Failed to initialize Google Cloud Healthcare Service…

Error message

Failed to initialize Google Cloud Healthcare Service. Reason:

What it means

newFhirStoreClient in fhirio panics when healthcare.NewService fails to construct the Google Cloud Healthcare API client. This typically means Google Cloud credentials are missing/invalid or the default options (user agent) could not be applied, so no FHIR store operations can proceed.

Solutions

Set GOOGLE_APPLICATION_CREDENTIALS to a valid service-account JSON key, or run 'gcloud auth application-default login' locally.
Ensure the runtime environment (GCE/GKE/Cloud Run) has the Cloud Healthcare scopes and a service account with healthcare permissions.
Validate credentials before starting the pipeline (e.g. create the healthcare client yourself in a pre-check).
Check network access to oauth2.googleapis.com and healthcare.googleapis.com.

Example fix

// before
beam.Init() // no credentials configured

// after
os.Setenv("GOOGLE_APPLICATION_CREDENTIALS", "/path/to/sa-key.json")
beam.Init()

Defensive patterns

Strategy: validation

Validate before calling

if _, err := healthcare.NewService(context.Background()); err != nil {
    return fmt.Errorf("Google Cloud Healthcare client unavailable: %w", err)
}

Try / catch

defer func() {
    if r := recover(); r != nil {
        log.Fatalf("Healthcare service init failed: %v", r)
    }
}()

Prevention

Ensure GOOGLE_APPLICATION_CREDENTIALS or workload identity is configured before beam.Init().
Run 'gcloud auth application-default login' in dev environments.
Grant the runtime service account Cloud Healthcare roles and correct OAuth scopes.
Smoke-test client construction outside the pipeline first.

When it happens

Trigger: Running a fhirio pipeline (search/read/delete via setup -> newFhirStoreClient) with no Application Default Credentials available: GOOGLE_APPLICATION_CREDENTIALS unset, no metadata server, or a malformed credentials file.

Common situations: Running locally without 'gcloud auth application-default login'; deploying to an environment without the proper service-account scopes; a corrupted or wrong-project credentials JSON; network/DNS failure reaching the Google auth endpoints.

Related errors

AI-assisted analysis of apache/beam@12126d8942 (2026-09-13). Data as JSON: /api/errors/7cfcfaf7209c804a. Report an issue: GitHub.

Appendix: source

Thrown at sdks/go/pkg/beam/io/fhirio/common.go:99

	Failures  int64 `json:"failure,string"`
}

type fhirStoreClient interface {
	readResource(resourcePath []byte) (*http.Response, error)
	executeBundle(storePath string, bundle string) (*http.Response, error)
	search(storePath, resourceType string, queries map[string]string, pageToken string) (*http.Response, error)
	deidentify(srcStorePath, dstStorePath string, deidConfig *healthcare.DeidentifyConfig) (operationResults, error)
	importResources(storePath, gcsURI string, contentStructure ContentStructure) (operationResults, error)
}

type fhirStoreClientImpl struct {
	healthcareService *healthcare.Service
}

func newFhirStoreClient() *fhirStoreClientImpl {
	healthcareService, err := healthcare.NewService(context.Background(), option.WithUserAgent(UserAgent))
	if err != nil {
		panic("Failed to initialize Google Cloud Healthcare Service. Reason: " + err.Error())
	}
	return &fhirStoreClientImpl{healthcareService}
}

func (c *fhirStoreClientImpl) fhirService() *healthcare.ProjectsLocationsDatasetsFhirStoresFhirService {
	return c.healthcareService.Projects.Locations.Datasets.FhirStores.Fhir
}

func (c *fhirStoreClientImpl) fhirStoreService() *healthcare.ProjectsLocationsDatasetsFhirStoresService {
	return c.healthcareService.Projects.Locations.Datasets.FhirStores
}

func (c *fhirStoreClientImpl) readResource(resourcePath []byte) (*http.Response, error) {
	return c.fhirService().Read(string(resourcePath)).Do()
}

func (c *fhirStoreClientImpl) executeBundle(storePath, bundle string) (*http.Response, error) {
	return c.fhirService().ExecuteBundle(storePath, strings.NewReader(bundle)).Do()

View on GitHub (pinned to 12126d8942)