Repository navigation
Bug: non-UTF-8 SecretBinary with transform='binary' or 'auto' raises UnicodeDecodeError instead of TransformParameterError #8600
Description
Expected Behaviour
A transform failure raises TransformParameterError, or returns None when raise_on_transform_error=False, as documented. With transform="auto" and a name whose suffix does not match, the value is returned as-is.
Current Behaviour
BaseProvider.transform_value (base.py:328) decodes bytes to str before entering the try block, so a SecretBinary that is not valid UTF-8 leaks a raw UnicodeDecodeError from the transform, including with transform="auto" on a .bin name where no transform should run at all.
Code snippet
from botocore.config import Config
from botocore.stub import Stubber
from aws_lambda_powertools.utilities.parameters import SecretsProvider
provider = SecretsProvider(boto_config=Config(region_name="us-east-1"))
stub = Stubber(provider.client)
stub.add_response("get_secret_value", {"SecretBinary": b"\xff\xfe"}, {"SecretId": "b"})
stub.add_response("get_secret_value", {"SecretBinary": b"\xff\xfe"}, {"SecretId": "b.bin"})
stub.activate()
provider.get("b", transform="binary") # UnicodeDecodeError, expected TransformParameterError
provider.get("b.bin", transform="auto") # UnicodeDecodeError, expected the raw bytesPossible Solution
Move the decode inside the try, and skip it when the resolved transform is the identity (auto with a non-matching suffix).
Steps to Reproduce
Run the snippet above (it uses botocore.stub.Stubber, no AWS access needed).
Powertools for AWS Lambda (Python) version
latest
AWS Lambda function runtime
3.13
Packaging format used
PyPi
Debugging logs
Warning
This issue is ready to be picked up, by humans or by agents. If you want it, comment here first so we can assign it to you, and please take only one or two issues at a time so others can join in too. The reproduction above runs locally without AWS access. Thanks!
Activity
Golden007-prog commentedon Oct 18, 2026
I'd like to work on this issue with OpenAI Codex assistance. I'll reproduce the invalid UTF-8 and auto/identity cases locally, add regression coverage, and run the relevant validation before submitting a PR. This is the only Powertools issue I am taking.
leandrodamascena commentedon Oct 18, 2026
powertools-for-aws-oss-automation commentedon Oct 29, 2026
Warning
This issue is now closed. Please be mindful that future comments are hard for our team to see.
If you need more assistance, please either reopen the issue, or open a new issue referencing this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.