apache/flink · error · IllegalArgumentException

Class {} does not implement AwsCredentialsProvider

Error message

Class {} does not implement AwsCredentialsProvider

What it means

instantiateCredentialsProvider() loads each class named in fs.s3.aws.credentials.provider (after resolveProviderClassName maps simple names to software.amazon.awssdk.auth.credentials.*). If the class loads but does not implement the AWS SDK v2 marker interface software.amazon.awssdk.auth.credentials.AwsCredentialsProvider, this IllegalArgumentException is thrown. It is a config-type error: the named class exists but is not usable as a credentials provider.

Source

Thrown at flink-filesystems/flink-s3-fs-native/src/main/java/org/apache/flink/fs/s3native/S3ClientProvider.java:921

                    chain.stream()
                            .map(p -> p.getClass().getSimpleName())
                            .collect(Collectors.joining(" -> ")));

            return AwsCredentialsProviderChain.builder().credentialsProviders(chain).build();
        }

        /**
         * Instantiates an {@link AwsCredentialsProvider} from a class name. Accepts fully-qualified
         * SDK v2 class names or simple names resolved from the {@code
         * software.amazon.awssdk.auth.credentials} package (e.g. {@code
         * AnonymousCredentialsProvider}).
         */
        private AwsCredentialsProvider instantiateCredentialsProvider(String className) {
            String resolvedClassName = resolveProviderClassName(className);
            try {
                Class<?> clazz = Class.forName(resolvedClassName);
                if (!AwsCredentialsProvider.class.isAssignableFrom(clazz)) {
                    throw new IllegalArgumentException(
                            "Class "
                                    + resolvedClassName
                                    + " does not implement AwsCredentialsProvider");
                }

                try {
                    Method createMethod = clazz.getMethod("create");
                    if (Modifier.isStatic(createMethod.getModifiers())
                            && AwsCredentialsProvider.class.isAssignableFrom(
                                    createMethod.getReturnType())) {
                        return (AwsCredentialsProvider) createMethod.invoke(null);
                    }
                } catch (NoSuchMethodException ignored) {
                }

                return (AwsCredentialsProvider) clazz.getDeclaredConstructor().newInstance();
            } catch (Exception e) {
                throw new IllegalArgumentException(

View on GitHub (pinned to 2f3c205e92)

Solutions

1. Use an SDK v2 provider implementing software.amazon.awssdk.auth.credentials.AwsCredentialsProvider, e.g. software.amazon.awssdk.auth.credentials.InstanceProfileCredentialsProvider or EnvironmentVariableCredentialsProvider.
2. Port custom providers to SDK v2: implement resolveCredentials() returning AwsCredentials (v2 types), not com.amazonaws.auth.AWSCredentialsProvider.
3. If you rely on session/STS chaining, wrap your logic in a v2 AwsCredentialsProvider implementation or use StsAssumeRoleCredentialsProvider (v2).

Example fix

# before (flink-conf.yaml) — SDK v1 class, fails
fs.s3.aws.credentials.provider: com.amazonaws.auth.InstanceProfileCredentialsProvider

# after — SDK v2 class
fs.s3.aws.credentials.provider: software.amazon.awssdk.auth.credentials.InstanceProfileCredentialsProvider

// Validate each configured class implements the v2 interface before handing config to Flink
static void checkProviderClasses(String csv) {
    for (String n : csv.split(",")) {
        String name = n.trim();
        if (name.isEmpty()) continue;
        String fqcn = name.contains(".") ? name : "software.amazon.awssdk.auth.credentials." + name;
        Class<?> c = Class.forName(fqcn);
        if (!software.amazon.awssdk.auth.credentials.AwsCredentialsProvider.class.isAssignableFrom(c))
            throw new IllegalArgumentException(fqcn + " is not an SDK v2 AwsCredentialsProvider");
    }
}

static boolean isV2CredentialsProvider(String fqcn) { try { return AwsCredentialsProvider.class.isAssignableFrom(Class.forName(fqcn)); } catch (ClassNotFoundException e) { return false; } }

When it happens

Trigger: Naming an SDK v1 provider (com.amazonaws.auth.InstanceProfileCredentialsProvider) in fs.s3.aws.credentials.provider; naming a user class that implements the v1 interface or merely exposes credentials; simple-name resolution picking an unrelated class with the same simple name in the awssdk package.

Common situations: Migrating configs from the presto/hadoop S3 filesystems or SDK v1 examples to the native SDK v2 filesystem; user companies with in-house v1 credential refreshers; typo'ing a simple name that accidentally matches another class in the awssdk credentials package.

Related errors

• Failed to instantiate credentials provider: {}
• fs.s3.aws.credentials.provider is set but contains no valid
• AWS region could not be determined. Set 's3.region' in Flink
• Unknown encryption type: {}. Supported values: none, sse-s3,
• Failed to upload part %d for key: %s, uploadId: %s

AI-assisted analysis of apache/flink@2f3c205e92 (2026-08-14). Data as JSON: /api/errors/532f6ad9eb133615. Report an issue: GitHub.