diff --git a/seedfarmer/mgmt/archive_support.py b/seedfarmer/mgmt/archive_support.py
index c9f64e9..da4b104 100644
--- a/seedfarmer/mgmt/archive_support.py
+++ b/seedfarmer/mgmt/archive_support.py
@@ -55,6 +55,10 @@ def _download_archive(archive_url: str, secret_name: Optional[str]) -> Response:
     if secret_name:
         session: boto3.Session = SessionManager().get_or_create().toolchain_session  # type: ignore[no-redef]
         secret_value = get_secrets_manager_value(secret_name, session)
+
+        if "username" not in secret_value or "password" not in secret_value:
+            raise InvalidConfigurationError("username and password required in secret %s", secret_name)
+
         auth = HTTPBasicAuth(secret_value["username"], secret_value["password"])
     else:
         auth = None