apache/flink · error · IllegalArgumentException

fs.s3.aws.credentials.provider is set but contains no valid

Error message

fs.s3.aws.credentials.provider is set but contains no valid provider class names

What it means

buildBaseCredentialsProvider() parses fs.s3.aws.credentials.provider as a comma-separated list of provider class names. After trimming and dropping empty entries, if NO entry survived the chain stays empty and this IllegalArgumentException is thrown — i.e. the option's value consists only of whitespace/commas (e.g. " ", ",,", " , "). A single invalid class name throws a different error (class resolution / instantiation), so this one specifically means zero usable names were parsed.

Source

Thrown at flink-filesystems/flink-s3-fs-native/src/main/java/org/apache/flink/fs/s3native/S3ClientProvider.java:887

            return "CRT transport requested (s3.crt.enabled=true) but the aws-crt JAR "
                    + "is not on the classpath. Place it in the Flink plugin directory "
                    + "(e.g. $FLINK_HOME/plugins/s3-fs-native/) alongside flink-s3-fs-native.jar. "
                    + "Run tools/download-crt-jars.sh to download the matching version. "
                    + "See the module README for setup details.";
        }

        private AwsCredentialsProvider buildBaseCredentialsProvider() {
            List<AwsCredentialsProvider> chain = new ArrayList<>();

            if (!StringUtils.isNullOrWhitespaceOnly(credentialsProviderClasses)) {
                for (String name : credentialsProviderClasses.split(",")) {
                    String trimmed = name.trim();
                    if (!trimmed.isEmpty()) {
                        chain.add(instantiateCredentialsProvider(trimmed));
                    }
                }
                if (chain.isEmpty()) {
                    throw new IllegalArgumentException(
                            "fs.s3.aws.credentials.provider is set but contains no valid provider class names");
                }
            }

            if (accessKey != null && secretKey != null) {
                chain.add(
                        StaticCredentialsProvider.create(
                                AwsBasicCredentials.create(accessKey, secretKey)));
            }

            chain.add(new DynamicTemporaryAWSCredentialsProvider());
            chain.add(DefaultCredentialsProvider.builder().build());

            LOG.info(
                    "Using credentials provider chain: {}",
                    chain.stream()
                            .map(p -> p.getClass().getSimpleName())
                            .collect(Collectors.joining(" -> ")));

View on GitHub (pinned to 2f3c205e92)

Solutions

Set the option to at least one valid provider class name, e.g. fs.s3.aws.credentials.provider: org.apache.flink.fs.s3native.user.TemporaryKeyCredentialsProvider, or remove the line entirely to use the default chain (static keys, DynamicTemporaryAWSCredentialsProvider, DefaultCredentialsProvider).
Check rendered config on the cluster: grep 'credentials.provider' flink-conf.yaml* and fix templating that emits blank values.
If multiple providers are wanted, supply them comma-separated with real names: 'A,B'.

Example fix

# before (flink-conf.yaml)
fs.s3.aws.credentials.provider:

# after (either remove the line, or set a real provider)
fs.s3.aws.credentials.provider: software.amazon.awssdk.auth.credentials.InstanceProfileCredentialsProvider

Defensive patterns

Strategy: validation

Validate before calling

// Validate the option before Flink initializes the filesystem
String providers = conf.getString("fs.s3.aws.credentials.provider", "");
boolean hasName = Arrays.stream(providers.split(",")).map(String::trim).anyMatch(s -> !s.isEmpty());
if (providers != null && !providers.trim().isEmpty() && !hasName) {
    throw new IllegalArgumentException("fs.s3.aws.credentials.provider must list at least one class name");
}

Prevention

Lint rendered flink-conf.yaml in CI: fail when an s3.* key has an empty value.
Prefer omitting the option entirely over setting it blank.
When templating configs, render the whole line conditionally, not just the value.

When it happens

Trigger: flink-conf.yaml contains fs.s3.aws.credentials.provider with an empty or comma-only value: fs.s3.aws.credentials.provider: (blank), : ",", : " , , ". Any filesystem/client construction at plugin init fails immediately.

Common situations: YAML templating (Helm/Kustomize) that renders an unset variable as empty string; commented-out examples partially reverted; copy-paste of a placeholder value like 'COMMA_SEPARATED_LIST'; trailing colon with no value in flink-conf.yaml which Flink parses as empty string.

Related errors

AI-assisted analysis of apache/flink@2f3c205e92 (2026-08-14). Data as JSON: /api/errors/d0a9595a250c3959. Report an issue: GitHub.