[hiyouwhatsapp]

Issue number: closes #8592

Summary

Changes

Filter the batch response to an exact-name set before extracting values, transforming results, or caching. The existing name-filter request and pagination remain unchanged.

Add six regression cases covering string and binary values, prefix collisions, cached and forced reads, a prefix-only page before an exact match, JSON transformation, and no exact matches.

User experience

With secrets db, db-password, and db2, requesting ["db"] now returns only db on both fresh and cached reads. Unrequested prefix matches cannot cause transformation errors.

Validation

Verified commit: a8278e0c626e26c10a7d128667cd02b704ebf599.

• Unchanged quality workflow: passed on Python 3.10–3.14; 3,848 tests plus 10 performance tests per version, mypy, ty, and all 15 Nox dependency sessions. Formatting, lint, security and complexity baselines passed.
• Supplementary contribution checks: documentation lint and pre-commit hooks on both changed files passed, with no resulting source changes.
• Dependency Review: passed after enabling the fork's dependency graph.
• All six new regression cases failed on the original implementation.

Verification-only workflows are on separate fork branches and are not included here.

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[boring-cyborg]

Thanks a lot for your first contribution! Please check out our contributing guidelines and don't hesitate to ask whatever you need.
In the meantime, check out the #python channel on our Powertools for AWS Lambda Discord: Invite link

[leandrodamascena]

Thanks @hiyouwhatsapp! I ran the suite and also tested this against real Secrets Manager with db, db-password and db2: develop returns all three for ["db"] on the first call and only db from the cache, your branch returns only db both times. Pagination, the Errors path and transform="json" all behave, and keeping the same API request was the right call.

Approving now. This goes out in 3.38.0, so it will sit here a bit before I merge. No need to rebase or touch anything, I'll take care of it and you'll get the credit in the release notes. Thank you!

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.93%. Comparing base (246aa01) to head (e2a7105).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop    #8621   +/-   ##
========================================
  Coverage    96.93%   96.93%           
========================================
  Files          318      318           
  Lines        16072    16075    +3     
  Branches      1435     1436    +1     
========================================
+ Hits         15580    15583    +3     
  Misses         349      349           
  Partials       143      143           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[boring-cyborg]

Awesome work, congrats on your first merged pull request and thank you for helping improve everyone's experience!

[powertools-for-aws-oss-automation]

Awesome work, congrats on your first merged pull request and thank you for helping improve everyone's experience!