CDK) actually created the parameter in this environment
Confirm the path is a parameter, not just a hierarchy prefix (GetParameter does not resolve paths; use GetParametersByPath semantics instead)

Example fix

// before
secret://aws-ssm/app/db-password
// after
secret://aws-ssm/prod/app/db-password

Defensive patterns

Strategy: retry

Validate before calling

func parameterExists(ctx context.Context, c *ssm.Client, name string) error {
  _, err := c.GetParameter(ctx, &ssm.GetParameterInput{Name: aws.String(name), WithDecryption: aws.Bool(false)})
  return err
}
// call at startup; ParameterNotFound here means fix config before proceeding

Try / catch

val, err := client.Secret(ctx, "aws-ssm", paramName, "")
if err != nil {
  if strings.Contains(err.Error(), "parameter not found") {
    if av, e2 := client.Secret(ctx, "aws-ssm", "/defaults"+paramName, ""); e2 == nil {
      return av, nil
    }
    return nil, fmt.Errorf("missing required parameter %s (checked region %s)", paramName, region)
  }
  return nil, err
}

Prevention

Include the leading '/' and exact case in parameter names
Adopt a naming convention (/env/app/key) and validate references against it
Deploy parameters to every environment your app runs in via IaC
Log the region and account ID alongside not-found errors to spot env mismatches fast
Remember GetParameter needs exact names — path prefixes are not resolved

When it happens

Trigger: GetParameter called with a name that does not exist in the current region/account, missing the leading '/', wrong case, or a hierarchical path referenced as if it were a leaf parameter.

Common situations: Parameter exists in another region or account; forgot the /app/env/ prefix convention; parameter created only in other environments (dev vs prod); deleted by IaC drift; typo in name.

Related errors

AI-assisted analysis of dagger/dagger@82ba2681db (2026-09-05). Data as JSON: /api/errors/ba908e00c7ddb74c. Report an issue: GitHub.