What causes "Snowflake credentials are not set correctly." in apache/beam?

Provide one complete scheme: o_auth_token, or username+password, or username+private_key_path/raw_private_key

apache/beam · error · RuntimeError

Snowflake credentials are not set correctly.

Error message

Snowflake credentials are not set correctly.

What it means

The Snowflake connector's verify_credentials() enforces that exactly one complete credential scheme is present: an OAuth token, a username+password pair, or a username plus a private key (file path or raw PEM contents). It raises RuntimeError when none of these combinations is satisfied, since Snowflake cannot authenticate without one.

Solutions

Provide one complete scheme: o_auth_token, or username+password, or username+private_key_path/raw_private_key
Check that environment variables/options are actually set at runtime, not just defined
If using key-pair auth, pass both username and private_key_path (or raw_private_key contents)
Never mix schemes unnecessarily — ensure the intended scheme's values are not None/empty strings

Example fix

// before
WriteToSnowflake(username='user')  # no password or key
// after
WriteToSnowflake(username='user', private_key_path='/path/to/key.p8')

Defensive patterns

Strategy: validation

Validate before calling

def snowflake_credentials_ok(username, password, private_key_path, raw_private_key, o_auth_token):
    return bool(o_auth_token or (username and password) or (username and (private_key_path or raw_private_key)))

Type guard

def has_complete_credential_scheme(u, p, k, r, o):
    return bool(o) or bool(u and p) or bool(u and (k or r))

Try / catch

try:
    transform = snowflake.WriteToSnowflake(**creds)
except RuntimeError as e:
    raise RuntimeError('Configure OAuth, password, or key-pair credentials for Snowflake') from e

Prevention

Validate all credential env vars are non-empty at pipeline startup
Provide exactly one full scheme (token, password, or key pair)
Fail fast with a clear message before launching the pipeline

When it happens

Trigger: Calling WriteToSnowflake/ReadFromSnowflake with username but no password or private key, with a private key path but no username, or with all credentials None.

Common situations: Missing environment variables in CI, pointing at a private_key_path that was never configured, providing only an OAuth token without the rest being validated, or partial config migrations.

Related errors

AI-assisted analysis of apache/beam@12126d8942 (2026-09-13). Data as JSON: /api/errors/2c0019d42bc09378. Report an issue: GitHub.

Appendix: source

Thrown at sdks/python/apache_beam/io/snowflake.py:488

  before writing to it.
  """
  APPEND = 'APPEND'
  EMPTY = 'EMPTY'
  TRUNCATE = 'TRUNCATE'

  @staticmethod
  def VerifyParam(field):
    if field and not hasattr(WriteDisposition, field):
      raise RuntimeError(
          'Write disposition has to be one of the following values:'
          'APPEND, EMPTY, TRUNCATE. Got: {}'.format(field))


def verify_credentials(
    username, password, private_key_path, raw_private_key, o_auth_token):
  if not (o_auth_token or (username and password) or
          (username and (private_key_path or raw_private_key))):
    raise RuntimeError('Snowflake credentials are not set correctly.')

View on GitHub (pinned to 12126d8942)