apache/flink · error · IllegalArgumentException

Failed to instantiate credentials provider: {}

Error message

Failed to instantiate credentials provider: {}

What it means

After the class passes the AwsCredentialsProvider check, instantiateCredentialsProvider() tries (1) a static no-arg create() method and (2) a no-arg constructor. Any reflective failure — missing both create() and a public no-arg constructor, non-public constructor, or the constructor/create() itself throwing — is wrapped in this IllegalArgumentException with the resolved class name and original cause. The message parameter {} is the fully-qualified resolved class name.

Source

Thrown at flink-filesystems/flink-s3-fs-native/src/main/java/org/apache/flink/fs/s3native/S3ClientProvider.java:939

                    throw new IllegalArgumentException(
                            "Class "
                                    + resolvedClassName
                                    + " does not implement AwsCredentialsProvider");
                }

                try {
                    Method createMethod = clazz.getMethod("create");
                    if (Modifier.isStatic(createMethod.getModifiers())
                            && AwsCredentialsProvider.class.isAssignableFrom(
                                    createMethod.getReturnType())) {
                        return (AwsCredentialsProvider) createMethod.invoke(null);
                    }
                } catch (NoSuchMethodException ignored) {
                }

                return (AwsCredentialsProvider) clazz.getDeclaredConstructor().newInstance();
            } catch (Exception e) {
                throw new IllegalArgumentException(
                        "Failed to instantiate credentials provider: " + resolvedClassName, e);
            }
        }

        private static String resolveProviderClassName(String className) {
            if (!className.contains(".")) {
                return "software.amazon.awssdk.auth.credentials." + className;
            }
            return className;
        }

        private StsClient buildStsClient(AwsCredentialsProvider baseProvider, Region awsRegion) {
            return StsClient.builder().region(awsRegion).credentialsProvider(baseProvider).build();
        }

        private AwsCredentialsProvider buildAssumeRoleProvider(StsClient stsClient) {
            AssumeRoleRequest.Builder requestBuilder =
                    AssumeRoleRequest.builder()

View on GitHub (pinned to 2f3c205e92)

Solutions

1. Prefer built-in providers that support no-arg creation: AnonymousCredentialsProvider, DefaultCredentialsProvider, InstanceProfileCredentialsProvider (v2 class names or simple names).
2. For custom providers, add a public no-arg constructor (or static create()) that internally reads config from Flink options/environment instead of constructor params.
3. Read the chained cause: if it is an NPE/IllegalState from inside the constructor, fix that prerequisite (e.g. provide the profile/role env) rather than the instantiation mechanism.
4. For assume-role flows, use the provider's env-var-driven v2 variant (e.g. StsAssumeRoleCredentialsProvider via AWS_ROLE_ARN) instead of a constructor-arg provider.

Example fix

// before: custom provider with only an arg constructor — instantiation fails
public class MyProvider implements AwsCredentialsProvider {
    public MyProvider(String roleArn) { ... }
    public AwsCredentials resolveCredentials() { ... }
}

// after: public no-arg constructor reading config from the environment
public class MyProvider implements AwsCredentialsProvider {
    public MyProvider() { this(System.getenv("AWS_ROLE_ARN")); }
    private MyProvider(String roleArn) { ... }
    public AwsCredentials resolveCredentials() { ... }
}

// Verify the provider is instantiable the way the module instantiates it
static boolean instantiable(String fqcn) {
    try {
        Class<?> c = Class.forName(fqcn);
        if (!AwsCredentialsProvider.class.isAssignableFrom(c)) return false;
        try {
            java.lang.reflect.Method m = c.getMethod("create");
            if (java.lang.reflect.Modifier.isStatic(m.getModifiers())) return true;
        } catch (NoSuchMethodException ignored) {}
        c.getDeclaredConstructor().newInstance();
        return true;
    } catch (ReflectiveOperationException e) { return false; }
}

catch (IllegalArgumentException e) { if (e.getMessage().startsWith("Failed to instantiate credentials provider")) { read e.getCause(): construction-time failure -> fix provider's prerequisites; no no-arg ctor -> use a different provider or add one; } else throw e; }

When it happens

Trigger: Listing a provider class whose only constructors take arguments (e.g. some profile- or role-based providers); an abstract class or interface name; a provider whose no-arg constructor throws because required configuration/env (profile file, web-idenity token, STS endpoint) is absent at instantiation time.

Common situations: Using providers that need builder-time config (assume-role with role ARN) which cannot be expressed as a bare class name; provider constructor calling external metadata service in an offline test env; user provider with constructor injection (Spring) that has no default ctor.

Related errors

• Class {} does not implement AwsCredentialsProvider
• fs.s3.aws.credentials.provider is set but contains no valid
• AWS region could not be determined. Set 's3.region' in Flink
• Unknown encryption type: {}. Supported values: none, sse-s3,
• Failed to upload part %d for key: %s, uploadId: %s

AI-assisted analysis of apache/flink@2f3c205e92 (2026-08-14). Data as JSON: /api/errors/b1747a74f42423ab. Report an issue: GitHub.