Mismatching tokens

[aws-samples]

Mismatching tokens

[jchannon]

Just had a the same error message in a .net app. No idea what it means

[ThinTim]

If it helps at all, I get that error when there's no version with the given label for the given secret:

aws secretsmanager get-secret-value --secret-id my_secret --version-stage RANDOM 

An error occurred (ResourceNotFoundException) when calling the GetSecretValue operation: Secrets Manager can’t find the specified secret value for staging label: RANDOM

If that's the case, a possible resolution would be to just assign the AWSCURRENT label to whatever version of your secret you're currently using:

aws secretsmanager update-secret-version-stage --secret-id my_secret --version-stage AWSCURRENT  --move-to-version-id whatever_current_version_id_is

If it's already assigned to something else, I believe this call would raise an error asking for explicit version IDs for both sides of the transaction.

[sb-ovo]

Thx @ThinTim , but in my case it's not going to help.

I'm creating secrets using Terraform, and since I set these to rotate automatically, AWS starts a rotation process right away after creation.

That means I have no control over the versions/stages, AWS is triggering all that and calling my Lambda function automatically. (probably a step function behind the scene)
And that's the issue: when calling Lambda, AWS sends me a token that is supposed to match a stage... but doesn't match anything when I fetch data from the secretsmanager API.

[rstevens011]

Terraform may be rotating the secret before putting a initial secret value. Terraform makes a distinction between a secret and a secret version. It'd probably be helpful to have a look at your CloudTrail logs to see the individual API calls and the order they are called in.

[ayshamdmgit]

@sb-ovo Were you able to resolve this?

[joebaro]

If you are still experiencing this issue please open a support case with AWS.