risingwavelabs/risingwave · error · EnforceSecretError

is enforced to be a SECRET on RisingWave Cloud, please use…

Error message

{key} is enforced to be a SECRET on RisingWave Cloud, please use `CREATE SECRET` first

What it means

When connecting to RisingWave Cloud, certain connector option keys (passwords, access keys, tokens) are mandatory secrets. If a user passes such a key as a plain-text option instead of referencing a secret created via CREATE SECRET, validation fails with EnforceSecretError naming the offending key.

Solutions

1. Create a secret: CREATE SECRET my_secret WITH (backend='meta');
2. Reference it in the connector options: password = SECRET my_secret
3. Remove the plain-text value for the enforced key from the statement

Example fix

// before
CREATE SOURCE s WITH (connector='kafka', password='plaintext', ...);
// after
CREATE SECRET kafka_password WITH (backend='meta');
CREATE SOURCE s WITH (connector='kafka', password=SECRET kafka_password, ...);

const ENFORCED_KEYS = ['password','aws.access_key_id','aws.secret_access_key','ssh_key','private_key'];
function validateOptions(opts) {
  for (const k of Object.keys(opts)) {
    if (ENFORCED_KEYS.includes(k) && typeof opts[k] === 'string') {
      throw new Error(`${k} must reference a secret: use CREATE SECRET then ${k}=SECRET name`);
    }
  }
}

try {
  await rw.query(createSinkSql);
} catch (e) {
  if (/is enforced to be a SECRET/.test(e.message)) {
    const key = e.message.split(' ')[0];
    // create secret and rewrite statement with SECRET reference
  } else throw e;
}

When it happens

Trigger: CREATE SINK/SOURCE with a connector option like 'password', 'aws.access_key_id', or a private key passed inline as a literal while running on RisingWave Cloud, where that key is in ENFORCE_SECRET_PROPERTIES.

Common situations: Deploying to RisingWave Cloud after testing locally with inline credentials; copying a local CREATE SOURCE statement to Cloud; following outdated documentation/examples that pass secrets inline.

Related errors

• adlsgen2.authority_host must not contain userinfo
• adlsgen2.authority_host must use the https scheme, got
• `enable_config_load` can't be enabled in this environment
• Failed to get secret in secret manager, secret_id
• fill secrets for iceberg

AI-assisted analysis of risingwavelabs/risingwave@6469eb736d (2026-09-11). Data as JSON: /api/errors/aae02e6d5ba7f3fe. Report an issue: GitHub.

Appendix: source

Thrown at src/connector/src/enforce_secret.rs:20

//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

use phf::{Set, phf_set};

use crate::error::ConnectorResult as Result;

#[derive(Debug, thiserror::Error)]
#[error("{key} is enforced to be a SECRET on RisingWave Cloud, please use `CREATE SECRET` first")]
pub struct EnforceSecretError {
    pub key: String,
}

pub trait EnforceSecret {
    const ENFORCE_SECRET_PROPERTIES: Set<&'static str> = phf_set! {};

    fn enforce_secret<'a>(prop_iter: impl Iterator<Item = &'a str>) -> Result<()> {
        for prop in prop_iter {
            if Self::ENFORCE_SECRET_PROPERTIES.contains(prop) {
                return Err(EnforceSecretError {
                    key: prop.to_owned(),
                }
                .into());
            }
        }
        Ok(())
    }

View on GitHub (pinned to 6469eb736d)