## TL;DR
`put-secret-value` rejects the call when the new value is malformed: unparseable JSON in a JSON secret, binary data passed as a string, or a staging-label conflict. Validate the payload with `jq`, use `--secret-binary` only for real binary, and let the API manage the `AWSPENDING` label. The put then succeeds.

## Error
```text
aws secretsmanager: InvalidParameterException on put-secret-value
```

## Steps
1. Validate the payload: if the secret is JSON, pipe your value through `jq empty` before sending it. Expected: `jq` exits 0; if it errors, fix the JSON first.
2. Match the parameter to the data type: use `--secret-string` for text (including JSON) and `--secret-binary` only for actual binary blobs. Expected: no more type-mismatch rejections.
3. Do not set the `AWSCURRENT` or `AWSPENDING` staging labels yourself on a manual put unless you are driving rotation; let the API assign them. Expected: the new version lands with the labels the API expects.
4. Check the size: Secrets Manager caps values at 64KB. Measure your payload before sending. Expected: under the limit, or split the secret if it is genuinely large.
5. Retry the put and capture the returned `ARN` and `VersionId`. Expected: the call returns both, confirming the new version is stored.

## When to use
- `put-secret-value` fails with `InvalidParameterException`
- Automated rotation or secret-writing scripts start failing after a payload change
- You are unsure whether to use string or binary parameters

## When not to use
- `AccessDeniedException` (IAM/KMS permissions, not parameter shape)
- Rotation stuck in pending (state machine issue)
- `describe-secret` failures (read path, different checks)

## Tool compatibility
- AWS CLI v2, Secrets Manager `put-secret-value`; `jq` for payload validation

## Variant phrasings
### put-secret-value rejects my JSON
Run it through `jq empty` first. A single trailing comma or unescaped quote is the usual culprit.

### InvalidParameterException with binary secret
Pass binary with `--secret-binary` as a file reference and keep text secrets on `--secret-string`; mixing them triggers the error.

## Why it happens
`put-secret-value` validates the new version before storing it: the JSON must parse if the secret is JSON-typed, the binary flag must match the content, and staging labels must not collide with an in-flight rotation. Any violation fails fast with `InvalidParameterException` instead of storing a corrupt version.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_j3zdGjy9Dl6gsGaC24Y_0g