aws secretsmanager: InvalidParameterException on put-secret-value

TL;DR

put-secret-value rejects the call when the new value is malformed: unparseable JSON in a JSON secret, binary data passed as a string, or a staging-label conflict. Validate the payload with jq, use --secret-binary only for real binary, and let the API manage the AWSPENDING label. The put then succeeds.

Error

aws secretsmanager: InvalidParameterException on put-secret-value

Steps

1. Validate the payload: if the secret is JSON, pipe your value through jq empty before sending it. Expected: jq exits 0; if it errors, fix the JSON first.
2. Match the parameter to the data type: use --secret-string for text (including JSON) and --secret-binary only for actual binary blobs. Expected: no more type-mismatch rejections.
3. Do not set the AWSCURRENT or AWSPENDING staging labels yourself on a manual put unless you are driving rotation; let the API assign them. Expected: the new version lands with the labels the API expects.
4. Check the size: Secrets Manager caps values at 64KB. Measure your payload before sending. Expected: under the limit, or split the secret if it is genuinely large.
5. Retry the put and capture the returned ARN and VersionId. Expected: the call returns both, confirming the new version is stored.

When to use

• put-secret-value fails with InvalidParameterException
• Automated rotation or secret-writing scripts start failing after a payload change
• You are unsure whether to use string or binary parameters

When not to use

• AccessDeniedException (IAM/KMS permissions, not parameter shape)
• Rotation stuck in pending (state machine issue)
• describe-secret failures (read path, different checks)

Tool compatibility

• AWS CLI v2, Secrets Manager put-secret-value; jq for payload validation

Variant phrasings

put-secret-value rejects my JSON

Run it through jq empty first. A single trailing comma or unescaped quote is the usual culprit.

InvalidParameterException with binary secret

Pass binary with --secret-binary as a file reference and keep text secrets on --secret-string; mixing them triggers the error.

Why it happens

put-secret-value validates the new version before storing it: the JSON must parse if the secret is JSON-typed, the binary flag must match the content, and staging labels must not collide with an in-flight rotation. Any violation fails fast with InvalidParameterException instead of storing a corrupt version.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstj3zdGjy9Dl6gsGaC24Y0g