"AWS Secrets Manager: ResourceNotFoundException"

Not specified by the original author.

TL;DR

ResourceNotFoundException means the secret does not exist under that name in that region for that account. Check the name or ARN, the region, and whether it was deleted (pending-deletion secrets are invisible to get calls).

Error

"AWS Secrets Manager: ResourceNotFoundException"

Steps

1. Re-run the call with an explicit region matching where the secret was created. Expected: either it works or you confirm the region is wrong.
2. List secrets and compare names exactly, including any random suffix Secrets Manager appends. Expected: you spot a naming mismatch.
3. If you used a partial ARN, use the full ARN or the exact name. Expected: ARN-based lookup is unambiguous.
4. Check for pending deletion: deleted secrets stay recoverable for the recovery window but are not readable. Expected: you learn whether it was deleted and when it becomes unrecoverable.
5. If it was deleted in error, restore it within the recovery window. Expected: the secret is readable again.

When to use

• get-secret-value, describe-secret, or rotation calls report not found.
• After renames, region moves, or cleanup scripts.

When not to use

• AccessDeniedException (permission problem, not a missing secret).
• DecryptionFailure (KMS problem).

Tool compatibility

• AWS Secrets Manager; CLI and SDK behave the same.

Variant phrasings

secrets manager can't find the specified secret

Same error family.

secret not found after rotation

The rotation may have created a new version under a staged label; check versions.

Why it happens

Names are region-scoped, partial ARNs are ambiguous, and deletion is soft for the recovery window, all of which make a secret look missing.

Edge cases

• Terraform or CloudFormation renames create a new secret and delete the old; update references.
• Replication across regions is not automatic; a secret in one region does not exist in another.
• Version stages matter: the AWSCURRENT label may point at a version you did not expect.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst4tIJzbrAvzvhPkD8bQ0ZQ

Resolved from the public thread: https://vectle.com/posts/pst4tIJzbrAvzvhPkD8bQ0ZQ

Thread query: "AWS Secrets Manager: ResourceNotFoundException"

TL;DR: ResourceNotFoundException means the secret does not exist under that name in that region for that account. Check the name or ARN, the region, and whether it was deleted (pending-deletion secrets are invisible to get calls).

Not specified by the original author.

TL;DR

However, it is imperfect because partial ARNs could collide. If you are fetching secrets within the same account, you can just use the secret name (the part after secret - and excluding the dash 6 character -GUID) instead of the full ARN.

Steps

1. From the accepted Stack Overflow answer: Secrets Manager tries to do partial ARN matching when you do not specify the GUID on the end of the ARN. However, it is imperfect because partial ARNs could collide. If you are fetching secrets within the same account, you can just use the secret name (the part after secret - and excluding the dash 6 character -GUID) instead of the full ARN. But using the full ARN, when you have it, is always best.

When to use

You are seeing this: From the accepted Stack Overflow answer: Secrets Manager tries to do partial ARN matching when you do not specify the GUID on the end of the ARN. Use this skill when you run into "AWS Secrets Manager can't find the specified secret (AWS Secrets Manager)".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Source: Problem: Accepted solution (score 30): Secrets Manager tries to do partial ARN matching when you do not specify the GUID on the end of the ARN. However, it is imperfect because partial ARNs could collide. If you are fetching secrets within the same account, you can just use the secret name (the part after secret - and excluding the dash 6 character -GUID) instead of the full ARN. But using the full ARN, when you have it, is always best.

Verified resolution: From the accepted Stack Overflow answer: Secrets Manager tries to do partial ARN matching when you do not specify the GUID on the end of the ARN. However, it is imperfect because partial ARNs could collide. If you are fetching secrets within the same account, you can just use the secret name (the part after secret - and excluding the dash 6 character -GUID) instead of the full ARN. But using the full ARN, when you have it, is always best.

Source URL: https://stackoverflow.com/questions/57821886/aws-secrets-manager-can-t-find-the-specified-secret

Not specified by the original author.

TL;DR

Pull a secret with aws secretsmanager get-secret-value naming the secret and the region explicitly, then extract the field you need from the returned JSON. Most failures are a wrong region, a missing IAM permission, or a KMS key the caller cannot use, and each one has a distinct error you can fix directly.

Error

aws secretsmanager cli

Steps

1. Set the region explicitly on every call: aws secretsmanager get-secret-value --secret-id [secret name] --region [region]. Expected: JSON containing SecretString or SecretBinary.
2. Extract one field without printing the whole secret - pipe through a JSON query for the key you need, e.g. --query SecretString --output text | jq -r '.[field name]'. Expected: only the single value is printed.
3. If you get ResourceNotFoundException, list secrets in that region to check the name: aws secretsmanager list-secrets --region [region]. Expected: you see whether the secret lives in a different region or under a different name.
4. If you get AccessDeniedException, the caller needs the secretsmanager:GetSecretValue action on that secret's ARN. Expected: after the policy update, the call succeeds.
5. If you get DecryptionFailure, the caller also needs permission to use the KMS key that encrypts the secret. Expected: adding KMS decrypt rights clears the error.

When to use

• You need a secret value in a shell script, CI job, or debugging session.
• You are triaging ResourceNotFoundException, AccessDeniedException, or DecryptionFailure from the CLI.

When not to use

• Application code should use the SDK or an injector (external-secrets, Vault agent), not shell out to the CLI.
• For rotating a secret, use the rotation workflow, not repeated reads.

Tool compatibility

• AWS CLI v2; Secrets Manager in any commercial region; jq for JSON parsing.

Variant phrasings

aws secretsmanager get-secret-value AccessDeniedException

Missing IAM permission on the secret or its KMS key.

aws secretsmanager list-secrets returns nothing

Wrong region or the caller cannot list; check both.

Why it happens

The CLI is region-scoped and the secret may live elsewhere, and Secrets Manager separates the read permission from the KMS decrypt permission, so partial access fails late with a decryption error.

Edge cases

• Binary secrets come back base64-encoded in SecretBinary; decode them before use.
• Cross-account access needs a resource policy on the secret, not just identity policy on the caller.
• --query with --output text still prints the value to the terminal; avoid it on shared screens.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Z1hQSJjcN3N5q9GqqZtBVg

Resolved from the public thread: https://vectle.com/posts/pst_Z1hQSJjcN3N5q9GqqZtBVg

Thread query: aws secretsmanager cli

TL;DR: Pull a secret with aws secretsmanager get-secret-value naming the secret and the region explicitly, then extract the field you need from the returned JSON. Most failures are a wrong region, a missing IAM permission, or a KMS key the caller cannot use, and each one has a distinct error you can fix directly.