[Golden007-prog]

Issue number: closes #8600

Summary

Changes

Resolve the transform from the parameter name before decoding bytes. Identity transforms preserve the original byte value; UTF-8 decoding for JSON/base64 transforms runs inside the existing error handler. This wraps decoding failures in TransformParameterError, or returns None when transformation errors are suppressed.

User experience

An invalid UTF-8 SecretBinary now follows the documented transformation-error policy. With transform="auto" and an unmatched suffix, both valid and invalid UTF-8 binary secrets remain bytes instead of being decoded or raising an unexpected exception.

Validation

• Nine new regression cases failed on the original implementation and pass with the fix, including SecretsProvider calls with botocore Stubber; no AWS access required.
• Parameter functional suite: 147 passed.
• Ruff formatting/lint and mypy for the changed source pass.
• Broader Windows unit/functional run: 3,594 passed, 72 skipped, 11 failed. Ten failures reproduced with the original parameter implementation (Windows paths/newlines and bytecode-loader behavior); the Datadog logging failure passed when rerun in isolation. These are disclosed rather than reported as a green full suite.
• git diff --check passes.

The full make pr pipeline, live AWS tests, and Valkey native extra were not run. The Valkey extra could not build in this Windows environment. Implementation and verification assisted by OpenAI Codex.

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[boring-cyborg]

Thanks a lot for your first contribution! Please check out our contributing guidelines and don't hesitate to ask whatever you need.
In the meantime, check out the #python channel on our Powertools for AWS Lambda Discord: Invite link

[leandrodamascena]

Thanks @Golden007-prog, this is exactly the fix I had in mind when I opened the issue. I ran it against real Secrets Manager with invalid and valid binary secrets across every transform, and the error policy now holds everywhere: TransformParameterError when asked to raise, None in a batch when not, and raw bytes when auto finds no suffix to act on.

One thing I want to be explicit about: with transform="auto" and no matching suffix, a valid UTF-8 binary secret used to come back as str and now comes back as bytes, same as transform=None. I think that's the right behavior, the old str was a side effect of decoding too early, but I'll call it out in the release notes.

I'm approving now. This goes out in 3.39.0, so it will sit here for a while before I merge it. No rebase needed in the meantime, and you'll be credited in the release notes.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[powertools-for-aws-oss-automation]

Awesome work, congrats on your first merged pull request and thank you for helping improve everyone's experience!

[boring-cyborg]

Awesome work, congrats on your first merged pull request and thank you for helping improve everyone's experience!

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.95%. Comparing base (7188793) to head (c1ff178).
⚠️ Report is 1 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop    #8609      +/-   ##
===========================================
- Coverage    96.95%   96.95%   -0.01%     
===========================================
  Files          321      321              
  Lines        16260    16258       -2     
  Branches      1456     1455       -1     
===========================================
- Hits         15765    15763       -2     
  Misses         353      353              
  Partials       142      142              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.