[Golden007-prog]

Issue number: closes #8600

Summary

Changes

Resolve the transform from the parameter name before decoding bytes. Identity transforms preserve the original byte value; UTF-8 decoding for JSON/base64 transforms runs inside the existing error handler. This wraps decoding failures in TransformParameterError, or returns None when transformation errors are suppressed.

User experience

An invalid UTF-8 SecretBinary now follows the documented transformation-error policy. With transform="auto" and an unmatched suffix, both valid and invalid UTF-8 binary secrets remain bytes instead of being decoded or raising an unexpected exception.

Validation

• Nine new regression cases failed on the original implementation and pass with the fix, including SecretsProvider calls with botocore Stubber; no AWS access required.
• Parameter functional suite: 147 passed.
• Ruff formatting/lint and mypy for the changed source pass.
• Broader Windows unit/functional run: 3,594 passed, 72 skipped, 11 failed. Ten failures reproduced with the original parameter implementation (Windows paths/newlines and bytecode-loader behavior); the Datadog logging failure passed when rerun in isolation. These are disclosed rather than reported as a green full suite.
• git diff --check passes.

The full make pr pipeline, live AWS tests, and Valkey native extra were not run. The Valkey extra could not build in this Windows environment. Implementation and verification assisted by OpenAI Codex.

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[boring-cyborg]

Thanks a lot for your first contribution! Please check out our contributing guidelines and don't hesitate to ask whatever you need.
In the meantime, check out the #python channel on our Powertools for AWS Lambda Discord: Invite link

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[leandrodamascena]

Thanks @Golden007-prog, this is exactly the fix I had in mind when I opened the issue. I ran it against real Secrets Manager with invalid and valid binary secrets across every transform, and the error policy now holds everywhere: TransformParameterError when asked to raise, None in a batch when not, and raw bytes when auto finds no suffix to act on.

One thing I want to be explicit about: with transform="auto" and no matching suffix, a valid UTF-8 binary secret used to come back as str and now comes back as bytes, same as transform=None. I think that's the right behavior, the old str was a side effect of decoding too early, but I'll call it out in the release notes.

I'm approving now. This goes out in 3.39.0, so it will sit here for a while before I merge it. No rebase needed in the meantime, and you'll be credited in the release notes.