read command doesn't allow to read secrets if they are uppercase

[colonnac]

Hello guys,

read command like this

chamber read staging/eu-west-1/my_service DATABASE_URL

will fail due to this bug: https://github.com/segmentio/chamber/blob/master/cmd/read.go#L39-L42

The code always forces the key to be lower case.

I propose to remove that normalization. This will extend the functionality. That is it allows you to run both:

chamber read staging/eu-west-1/my_service DATABASE_URL
chamber read staging/eu-west-1/my_service database_url

There's no need to add a flag or nothing. You have for free the new feature just removing that normalization.

Chamber if importing secrets with import command will allow you to create uppercase secrets but you have no way to read them.

Thanks

[Androz2091]

Independently hit this on chamber v3.1.5 against the SecretsManager backend — confirming the report, and adding a cleaner repro plus what I had to do to work around it.

Repro

$ printf '{"FOO": "bar"}' | chamber import -b secretsmanager mysvc -
Successfully imported 1 secrets

$ chamber list -b secretsmanager mysvc
Key  Version  LastModified         User
FOO  1        2026-05-18 17:55:08  arn:aws:iam::...:user/me

$ chamber read -b secretsmanager mysvc FOO -q
Error: Failed to read: secret not found

$ chamber exec -b secretsmanager mysvc -- printenv FOO
bar

Diagnosis

• chamber import (without --normalize-keys, the default) preserves case → JSON in Secrets Manager is {"FOO": "bar"}.
• chamber list iterates the raw map → shows FOO verbatim.
• chamber exec injects every key into the child env without lowercasing → printenv FOO works.
• chamber read calls utils.NormalizeKey → looks up latest["foo"] in a map keyed "FOO" → ErrSecretNotFound.

So import → list → exec form a consistent case-preserving pipeline, but read is the odd one out.

Related

• Issue with key case for write operation #644 reports the matching bug on the write side (docs say keys are uppercased, code lowercases). Open PR feat: preserve key on write #643 adds --preserve-case for write only — doesn't touch read.
• Even if feat: preserve key on write #643 merges as-is, the round-trip on the SecretsManager backend stays broken: import (preserves), write (preserves with --preserve-case), but read (still lowercases).

The minimal fix on the read path is what @colonnac suggested in the OP — drop the NormalizeKey call in cmd/read.go. If consistency with --preserve-case from #643 is preferred, then read should honor the same flag (or have its own).

Workaround

chamber exec -b secretsmanager <svc> -- printenv <KEY>

Works because exec injects keys verbatim and printenv looks them up case-sensitively. Slower than read (spawns a subshell) but correct, and doesn't require re-importing with lowercase keys.

Happy to test a fix if a PR lands.

[Timothyng28]

+1