Skip to content

ssm get-parameter can't get secret #10518

Closed
Closed
ssm get-parameter can't get secret#10518
Assignees
RyanFitzSimmonsAK
Labels
bugThis issue is a bug.p2This is a standard priority issueservice-apiThis issue is due to a problem in a service API, not the SDK implementation.ssm

Description

@lkurzyniec
lkurzyniec
opened on Jul 31, 2026

Describe the bug

I can't get secret through ssm with a specific name, both on Win and Linux. It looks like some internals are adding null suffix.

Image Image

Regression Issue

  • Select this option if this issue appears to be a regression.

Expected Behavior

Be able to get secret with a name shared-secret-alpha through ssm

Current Behavior

I'm getting error:

aws: [ERROR]: An error occurred (ParameterNotFound) when calling the GetParameter operation: An error occurred (ParameterNotFound) when referencing Secrets Manager: Secret aws/reference/secretsmanager/shared-secret-alphanull not found.

with added null at the end of secret name

Reproduction Steps

aws ssm get-parameter --name "/aws/reference/secretsmanager/alpha" --with-decryption

Possible Solution

No response

Additional Information/Context

No response

CLI version used

aws-cli/2.36.7 Python/3.14.6 Windows/11 exe/AMD64

Environment details (OS name and version, etc.)

aws-cli/2.36.13 Python/3.14.6 Linux/6.18.33.2-microsoft-standard-WSL2 script-exe/x86_64.ubuntu.24

Activity

  1. lkurzyniec
    added
    bugThis issue is a bug.
    needs-triageThis issue or PR still needs to be triaged.
    on Jul 31, 2026
  2. RyanFitzSimmonsAK
    self-assigned this
    on Aug 4, 2026
  3. RyanFitzSimmonsAK
    added
    investigatingThis issue is being investigated and/or work is in progress to resolve the issue.
    ssm
    p2This is a standard priority issue
    and removed
    needs-triageThis issue or PR still needs to be triaged.
    on Aug 4, 2026

  4. RyanFitzSimmonsAK commented on Aug 4, 2026

    @RyanFitzSimmonsAK
    RyanFitzSimmonsAK
    on Aug 4, 2026
    Contributor

    Hi @lkurzyniec, thanks for reaching out. I wasn't able to reproduce this behavior. In my testing, I was able to successfully retrieve a SecretsManager secret with GetParameter. Could you provide debug logs of the issue? You can get debug logs by adding --debug to your command, and redacting any sensitive information. Thanks!

  5. RyanFitzSimmonsAK
    added
    response-requestedWaiting on additional info and feedback. Will move to "closing-soon" in 7 days.
    and removed
    investigatingThis issue is being investigated and/or work is in progress to resolve the issue.
    on Aug 4, 2026

  6. lkurzyniec commented on Aug 6, 2026

    @lkurzyniec
    lkurzyniec
    on Aug 6, 2026
    Author

    @RyanFitzSimmonsAK

    ╰─ ./aws ssm get-parameter --name "/aws/reference/secretsmanager/alpha" --with-decryption --debug                                                                                                      ─╯
2026-08-06 13:00:26,399 - MainThread - awscli.clidriver - DEBUG - CLI version: aws-cli/2.36.17 Python/3.14.6 Linux/6.18.33.2-microsoft-standard-WSL2 script-exe/x86_64.ubuntu.24
2026-08-06 13:00:26,400 - MainThread - awscli.clidriver - DEBUG - Arguments entered to CLI: ['ssm', 'get-parameter', '--name', '/aws/reference/secretsmanager/alpha', '--with-decryption', '--debug']
2026-08-06 13:00:26,405 - MainThread - awscli.lazy_emitter - DEBUG - Lazy-initializing plugin awscli.customizations.waiters.register_add_waiters for event building-command-table.main
2026-08-06 13:00:26,406 - MainThread - awscli.lazy_emitter - DEBUG - Lazy-initializing plugin awscli.alias.register_alias_commands for event building-command-table.main
2026-08-06 13:00:26,406 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <function add_waiters at 0x7885031bd900>
2026-08-06 13:00:26,406 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <bound method AliasSubCommandInjector.on_building_command_table of <awscli.alias.AliasSubCommandInjector object at 0x788503220830>>
2026-08-06 13:00:26,406 - MainThread - botocore.loaders - DEBUG - Loading JSON file: /home/x/.local/share/aws-cli/v2/2.36.17/dist/awscli/data/cli.json
2026-08-06 13:00:26,408 - MainThread - awscli.lazy_emitter - DEBUG - Lazy-initializing plugin awscli.customizations.globalargs.register_parse_global_args for event top-level-args-parsed
2026-08-06 13:00:26,408 - MainThread - awscli.lazy_emitter - DEBUG - Lazy-initializing plugin awscli.customizations.cloudfront.register for event top-level-args-parsed
2026-08-06 13:00:26,409 - MainThread - botocore.hooks - DEBUG - Event top-level-args-parsed: calling handler <function resolve_types at 0x78850267c720>
2026-08-06 13:00:26,409 - MainThread - botocore.hooks - DEBUG - Event top-level-args-parsed: calling handler <function no_sign_request at 0x78850267ca90>
2026-08-06 13:00:26,409 - MainThread - botocore.hooks - DEBUG - Event top-level-args-parsed: calling handler <function resolve_verify_ssl at 0x78850267c9e0>
2026-08-06 13:00:26,409 - MainThread - botocore.hooks - DEBUG - Event top-level-args-parsed: calling handler <function resolve_cli_read_timeout at 0x78850267cbf0>
2026-08-06 13:00:26,409 - MainThread - botocore.hooks - DEBUG - Event top-level-args-parsed: calling handler <function resolve_cli_connect_timeout at 0x78850267cb40>
2026-08-06 13:00:26,409 - MainThread - botocore.hooks - DEBUG - Event top-level-args-parsed: calling handler <built-in method update of dict object at 0x7885026a8800>
2026-08-06 13:00:26,409 - MainThread - awscli.clidriver - DEBUG - CLI version: aws-cli/2.36.17 Python/3.14.6 Linux/6.18.33.2-microsoft-standard-WSL2 script-exe/x86_64.ubuntu.24
2026-08-06 13:00:26,409 - MainThread - awscli.clidriver - DEBUG - Arguments entered to CLI: ['ssm', 'get-parameter', '--name', '/aws/reference/secretsmanager/alpha', '--with-decryption', '--debug']
2026-08-06 13:00:26,409 - MainThread - awscli.lazy_emitter - DEBUG - Lazy-initializing plugin awscli.paramfile.register_init_uri_param_handler for event session-initialized
2026-08-06 13:00:26,409 - MainThread - awscli.lazy_emitter - DEBUG - Lazy-initializing plugin awscli.customizations.binaryformat.register_init_binary_formatter for event session-initialized
2026-08-06 13:00:26,410 - MainThread - awscli.lazy_emitter - DEBUG - Lazy-initializing plugin awscli.clidriver.register_no_pager_handler for event session-initialized
2026-08-06 13:00:26,410 - MainThread - awscli.lazy_emitter - DEBUG - Lazy-initializing plugin awscli.customizations.assumerole.register_assume_role_provider for event session-initialized
2026-08-06 13:00:26,410 - MainThread - awscli.lazy_emitter - DEBUG - Lazy-initializing plugin awscli.customizations.timestampformat.register_timestamp_format for event session-initialized
2026-08-06 13:00:26,411 - MainThread - awscli.lazy_emitter - DEBUG - Lazy-initializing plugin awscli.customizations.history.register_history_mode for event session-initialized
2026-08-06 13:00:26,416 - MainThread - awscli.lazy_emitter - DEBUG - Lazy-initializing plugin awscli.customizations.sso.register_sso_commands for event session-initialized
2026-08-06 13:00:26,421 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function add_timestamp_parser at 0x78850267f950>
2026-08-06 13:00:26,421 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function register_uri_param_handler at 0x788503611b10>
2026-08-06 13:00:26,421 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function add_binary_formatter at 0x78850267ecf0>
2026-08-06 13:00:26,421 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function no_pager_handler at 0x7885031b9590>
2026-08-06 13:00:26,421 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function inject_assume_role_provider_cache at 0x78850267f690>
2026-08-06 13:00:26,423 - MainThread - botocore.utils - DEBUG - IMDS ENDPOINT: http://169.x.x.x/
2026-08-06 13:00:26,424 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function attach_history_handler at 0x78850267fc10>
2026-08-06 13:00:26,424 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function inject_json_file_cache at 0x78850256d590>
2026-08-06 13:00:26,432 - MainThread - botocore.loaders - DEBUG - Loading JSON file: /home/x/.local/share/aws-cli/v2/2.36.17/dist/awscli/botocore/data/ssm/2014-11-06/service-2.json
2026-08-06 13:00:26,451 - MainThread - awscli.lazy_emitter - DEBUG - Lazy-initializing plugin awscli.customizations.sessionmanager.register_ssm_session for event building-command-table.ssm
2026-08-06 13:00:26,452 - MainThread - botocore.hooks - DEBUG - Event building-command-table.ssm: calling handler <function add_custom_start_session at 0x7885022f78a0>
2026-08-06 13:00:26,452 - MainThread - botocore.hooks - DEBUG - Event building-command-table.ssm: calling handler <function add_waiters at 0x7885031bd900>
2026-08-06 13:00:26,458 - MainThread - botocore.loaders - DEBUG - Loading JSON file: /home/x/.local/share/aws-cli/v2/2.36.17/dist/awscli/botocore/data/ssm/2014-11-06/waiters-2.json
2026-08-06 13:00:26,458 - MainThread - botocore.hooks - DEBUG - Event building-command-table.ssm: calling handler <bound method AliasSubCommandInjector.on_building_command_table of <awscli.alias.AliasSubCommandInjector object at 0x788503220830>>
2026-08-06 13:00:26,459 - MainThread - awscli.clidriver - DEBUG - OrderedDict({'name': <awscli.arguments.CLIArgument object at 0x7885020ecec0>, 'with-decryption': <awscli.arguments.BooleanArgument object at 0x7885020ed010>, 'no-with-decryption': <awscli.arguments.BooleanArgument object at 0x78850220da90>})
2026-08-06 13:00:26,459 - MainThread - awscli.lazy_emitter - DEBUG - Lazy-initializing plugin awscli.customizations.streamingoutputarg.register_streaming_output_arg for event building-argument-table.ssm.get-parameter
2026-08-06 13:00:26,459 - MainThread - awscli.lazy_emitter - DEBUG - Lazy-initializing plugin awscli.customizations.cliinput.register_cli_input_args for event building-argument-table.ssm.get-parameter
2026-08-06 13:00:26,460 - MainThread - awscli.lazy_emitter - DEBUG - Lazy-initializing plugin awscli.customizations.paginate.register_pagination for event building-argument-table.ssm.get-parameter
2026-08-06 13:00:26,460 - MainThread - awscli.lazy_emitter - DEBUG - Lazy-initializing plugin awscli.customizations.generatecliskeleton.register_generate_cli_skeleton for event building-argument-table.ssm.get-parameter
2026-08-06 13:00:26,461 - MainThread - botocore.hooks - DEBUG - Event building-argument-table.ssm.get-parameter: calling handler <function add_streaming_output_arg at 0x7885024bc0f0>
2026-08-06 13:00:26,461 - MainThread - botocore.hooks - DEBUG - Event building-argument-table.ssm.get-parameter: calling handler <function add_cli_input_json at 0x7885024bc9e0>
2026-08-06 13:00:26,462 - MainThread - botocore.hooks - DEBUG - Event building-argument-table.ssm.get-parameter: calling handler <function add_cli_input_yaml at 0x7885024bd900>
2026-08-06 13:00:26,462 - MainThread - botocore.hooks - DEBUG - Event building-argument-table.ssm.get-parameter: calling handler <function unify_paging_params at 0x7885024be140>
2026-08-06 13:00:26,468 - MainThread - botocore.loaders - DEBUG - Loading JSON file: /home/x/.local/share/aws-cli/v2/2.36.17/dist/awscli/botocore/data/ssm/2014-11-06/paginators-1.json
2026-08-06 13:00:26,469 - MainThread - botocore.hooks - DEBUG - Event building-argument-table.ssm.get-parameter: calling handler <function add_generate_skeleton at 0x7885024befb0>
2026-08-06 13:00:26,469 - MainThread - botocore.hooks - DEBUG - Event before-building-argument-table-parser.ssm.get-parameter: calling handler <bound method OverrideRequiredArgsArgument.override_required_args of <awscli.customizations.cliinput.CliInputJSONArgument object at 0x7885020ed940>>
2026-08-06 13:00:26,469 - MainThread - botocore.hooks - DEBUG - Event before-building-argument-table-parser.ssm.get-parameter: calling handler <bound method OverrideRequiredArgsArgument.override_required_args of <awscli.customizations.cliinput.CliInputYAMLArgument object at 0x7885020edbe0>>
2026-08-06 13:00:26,469 - MainThread - botocore.hooks - DEBUG - Event before-building-argument-table-parser.ssm.get-parameter: calling handler <bound method GenerateCliSkeletonArgument.override_required_args of <awscli.customizations.generatecliskeleton.GenerateCliSkeletonArgument object at 0x7885020edd30>>
2026-08-06 13:00:26,469 - MainThread - botocore.hooks - DEBUG - Event building-command-table.ssm_get-parameter: calling handler <function add_waiters at 0x7885031bd900>
2026-08-06 13:00:26,469 - MainThread - botocore.hooks - DEBUG - Event building-command-table.ssm_get-parameter: calling handler <bound method AliasSubCommandInjector.on_building_command_table of <awscli.alias.AliasSubCommandInjector object at 0x788503220830>>
2026-08-06 13:00:26,470 - MainThread - botocore.hooks - DEBUG - Event load-cli-arg.ssm.get-parameter.name: calling handler <awscli.paramfile.URIArgumentHandler object at 0x7885027012b0>
2026-08-06 13:00:26,470 - MainThread - awscli.lazy_emitter - DEBUG - Lazy-initializing plugin awscli.argprocess.register_param_shorthand_parser for event process-cli-arg.ssm.get-parameter
2026-08-06 13:00:26,470 - MainThread - botocore.hooks - DEBUG - Event process-cli-arg.ssm.get-parameter: calling handler <awscli.argprocess.ParamShorthandParser object at 0x7885020edfd0>
2026-08-06 13:00:26,470 - MainThread - awscli.arguments - DEBUG - Unpacked value of '/aws/reference/secretsmanager/alpha' for parameter "name": '/aws/reference/secretsmanager/alpha'
2026-08-06 13:00:26,470 - MainThread - botocore.hooks - DEBUG - Event load-cli-arg.ssm.get-parameter.with-decryption: calling handler <awscli.paramfile.URIArgumentHandler object at 0x7885027012b0>
2026-08-06 13:00:26,470 - MainThread - botocore.hooks - DEBUG - Event load-cli-arg.ssm.get-parameter.cli-input-json: calling handler <awscli.paramfile.URIArgumentHandler object at 0x7885027012b0>
2026-08-06 13:00:26,470 - MainThread - botocore.hooks - DEBUG - Event load-cli-arg.ssm.get-parameter.cli-input-yaml: calling handler <awscli.paramfile.URIArgumentHandler object at 0x7885027012b0>
2026-08-06 13:00:26,471 - MainThread - botocore.hooks - DEBUG - Event load-cli-arg.ssm.get-parameter.generate-cli-skeleton: calling handler <awscli.paramfile.URIArgumentHandler object at 0x7885027012b0>
2026-08-06 13:00:26,471 - MainThread - botocore.hooks - DEBUG - Event calling-command.ssm.get-parameter: calling handler <bound method CliInputArgument.add_to_call_parameters of <awscli.customizations.cliinput.CliInputJSONArgument object at 0x7885020ed940>>
2026-08-06 13:00:26,471 - MainThread - botocore.hooks - DEBUG - Event calling-command.ssm.get-parameter: calling handler <bound method CliInputArgument.add_to_call_parameters of <awscli.customizations.cliinput.CliInputYAMLArgument object at 0x7885020edbe0>>
2026-08-06 13:00:26,471 - MainThread - botocore.hooks - DEBUG - Event calling-command.ssm.get-parameter: calling handler <bound method GenerateCliSkeletonArgument.generate_skeleton of <awscli.customizations.generatecliskeleton.GenerateCliSkeletonArgument object at 0x7885020edd30>>
2026-08-06 13:00:26,471 - MainThread - botocore.hooks - DEBUG - Event before-create-client: calling handler <function register_session_id_event.<locals>._inject_session_id at 0x7885031bd170>
2026-08-06 13:00:26,487 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: env
2026-08-06 13:00:26,487 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: assume-role
2026-08-06 13:00:26,487 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: assume-role-with-web-identity
2026-08-06 13:00:26,487 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: sso
2026-08-06 13:00:26,489 - MainThread - botocore.loaders - DEBUG - Loading JSON file: /home/x/.local/share/aws-cli/v2/2.36.17/dist/awscli/botocore/data/endpoints.json
2026-08-06 13:00:26,521 - MainThread - botocore.hooks - DEBUG - Event choose-service-name: calling handler <function handle_service_name_alias at 0x78850491f690>
2026-08-06 13:00:26,527 - MainThread - botocore.loaders - DEBUG - Loading JSON file: /home/x/.local/share/aws-cli/v2/2.36.17/dist/awscli/botocore/data/ssm/2014-11-06/endpoint-rule-set-1.json
2026-08-06 13:00:26,527 - MainThread - botocore.loaders - DEBUG - Loading JSON file: /home/x/.local/share/aws-cli/v2/2.36.17/dist/awscli/botocore/data/partitions.json
2026-08-06 13:00:26,529 - MainThread - botocore.hooks - DEBUG - Event creating-client-class.ssm: calling handler <function add_generate_presigned_url at 0x7885041666c0>
2026-08-06 13:00:26,529 - MainThread - botocore.configprovider - DEBUG - Looking for endpoint for ssm via: environment_service
2026-08-06 13:00:26,529 - MainThread - botocore.configprovider - DEBUG - Looking for endpoint for ssm via: environment_global
2026-08-06 13:00:26,529 - MainThread - botocore.configprovider - DEBUG - Looking for endpoint for ssm via: config_service
2026-08-06 13:00:26,529 - MainThread - botocore.configprovider - DEBUG - Looking for endpoint for ssm via: config_global
2026-08-06 13:00:26,529 - MainThread - botocore.configprovider - DEBUG - No configured endpoint found.
2026-08-06 13:00:26,532 - MainThread - botocore.endpoint - DEBUG - Setting ssm timeout as (60, 60)
2026-08-06 13:00:26,534 - MainThread - botocore.hooks - DEBUG - Event provide-client-params.ssm.GetParameter: calling handler <function base64_decode_input_blobs at 0x78850267eda0>
2026-08-06 13:00:26,534 - MainThread - botocore.hooks - DEBUG - Event before-parameter-build.ssm.GetParameter: calling handler <function generate_idempotent_uuid at 0x788503912980>
2026-08-06 13:00:26,534 - MainThread - botocore.hooks - DEBUG - Event before-parameter-build.ssm.GetParameter: calling handler <function _handle_request_validation_mode_member at 0x78850392da60>
2026-08-06 13:00:26,534 - MainThread - botocore.regions - DEBUG - Calling endpoint provider with parameters: {'Region': 'eu-west-1', 'UseDualStack': False, 'UseFIPS': False}
2026-08-06 13:00:26,535 - MainThread - botocore.regions - DEBUG - Endpoint provider result: https://ssm.eu-west-1.amazonaws.com
2026-08-06 13:00:26,535 - MainThread - botocore.hooks - DEBUG - Event before-call.ssm.GetParameter: calling handler <function inject_api_version_header_if_needed at 0x78850392c7d0>
2026-08-06 13:00:26,535 - MainThread - botocore.endpoint - DEBUG - Making request for OperationModel(name=GetParameter) with params: {'url_path': '/', 'query_string': '', 'method': 'POST', 'headers': {'X-Amz-Target': 'AmazonSSM.GetParameter', 'Content-Type': 'application/x-amz-json-1.1', 'User-Agent': 'aws-cli/2.36.17 md/awscrt#0.36.0 ua/2.1 os/linux#6.18.33.2-microsoft-standard-WSL2 md/arch#x86_64 lang/python#3.14.6 md/pyimpl#CPython m/s,r,Z,E,b cfg/retry-mode#standard md/installer#script-exe sid/xxx md/distrib#ubuntu.24 md/prompt#off md/command#ssm.get-parameter'}, 'body': b'{"Name": "/aws/reference/secretsmanager/alpha", "WithDecryption": true}', 'url': 'https://ssm.eu-west-1.amazonaws.com/', 'context': {'client_region': 'eu-west-1', 'client_config': <botocore.config.Config object at 0x78850220f110>, 'has_streaming_input': False, 'auth_type': None, 'unsigned_payload': None, 'auth_options': ['aws.auth#sigv4']}}
2026-08-06 13:00:26,535 - MainThread - botocore.hooks - DEBUG - Event request-created.ssm.GetParameter: calling handler <bound method RequestSigner.handler of <botocore.signers.RequestSigner object at 0x78850317d6a0>>
2026-08-06 13:00:26,535 - MainThread - botocore.hooks - DEBUG - Event choose-signer.ssm.GetParameter: calling handler <function set_operation_specific_signer at 0x7885039126c0>
2026-08-06 13:00:26,535 - MainThread - botocore.hooks - DEBUG - Event choose-signer.ssm.GetParameter: calling handler <function _set_auth_scheme_preference_signer at 0x78850392db10>
2026-08-06 13:00:26,536 - MainThread - botocore.credentials - DEBUG - Credentials for role retrieved from cache.
2026-08-06 13:00:26,536 - MainThread - botocore.credentials - DEBUG - Retrieved credentials will expire at: 2026-08-06 22:54:34+00:00
2026-08-06 13:00:26,536 - MainThread - botocore.auth - DEBUG - Calculating signature using v4 auth.
2026-08-06 13:00:26,536 - MainThread - botocore.auth - DEBUG - CanonicalRequest:
POST
/

content-type:application/x-amz-json-1.1
host:ssm.eu-west-1.amazonaws.com
x-amz-date:20260806T110026Z
x-amz-security-token:IQoJbxxx
x-amz-target:AmazonSSM.GetParameter

content-type;host;x-amz-date;x-amz-security-token;x-amz-target
exxx
2026-08-06 13:00:26,537 - MainThread - botocore.auth - DEBUG - StringToSign:
xxxx
2026-08-06 13:00:26,537 - MainThread - botocore.auth - DEBUG - Signature:
93cf81xxx
2026-08-06 13:00:26,537 - MainThread - botocore.hooks - DEBUG - Event request-created.ssm.GetParameter: calling handler <bound method UserAgentString.rebuild_and_replace_user_agent_handler of <botocore.useragent.UserAgentString object at 0x78850220fed0>>
2026-08-06 13:00:26,537 - MainThread - botocore.hooks - DEBUG - Event request-created.ssm.GetParameter: calling handler <function add_retry_headers at 0x78850392d2d0>
2026-08-06 13:00:26,537 - MainThread - botocore.endpoint - DEBUG - Sending http request: <AWSPreparedRequest stream_output=False, method=POST, url=https://ssm.eu-west-1.amazonaws.com/, headers={'X-Amz-Target': b'AmazonSSM.GetParameter', 'Content-Type': b'application/x-amz-json-1.1', 'User-Agent': b'aws-cli/2.36.17 md/awscrt#0.36.0 ua/2.1 os/linux#6.18.33.2-microsoft-standard-WSL2 md/arch#x86_64 lang/python#3.14.6 md/pyimpl#CPython m/s,r,Z,E,b cfg/retry-mode#standard md/installer#script-exe sid/xxx md/distrib#ubuntu.24 md/prompt#off md/command#ssm.get-parameter', 'X-Amz-Date': b'20260806T110026Z', 'X-Amz-Security-Token': b'IQoJb3JpZxxx', 'Authorization': b'AWdxxx', 'amz-sdk-invocation-id': b'574xx', 'amz-sdk-request': b'attempt=1', 'Content-Length': '71'}>
2026-08-06 13:00:26,538 - MainThread - botocore.httpsession - DEBUG - Certificate path: /home/x/.local/share/aws-cli/v2/2.36.17/dist/awscli/botocore/cacert.pem
2026-08-06 13:00:26,538 - MainThread - urllib3.connectionpool - DEBUG - Starting new HTTPS connection (1): ssm.eu-west-1.amazonaws.com:443
2026-08-06 13:00:26,761 - MainThread - urllib3.connectionpool - DEBUG - https://ssm.eu-west-1.amazonaws.com:443 "POST / HTTP/1.1" 400 171
2026-08-06 13:00:26,761 - MainThread - botocore.parsers - DEBUG - Response headers: {'Server': 'Server', 'Date': 'Thu, 06 Aug 2026 11:00:27 GMT', 'Content-Type': 'application/x-amz-json-1.1', 'Content-Length': '171', 'Connection': 'keep-alive', 'x-amzn-RequestId': 'e13406fc-9192-4788-87b3-7ef783ba60ad'}
2026-08-06 13:00:26,761 - MainThread - botocore.parsers - DEBUG - Response body:
b'{"__type":"ParameterNotFound","message":"An error occurred (ParameterNotFound) when referencing Secrets Manager: Secret aws/reference/secretsmanager/alphanull not found."}'
2026-08-06 13:00:26,764 - MainThread - botocore.parsers - DEBUG - Response headers: {'Server': 'Server', 'Date': 'Thu, 06 Aug 2026 11:00:27 GMT', 'Content-Type': 'application/x-amz-json-1.1', 'Content-Length': '171', 'Connection': 'keep-alive', 'x-amzn-RequestId': 'e13406fc-9192-4788-87b3-7ef783ba60ad'}
2026-08-06 13:00:26,765 - MainThread - botocore.parsers - DEBUG - Response body:
b'{"__type":"ParameterNotFound","message":"An error occurred (ParameterNotFound) when referencing Secrets Manager: Secret aws/reference/secretsmanager/alphanull not found."}'
2026-08-06 13:00:26,765 - MainThread - botocore.hooks - DEBUG - Event needs-retry.ssm.GetParameter: calling handler <bound method RetryHandler.needs_retry of <botocore.retries.standard.RetryHandler object at 0x78850127d2b0>>
2026-08-06 13:00:26,765 - MainThread - botocore.retries.standard - DEBUG - Not retrying request.
2026-08-06 13:00:26,765 - MainThread - botocore.hooks - DEBUG - Event after-call.ssm.GetParameter: calling handler <bound method RetryQuotaChecker.release_retry_quota of <botocore.retries.standard.RetryQuotaChecker object at 0x78850127c2f0>>
2026-08-06 13:00:26,766 - MainThread - awscli.clidriver - DEBUG - Exception caught in main()
Traceback (most recent call last):
  File "awscli/clidriver.py", line 604, in main
  File "awscli/clidriver.py", line 742, in __call__
  File "awscli/clidriver.py", line 959, in __call__
  File "awscli/clidriver.py", line 1095, in invoke
  File "awscli/clidriver.py", line 1109, in _make_client_call
  File "awscli/botocore/client.py", line 442, in _api_call
  File "awscli/botocore/context.py", line 124, in wrapper
  File "awscli/botocore/client.py", line 932, in _make_api_call
botocore.errorfactory.ParameterNotFound: An error occurred (ParameterNotFound) when calling the GetParameter operation: An error occurred (ParameterNotFound) when referencing Secrets Manager: Secret aws/reference/secretsmanager/alphanull not found.

aws: [ERROR]: An error occurred (ParameterNotFound) when calling the GetParameter operation: An error occurred (ParameterNotFound) when referencing Secrets Manager: Secret aws/reference/secretsmanager/alphanull not found.
  7. github-actions
    removed
    response-requestedWaiting on additional info and feedback. Will move to "closing-soon" in 7 days.
    on Aug 6, 2026

  8. lkurzyniec commented on Aug 24, 2026

    @lkurzyniec
    lkurzyniec
    on Aug 24, 2026
    Author

    @RyanFitzSimmonsAK any news?

  9. RyanFitzSimmonsAK commented on Sep 22, 2026

    @RyanFitzSimmonsAK
    RyanFitzSimmonsAK
    on Sep 22, 2026
    Contributor

    Thanks for your patience. I did find a couple of internal tickets reporting issues with this in eu-west-1, but I want to check a few other things as well.

    • Can you confirm the secret you're attempting to access is in eu-west-1?
    • Can you confirm whether not your secret contains a / character in the name?
    • Is this happening to you for all secrets in this region, or just this one in particular?
  10. RyanFitzSimmonsAK
    added
    response-requestedWaiting on additional info and feedback. Will move to "closing-soon" in 7 days.
    on Sep 22, 2026

  11. lkurzyniec commented on Sep 23, 2026

    @lkurzyniec
    lkurzyniec
    on Sep 23, 2026
    Author

    @RyanFitzSimmonsAK answering:

    • yes, all of them are in eu-west-1
    • the name don't contain / char
      • exemplary ARN: arn:aws:secretsmanager:eu-west-1:5***8:secret:shared-config-dev-XXnnGR
    • it happens for some secrets. at the top (here), you can see that it's working fine for shared-config-alpha, but not working for shared-secret-alpha

    Some more examples:
    Image

    Image Image
  12. github-actions
    removed
    response-requestedWaiting on additional info and feedback. Will move to "closing-soon" in 7 days.
    on Sep 23, 2026

  13. RyanFitzSimmonsAK commented on Sep 23, 2026

    @RyanFitzSimmonsAK
    RyanFitzSimmonsAK
    on Sep 23, 2026
    Contributor

    2026-08-06 13:00:26,535 - MainThread - botocore.endpoint - DEBUG - Making request for OperationModel(name=GetParameter) with params: {'url_path': '/', 'query_string': '', 'method': 'POST', 'headers': {'X-Amz-Target': 'AmazonSSM.GetParameter', 'Content-Type': 'application/x-amz-json-1.1', 'User-Agent': 'aws-cli/2.36.17 md/awscrt#0.36.0 ua/2.1 os/linux#6.18.33.2-microsoft-standard-WSL2 md/arch#x86_64 lang/python#3.14.6 md/pyimpl#CPython m/s,r,Z,E,b cfg/retry-mode#standard md/installer#script-exe sid/xxx md/distrib#ubuntu.24 md/prompt#off md/command#ssm.get-parameter'}, 'body': b'{"Name": "/aws/reference/secretsmanager/alpha", "WithDecryption": true}', 'url': 'https://ssm.eu-west-1.amazonaws.com/', 'context': {'client_region': 'eu-west-1', 'client_config': <botocore.config.Config object at 0x78850220f110>, 'has_streaming_input': False, 'auth_type': None, 'unsigned_payload': None, 'auth_options': ['aws.auth#sigv4']}}

    The request looks correct, and the name and region are both correct. I'm fairly convinced this is not a CLI bug, so I'm going to reach out to the SSM team for guidance on next steps.

    Ticket # for internal use : P519737792

  14. RyanFitzSimmonsAK
    added
    service-apiThis issue is due to a problem in a service API, not the SDK implementation.
    on Sep 23, 2026

  15. ivanatpr commented on Sep 29, 2026

    @ivanatpr
    ivanatpr
    on Sep 29, 2026

    Hi folks, I'm a member of the Parameter Store team. After doing dome digging I found that the ParameterNotFound errors in this instance were correct but the error messages themselves were less than helpful and in some cases partially mangled.

    • First thing to get out of the way, the null you're seeing appended to the secret name in the error messages (shared-secret-alphanull not found) is purely an error message formatting bug, not indicative of a deeper underlying problem. We're fixing that.

    • The shared-secret-alpha calls failed because the secret has no version carrying the AWSCURRENT staging label. Secrets Manager resolved the name but had no current version to return. The most likely cause is a secret created without supplying a value, or maybe a rotation that left AWSCURRENT unassigned. Try running aws secretsmanager describe-secret --secret-id shared-secret-alpha and check VersionIdsToStages for whether anything maps to AWSCURRENT. In this case, Parameter Store was right to throw ParameterNotFound but the error message text wasn't differentiating between a secret that doesn't exist vs a secret without a default version. We're also working on a fix for that so that the ParameterNotFound error you get from parameter store relays the original Secrets Manger error so that you can disambiguate between this case vs the secret not existing at all.

    From our logs:

    ParameterNotFound: An error occurred (ParameterNotFound) when referencing Secrets Manager: Secret aws/reference/secretsmanager/shared-secret-alphanull not found. 
Caused by: com.amazonaws.services.secretsmanager.model.ResourceNotFoundException: Secrets Manager can't find the specified secret value for staging label: AWSCURRENT
    • The alpha secret error responses appear to be valid, with no secret named alpha existing in the account at the time.

    From our logs:

    ParameterNotFound: An error occurred (ParameterNotFound) when referencing Secrets Manager: Secret aws/reference/secretsmanager/alphanull not found. 
Caused by: com.amazonaws.services.secretsmanager.model.ResourceNotFoundException: Secrets Manager can't find the specified secret.

  16. lkurzyniec commented on Sep 30, 2026

    @lkurzyniec
    lkurzyniec
    on Sep 30, 2026
    Author

    @ivanatpr @RyanFitzSimmonsAK thank you both for your investigation.

    Secrets Manager can't find the specified secret value for staging label: AWSCURRENT

    This is it. I wish I have it in error messages then I would know what is missing, what needs to be fixed.

  17. lkurzyniec
    closed this as completedon Sep 30, 2026

  18. github-actions commented on Sep 30, 2026

    @github-actions
    github-actionsBot
    on Sep 30, 2026 – with GitHub Actions
    Contributor

    This issue is now closed. Comments on closed issues are hard for our team to see.
    If you need more assistance, please open a new issue that references this one.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

bugThis issue is a bug.p2This is a standard priority issueservice-apiThis issue is due to a problem in a service API, not the SDK implementation.ssm

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions