aws secretsmanager: secret value exceeds maximum size

Not specified by the original author.

TL;DR

Secrets Manager caps values at 64KB; larger blobs (bundles, archives, giant JSON) get rejected. Split the payload across multiple secrets, or store the blob in S3 and keep a pointer secret. The application reassembles or fetches at runtime.

Error

aws secretsmanager: secret value exceeds maximum size

Steps

1. Measure the payload to confirm size is the issue, not malformed content. Expected: the byte count exceeds 65536.
2. Option A, split: divide the payload into logical chunks across multiple secrets with a naming convention, and have the application read and reassemble them. Expected: each piece stores successfully.
3. Option B, pointer: upload the blob to S3 with tight bucket policies and KMS encryption, then store the S3 path plus access configuration in Secrets Manager. Expected: a tiny secret pointing at the blob.
4. Update the application to fetch via the new pattern (multi-read or S3 download at startup). Expected: the app gets the full value at runtime.
5. Delete any partial or failed large-value attempts to avoid confusion. Expected: a clean secret layout.

When to use

• put-secret-value or create-secret fails on size
• Storing bundles, archives, or large JSON documents as secrets
• Designing secret storage for large payloads

When not to use

• KMS or IAM errors on normal-sized secrets
• Values that fit but fail validation (parameter issue)

Tool compatibility

• AWS Secrets Manager (64KB limit); S3 for blob offload

Variant phrasings

secretsmanager 64kb limit workaround

Split across secrets or use S3 with a pointer; the limit is per secret value.

store large json in secrets manager

Chunk it with a naming convention or move the document to S3 and keep the pointer.

Why it happens

Secrets Manager is built for credentials and config, not bulk storage; the 64KB cap keeps the service fast and the API simple. Large payloads belong in object storage with the secret holding only the access path.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst9QQJeEBryXhC366lTpZqQ

Resolved from the public thread: https://vectle.com/posts/pst9QQJeEBryXhC366lTpZqQ

Thread query: aws secretsmanager: secret value exceeds maximum size

TL;DR: Secrets Manager caps values at 64KB; larger blobs (bundles, archives, giant JSON) get rejected. Split the payload across multiple secrets, or store the blob in S3 and keep a pointer secret. The application reassembles or fetches at runtime.

Not specified by the original author.

TL;DR

Pull a secret with aws secretsmanager get-secret-value naming the secret and the region explicitly, then extract the field you need from the returned JSON. Most failures are a wrong region, a missing IAM permission, or a KMS key the caller cannot use, and each one has a distinct error you can fix directly.

Error

aws secretsmanager cli

Steps

1. Set the region explicitly on every call: aws secretsmanager get-secret-value --secret-id [secret name] --region [region]. Expected: JSON containing SecretString or SecretBinary.
2. Extract one field without printing the whole secret - pipe through a JSON query for the key you need, e.g. --query SecretString --output text | jq -r '.[field name]'. Expected: only the single value is printed.
3. If you get ResourceNotFoundException, list secrets in that region to check the name: aws secretsmanager list-secrets --region [region]. Expected: you see whether the secret lives in a different region or under a different name.
4. If you get AccessDeniedException, the caller needs the secretsmanager:GetSecretValue action on that secret's ARN. Expected: after the policy update, the call succeeds.
5. If you get DecryptionFailure, the caller also needs permission to use the KMS key that encrypts the secret. Expected: adding KMS decrypt rights clears the error.

When to use

• You need a secret value in a shell script, CI job, or debugging session.
• You are triaging ResourceNotFoundException, AccessDeniedException, or DecryptionFailure from the CLI.

When not to use

• Application code should use the SDK or an injector (external-secrets, Vault agent), not shell out to the CLI.
• For rotating a secret, use the rotation workflow, not repeated reads.

Tool compatibility

• AWS CLI v2; Secrets Manager in any commercial region; jq for JSON parsing.

Variant phrasings

aws secretsmanager get-secret-value AccessDeniedException

Missing IAM permission on the secret or its KMS key.

aws secretsmanager list-secrets returns nothing

Wrong region or the caller cannot list; check both.

Why it happens

The CLI is region-scoped and the secret may live elsewhere, and Secrets Manager separates the read permission from the KMS decrypt permission, so partial access fails late with a decryption error.

Edge cases

• Binary secrets come back base64-encoded in SecretBinary; decode them before use.
• Cross-account access needs a resource policy on the secret, not just identity policy on the caller.
• --query with --output text still prints the value to the terminal; avoid it on shared screens.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Z1hQSJjcN3N5q9GqqZtBVg

Resolved from the public thread: https://vectle.com/posts/pst_Z1hQSJjcN3N5q9GqqZtBVg

Thread query: aws secretsmanager cli

TL;DR: Pull a secret with aws secretsmanager get-secret-value naming the secret and the region explicitly, then extract the field you need from the returned JSON. Most failures are a wrong region, a missing IAM permission, or a KMS key the caller cannot use, and each one has a distinct error you can fix directly.

Not specified by the original author.

TL;DR

[helloV (accepted answer)] Use the --query option of the CLI to extract just the secret. ` aws secretsmanager get-secret-value --secret-id secrets --query SecretString --output text Context: Stack Overflow #50911540 (accepted answer, 150 votes, 16 answers): I am retrieving secrets I have stored in AWS secrets manager with the AWS cli like this: aws secretsmanager get-secret-value --secret-id secrets Which returns arn:aws:secretsmanager[ID]:secret - my\_secrets [number] my\_secrets {"API\_KEY":"ABCDEFGHI"} [UUID string] VERSIONSTAGES AWSCURRENT ` Does anyone know how I only get the se

Steps

1. [helloV (accepted answer)] Use the --query option of the CLI to extract just the secret.

``` aws secretsmanager get-secret-value --secret-id secrets ```

``` arn:aws:secretsmanager[ID]:secret - my_secrets [number] my_secrets {"API_KEY":"ABCDEFGHI"} [UUID string] VERSIONSTAGES AWSCURRENT ```

2. Does anyone know how I only get the secret ("API_KEY": "ABCDEFGHI")? I need to move these secrets to my register-task-definition environment variables. The best way would be to store them in a file and delete it after us or store them in variable. It is running on a linux machine.

## When to use

You are seeing this: I need to move these secrets to my register-task-definition environment variables. Use this skill when you run into "Parsing secrets from AWS secrets manager using AWS cli".

## When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

## Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

## Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Source: Stack Overflow #50911540 (accepted answer, 150 votes, 16 answers): I am retrieving secrets I have stored in AWS secrets manager with the AWS cli like this: `` aws secretsmanager get-secret-value --secret-id secrets Which returns arn:aws:secretsmanager[ID]:secret - my_secrets [number] my_secrets {"API_KEY":"ABCDEFGHI"} [UUID string] VERSIONSTAGES AWSCURRENT `` Does anyone know how I only get the secret ("API_KEY": "ABCDEFGHI")? I need to move these secrets to my register-task-definition environment variables. The best way would be to store them in a file and delete it after us or store them in variable. It is running on a linux machine.

Verified resolution: [helloV (accepted answer)] Use the --query option of the CLI to extract just the secret. `` aws secretsmanager get-secret-value --secret-id secrets --query SecretString --output text

Source URL: https://stackoverflow.com/questions/50911540