Repository navigation
Bug: get_secrets_by_name returns secrets that were not requested, and a different result once cached #8592
Description
Expected Behaviour
get_secrets_by_name(["db"]) returns only the db secret, and returns the same result whether it comes from the API or from the cache.
Current Behaviour
SecretsProvider._get_multiple (secrets.py:157) calls BatchGetSecretValue with a name filter, which the service documents as a prefix match. The first call returns db, db-password and db2. The cache path (secrets.py:262) filters to the requested names, so the second call returns only db. Same input, two different results. The docs describe the function as fetching secrets by name, not by prefix.
Code snippet
from botocore.config import Config
from botocore.stub import Stubber
from aws_lambda_powertools.utilities.parameters import SecretsProvider
provider = SecretsProvider(boto_config=Config(region_name="us-east-1"))
stub = Stubber(provider.client)
stub.add_response(
"batch_get_secret_value",
{"SecretValues": [{"Name": "db", "SecretString": "one"}, {"Name": "db-password", "SecretString": "two"}]},
{"Filters": [{"Key": "name", "Values": ["db"]}]},
)
stub.activate()
print(provider.get_multiple(["db"])) # {'db': 'one', 'db-password': 'two'}
print(provider.get_multiple(["db"])) # {'db': 'one'} served from cachePossible Solution
Keep the same API call and filter the returned SecretValues to the requested names before caching, so the API and cache paths agree. Switching to SecretIdList is the other option but changes the request shape. Anyone relying on the prefix behaviour today already loses the extra secrets after max_age, so this only makes the result consistent.
Steps to Reproduce
Run the snippet above (it uses botocore.stub.Stubber, no AWS access needed).
Powertools for AWS Lambda (Python) version
latest
AWS Lambda function runtime
3.13
Packaging format used
PyPi
Debugging logs
Warning
This issue is ready to be picked up, by humans or by agents. If you want it, comment here first so we can assign it to you, and please take only one or two issues at a time so others can join in too. The reproduction above runs locally without AWS access. Thanks!
Activity
hiyouwhatsapp commentedon Oct 18, 2026
I'd like to take this one. I'll keep the existing batch request and filter the results to the requested names, with tests for fresh lookups, cached lookups and prefix collisions.
leandrodamascena commentedon Oct 18, 2026
Pls go ahead @hiyouwhatsapp
powertools-for-aws-oss-automation commentedon Oct 22, 2026
Warning
This issue is now closed. Please be mindful that future comments are hard for our team to see.
If you need more assistance, please either reopen the issue, or open a new issue referencing this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.
github-actions commentedon Oct 28, 2026
This is now released under 3.38.0 version!