feat: Add plain text secret support for AWS Secrets Manager

AWS Secrets Manager natively supports plain text secrets, but the plugin
was forcing JSON parsing which caused plain text secrets to fail.

This change allows retrieving plain text secrets using the SecretString
key, while maintaining full backward compatibility with existing JSON
and binary secret handling.

Changes:
- Modified GetSecrets to gracefully handle non-JSON secret strings
- Added SecretString key for plain text secret access
- Added comprehensive test coverage for plain text scenarios
- Updated documentation with usage examples

Fixes #710

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: vlsi

docs/backends.md

@@ -312,6 +312,22 @@ stringData:
 type: Opaque
 ```
 
+###### Plain Text Secrets
+
+AWS Secrets Manager can store plain text (non-JSON) secrets. To retrieve the entire plain text value, use `SecretString` as the key:
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: aws-example
+stringData:
+  sample-secret: <path:test-plaintext-secret#SecretString>
+type: Opaque
+```
+
+**Note**: If you need to access the secret value as a single string, use `#SecretString`. If the secret contains JSON, you can access its elements with `#keyName` (e.g., `<path:test-secret#username>`).
+
 ###### Versioned secrets
 
 ```yaml
@@ -357,9 +373,11 @@ stringData:
 type: Opaque
 ```
 
-###### Retrieving of binary data
+###### Retrieving Binary and Plain Text Data
+
+AWS Secrets Manager supports three types of secret values: JSON objects, plain text strings, and binary data.
 
-Since there is no way to set a key for binary type in AWS Secret Manager, set the `<key>` part to `SecretBinary` to retrieve binary data:
+**For binary data**, use `SecretBinary` as the key:
 
 ```yaml
 apiVersion: v1
@@ -371,6 +389,31 @@ stringData:
 type: Opaque
 ```
 
+**For plain text (non-JSON) strings**, use `SecretString` as the key:
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: aws-example
+stringData:
+  sample-secret: <path:arn:aws:secretsmanager:<REGION>:<ACCOUNT_NUMBER>:<SECRET_ID>#SecretString>
+type: Opaque
+```
+
+**For JSON secrets**, specify the individual key you want to retrieve:
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: aws-example
+stringData:
+  username: <path:arn:aws:secretsmanager:<REGION>:<ACCOUNT_NUMBER>:<SECRET_ID>#username>
+  password: <path:arn:aws:secretsmanager:<REGION>:<ACCOUNT_NUMBER>:<SECRET_ID>#password>
+type: Opaque
+```
+
 **NOTE**
 For cross account access there is the need to configure the correct permissions between accounts, please check:
 https://aws.amazon.com/premiumsupport/knowledge-center/secrets-manager-share-between-accounts

pkg/backends/awssecretsmanager.go

@@ -77,7 +77,11 @@ func (a *AWSSecretsManager) GetSecrets(path string, version string, annotations
 	if result.SecretString != nil {
 		err := json.Unmarshal([]byte(*result.SecretString), &dat)
 		if err != nil {
-			return nil, err
+			// If JSON unmarshal fails, treat as plain text
+			utils.VerboseToStdErr("Get plain text value for %v", path)
+			dat = make(map[string]interface{})
+			dat["SecretString"] = *result.SecretString
+			return dat, nil
 		}
 	} else if result.SecretBinary != nil {
 		utils.VerboseToStdErr("Get binary value for %v", path)

pkg/backends/awssecretsmanager_test.go

@@ -27,6 +27,15 @@ func (m *mockSecretsManagerClient) GetSecretValue(ctx context.Context, input *se
 		}
 	case "test-binary":
 		data.SecretBinary = []byte("binary-data")
+	case "test-plaintext":
+		string := "This is a plain text secret, not JSON"
+		data.SecretString = &string
+	case "test-empty-plaintext":
+		string := ""
+		data.SecretString = &string
+	case "test-invalid-json":
+		string := "{incomplete json"
+		data.SecretString = &string
 	}
 
 	return data, nil
@@ -92,6 +101,64 @@ func TestAWSSecretManagerGetSecrets(t *testing.T) {
 			t.Errorf("expected: %v, got: %v.", expected, data)
 		}
 	})
+
+	t.Run("Get plain text secret", func(t *testing.T) {
+		data, err := sm.GetSecrets("test-plaintext", "", map[string]string{})
+		if err != nil {
+			t.Fatalf("expected 0 errors but got: %s", err)
+		}
+
+		expected := map[string]interface{}{
+			"SecretString": "This is a plain text secret, not JSON",
+		}
+
+		if !reflect.DeepEqual(expected, data) {
+			t.Errorf("expected: %v, got: %v.", expected, data)
+		}
+	})
+
+	t.Run("Get individual plain text secret", func(t *testing.T) {
+		secret, err := sm.GetIndividualSecret("test-plaintext", "SecretString", "", map[string]string{})
+		if err != nil {
+			t.Fatalf("expected 0 errors but got: %s", err)
+		}
+
+		expected := "This is a plain text secret, not JSON"
+
+		if !reflect.DeepEqual(expected, secret) {
+			t.Errorf("expected: %s, got: %s.", expected, secret)
+		}
+	})
+
+	t.Run("Get empty plain text secret", func(t *testing.T) {
+		data, err := sm.GetSecrets("test-empty-plaintext", "", map[string]string{})
+		if err != nil {
+			t.Fatalf("expected 0 errors but got: %s", err)
+		}
+
+		expected := map[string]interface{}{
+			"SecretString": "",
+		}
+
+		if !reflect.DeepEqual(expected, data) {
+			t.Errorf("expected: %v, got: %v.", expected, data)
+		}
+	})
+
+	t.Run("Get invalid JSON as plain text", func(t *testing.T) {
+		data, err := sm.GetSecrets("test-invalid-json", "", map[string]string{})
+		if err != nil {
+			t.Fatalf("expected 0 errors but got: %s", err)
+		}
+
+		expected := map[string]interface{}{
+			"SecretString": "{incomplete json",
+		}
+
+		if !reflect.DeepEqual(expected, data) {
+			t.Errorf("expected: %v, got: %v.", expected, data)
+		}
+	})
 }
 
 func TestAWSSecretManagerEmptyIfNoSecret(t *testing.T) {