Using Secret Manager for password bug?

I'm trying to use secrets manager to generate the password for DocumentDB and I'm stuck. I've managed to simplify to the below. It doesn't seem to matter if I generate it or not actually, when hard coded to a short password I still get the error.

      MasterUserPassword:         '{{resolve:secretsmanager:ab:SecretString}}'

Property validation failure: [Length of value {{{resolve:secretsmanager:ab:SecretString}}} for property {/MasterUserPassword} is greater than maximum allowed length {41}]

However the below works:

      MasterUserPassword:         '{{resolve:secretsmanager:a:SecretString}}'

Anyone else tried this or hit this issue or managed to get it working?
Looks like it's doing the 41 digit check on the pre-resolved string, not the actual password