warpdotdev/warp · error · anyhow::Error

Bedrock access key secrets cannot be updated via `--value`;

Error message

Bedrock access key secrets cannot be updated via `--value`; re-create the secret instead

What it means

make_secret_value_from_gql_type maps a fetched secret's GraphQL type to a value constructor for the generic --value update path. Bedrock access-key secrets hold structured AWS credentials (access key id, secret access key, optional session token, region) that a single raw string cannot represent, so the generic update path refuses and directs you to re-create the secret with the dedicated flags.

Source

Thrown at app/src/ai/agent_sdk/secret.rs:595

            unreachable!("OpenAI API key secrets should not go through make_simple_secret_value")
        }
    }
}

/// Constructs the appropriate [`ManagedSecretValue`] for the given GraphQL secret type.
/// Used when updating an existing secret whose type is fetched from the server.
fn make_secret_value_from_gql_type(
    gql_type: ManagedSecretType,
    raw: &str,
) -> Result<ManagedSecretValue> {
    match gql_type {
        ManagedSecretType::RawValue | ManagedSecretType::Dotenvx => {
            Ok(ManagedSecretValue::raw_value(raw))
        }
        ManagedSecretType::AnthropicApiKey => Ok(ManagedSecretValue::anthropic_api_key(raw)),
        ManagedSecretType::AnthropicBedrockAccessKey => {
            // Bedrock access key secrets cannot be updated through the generic raw-string path.
            Err(anyhow::anyhow!(
                "Bedrock access key secrets cannot be updated via `--value`; re-create the secret instead"
            ))
        }
        ManagedSecretType::AnthropicBedrockApiKey => {
            // Bedrock secrets cannot be updated through the generic raw-string path.
            // The caller should use the dedicated Bedrock creation flow instead.
            Err(anyhow::anyhow!(
                "Bedrock API key secrets cannot be updated via `--value`; re-create the secret instead"
            ))
        }
        ManagedSecretType::OpenaiApiKey => Ok(ManagedSecretValue::openai_api_key(raw, None)),
    }
}

/// Read an OpenAI API key secret from CLI flags or interactive prompts.
///
/// The API key value is read from `--value-file`, stdin, or an interactive password prompt (in
/// that order), matching the behavior of other simple secret types.

View on GitHub (pinned to e72fd7aacb)

Solutions

Delete the secret (add --force in non-interactive contexts) and re-create it with the dedicated Bedrock access-key flags: --access-key-id, --secret-access-key, optional --session-token, and --region
For rotation, script the delete+create pair as one step since update is unsupported for this type

Example fix

# before
oz secret update aws-prod --value $KEY
# Error: Bedrock access key secrets cannot be updated via `--value`; re-create the secret instead

# after
oz secret delete aws-prod --force
oz secret create aws-prod --access-key-id $AKID --secret-access-key $SK --region us-east-1

Defensive patterns

Strategy: type-guard

Validate before calling

let secrets = list_secrets(&owner).await?;
let t = find_secret_type(&secrets, &name, &owner).context("secret not found")?;
if matches!(t, ManagedSecretType::AnthropicBedrockAccessKey | ManagedSecretType::AnthropicBedrockApiKey) {
    anyhow::bail!("'{name}' is a Bedrock secret: rotate via delete + re-create");
}

Type guard

fn updatable_via_value(t: ManagedSecretType) -> bool {
    !matches!(
        t,
        ManagedSecretType::AnthropicBedrockAccessKey | ManagedSecretType::AnthropicBedrockApiKey
    )
}

Try / catch

match update_secret(name, value).await {
    Err(e) if e.to_string().contains("re-create the secret") => {
        rotate_bedrock_by_recreate(name).await?; // delete + create with dedicated flags
    }
    rest => rest?,
}

Prevention

Check the secret's type before choosing the update path
Automate Bedrock rotation as delete+create, never --value
Tag Bedrock secrets in naming conventions so operators know

When it happens

Trigger: oz secret update <name> --value ... on a secret whose server-reported type is AnthropicBedrockAccessKey.

Common situations: Credential-rotation scripts that use the same --value flow as raw/API-key secrets; discovering only at update time that the secret was created via the Bedrock access-key flow.

Related errors

AI-assisted analysis of warpdotdev/warp@e72fd7aacb (2026-08-16). Data as JSON: /api/errors/596e4a305a5e39cb. Report an issue: GitHub.