What causes "secret not found: %q" in dagger/dagger?

Run `aws secretsmanager get-secret-value --secret-id ` with the same credentials/region to reproduce

secret not found: %q

Error message

secret not found: %q

What it means

AWS Secrets Manager returned ResourceNotFoundException for GetSecretValue, remapped by mapAWSError into a clear 'secret not found' message. The SDK's raw error was opaque, so the provider translates well-known AWS error codes into actionable messages.

Source

Thrown at engine/client/secretprovider/aws.go:244

		return []byte(v), nil
	case nil:
		return []byte{}, nil
	default:
		// For numbers, booleans, and nested objects, return JSON representation
		jsonValue, err := json.Marshal(v)
		if err != nil {
			return nil, fmt.Errorf("failed to marshal field value: %w", err)
		}
		return jsonValue, nil
	}
}

func mapAWSError(err error, name, resourceType string) error {
	var apiErr smithy.APIError
	if errors.As(err, &apiErr) {
		switch apiErr.ErrorCode() {
		case "ResourceNotFoundException":
			return fmt.Errorf("secret not found: %q", name)
		case "ParameterNotFound":
			return fmt.Errorf("parameter not found: %q", name)
		case "AccessDeniedException":
			return fmt.Errorf("access denied to %s %q: check IAM permissions", resourceType, name)
		case "DecryptionFailure":
			return fmt.Errorf("failed to decrypt %s %q: check KMS permissions", resourceType, name)
		case "InvalidRequestException":
			return fmt.Errorf("invalid request for %s %q: %s", resourceType, name, apiErr.ErrorMessage())
		}
	}
	return fmt.Errorf("failed to retrieve %s %q: %w", resourceType, name, err)
}

View on GitHub (pinned to 82ba2681db)

Solutions

Run `aws secretsmanager get-secret-value --secret-id <name>` with the same credentials/region to reproduce
Check AWS_REGION / region config matches where the secret lives
Use the full ARN if the secret lives in another account or region
Verify the secret is not in a pending-deletion state (`aws secretsmanager describe-secret`) and restore if needed
Check IAM policy includes secretsmanager:DescribeSecret and GetSecretValue

Example fix

// before
secret://aws/prod/db-creds  (region: us-east-1, secret lives in eu-west-1)
// after
secret://aws/arn:aws:secretsmanager:eu-west-1:123456789012:secret:prod/db-creds-AbCdEf

Defensive patterns

Strategy: retry

Validate before calling

func secretExists(ctx context.Context, c *secretsmanager.Client, name string) error {
  _, err := c.DescribeSecret(ctx, &secretsmanager.DescribeSecretInput{SecretId: aws.String(name)})
  return err // nil means safe to GetSecretValue
}

Try / catch

val, err := client.Secret(ctx, "aws", name, "")
if err != nil {
  if strings.Contains(err.Error(), "secret not found") {
    if av, e2 := client.Secret(ctx, "aws", fallbackName, ""); e2 == nil {
      return av, nil // env-specific fallback
    }
  }
  return nil, err
}

Prevention

Pin the region explicitly (AWS_REGION / client config) rather than relying on ambient defaults
Use full ARNs for cross-account or cross-region secrets
Check for pending deletion before removing secrets in cleanup jobs
Grant secretsmanager:DescribeSecret so genuine not-found vs permission masking stays clear
Validate secret names in config with a startup preflight

When it happens

Trigger: GetSecretValue called with a SecretId that does not exist in the current region/account, or one the caller cannot describe (AWS also returns ResourceNotFound for secrets the identity has no DescribeSecret grant on, and for replicas before promotion).

Common situations: Typo or wrong path in secret name/ARN; secret exists in another region; secret deleted (or pending deletion window); wrong AWS account/credentials; missing secretsmanager:DescribeSecret permission (masked as not-found).

Related errors

AI-assisted analysis of dagger/dagger@82ba2681db (2026-09-05). Data as JSON: /api/errors/975dde0d752ca845. Report an issue: GitHub.