[wanjinhao1]

Issue number: closes #8596

Summary

Changes

SecretsProvider._get_multiple appended the synthesized {"Key": "name", ...} filter to the very list the caller passed via sdk_options["Filters"] (filters.append(name_filter)). A shared or module-level Filters list — as shown in the documentation example — therefore grew one stale name filter per call, and every subsequent request sent the accumulated filters.

This changes the merge to build a new list ([*sdk_options.get("Filters", []), name_filter]), leaving the caller's list untouched. A functional test with botocore.stub.Stubber calls get_multiple twice with the same shared list and asserts the list is unchanged.

User experience

Before: reusing a Filters list across calls silently accumulated stale name filters, causing subsequent batch_get_secret_value calls to request secrets that were no longer wanted.

After: the caller's Filters list is left exactly as passed, and each request sends only the caller's filters plus the current name filter.

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

AI assistance disclosure: this fix was implemented with the help of an AI coding agent on behalf of the account owner.

[boring-cyborg]

Thanks a lot for your first contribution! Please check out our contributing guidelines and don't hesitate to ask whatever you need.
In the meantime, check out the #python channel on our Powertools for AWS Lambda Discord: Invite link

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[leandrodamascena]

Thanks @wanjinhao1, confirmed and approved. I ran it against real Secrets Manager with a module-level Filters list like the one in our docs: on develop the second call already fails with "No secrets found" because the stale name filter from the first call is still in the list. With your change the list stays untouched and every call sends only its own name filter.

This goes out in 3.39.0, so it will sit here for a while before I merge it. No rebase needed in the meantime, and you'll be credited in the release notes.