private Secret retrieveSecret(Key key, SecretVersionId version) {
        var client = getClient(key.vaultName());
        var requestBuilder = GetSecretValueRequest.builder()
                .secretId(awsSecretId(key));

        if (version != null) {
            requestBuilder.versionId(version.value());
        } else {
            requestBuilder.versionStage(AWSCURRENT);
        }
        var request = requestBuilder.build();


        try {
            GetSecretValueResponse secret = client.getSecretValue(request);
            return new Secret(key,
                              secret.secretString().getBytes(StandardCharsets.UTF_8),
                              SecretVersionId.of(secret.versionId()),
                              toSecretVersionState(secret.versionStages()));
        } catch (Exception e) {
            throw new IllegalArgumentException("Failed to retrieve secret with key %s:\n%s".formatted(key, e.getMessage()));
        }
    }
Returns the AWS secret id to use for the given key.
jdisc-cloud-aws/src/main/java/ai/vespa/secret/aws/AsmSecretReader.java