apache/flink · error · IllegalConfigurationException

Invalid assume-role.session-duration '%s' for bucket '%s'. M

Error message

Invalid assume-role.session-duration '%s' for bucket '%s'. Must be a valid integer (e.g., 3600)

What it means

BucketConfigProvider throws IllegalConfigurationException when parsing the per-bucket property 'assume-role.session-duration' because Integer.parseInt failed. The value must be a plain integer number of seconds (e.g. 3600). The exception names both the bad value and the bucket, and chains the original NumberFormatException.

Source

Thrown at flink-filesystems/flink-s3-fs-native/src/main/java/org/apache/flink/fs/s3native/BucketConfigProvider.java:69

    private static final Logger LOG = LoggerFactory.getLogger(BucketConfigProvider.class);
    static final String BUCKET_CONFIG_PREFIX = "s3.bucket.";
    static final Map<String, BiConsumer<S3BucketConfig.Builder, String>> PROPERTY_APPLICATORS;
    static final List<String> KNOWN_PROPERTIES_BY_LENGTH;

    static {
        final Map<String, BiConsumer<S3BucketConfig.Builder, String>> applicators =
                new LinkedHashMap<>();
        applicators.put("access-key", S3BucketConfig.Builder::accessKey);
        applicators.put("assume-role.arn", S3BucketConfig.Builder::assumeRoleArn);
        applicators.put("assume-role.external-id", S3BucketConfig.Builder::assumeRoleExternalId);
        applicators.put(
                "assume-role.session-duration",
                (b, v) -> {
                    try {
                        b.assumeRoleSessionDurationSeconds(Integer.parseInt(v));
                    } catch (NumberFormatException e) {
                        throw new IllegalConfigurationException(
                                String.format(
                                        "Invalid assume-role.session-duration '%s' for bucket '%s'. "
                                                + "Must be a valid integer (e.g., 3600)",
                                        v, b.getBucketName()),
                                e);
                    }
                });
        applicators.put("assume-role.session-name", S3BucketConfig.Builder::assumeRoleSessionName);
        applicators.put("aws.credentials.provider", S3BucketConfig.Builder::credentialsProvider);
        applicators.put("endpoint", S3BucketConfig.Builder::endpoint);
        applicators.put(
                "path-style-access",
                (b, v) -> {
                    if (!"true".equalsIgnoreCase(v) && !"false".equalsIgnoreCase(v)) {
                        throw new IllegalConfigurationException(
                                String.format(
                                        "Invalid path-style-access '%s' for bucket '%s'. "
                                                + "Must be 'true' or 'false'",

View on GitHub (pinned to 2f3c205e92)

Solutions

Set the value to a bare integer of seconds, e.g. assume-role.session-duration: 3600.
Remove quotes/units/whitespace from the value in the bucket config file or flink-conf.
Confirm IAM role constraints: AWS accepts 900..43200 seconds, so use an integer inside that range.

Example fix

# before
s3.bucket.my-bucket.assume-role.session-duration: 1h

# after
s3.bucket.my-bucket.assume-role.session-duration: 3600

Defensive patterns

Strategy: validation

Validate before calling

static int parseSessionDuration(String raw, String bucket) {
    String v = raw == null ? null : raw.trim();
    if (v == null || !v.matches("\\d+")) {
        throw new IllegalArgumentException("assume-role.session-duration for '" + bucket + "' must be an integer like 3600, got: " + raw);
    }
    int seconds = Integer.parseInt(v);
    if (seconds < 900 || seconds > 43200) {
        throw new IllegalArgumentException("session duration must be within 900..43200 seconds");
    }
    return seconds;
}

Try / catch

try {
    Integer.parseInt(config.get("assume-role.session-duration"));
} catch (NumberFormatException e) {
    // surface a clear config error before job submission, pointing at the bucket entry
}

Prevention

Use bare integers in seconds for AWS session durations; never '1h'/'30m' style.
Add config linting in CI that validates all s3.bucket.*.assume-role.* values parse.
Remember the AWS-valid range is 900-43200 seconds.

When it happens

Trigger: Configuring a bucket entry with s3.bucket.<bucket>.assume-role.session-duration set to a non-integer such as '3600s', '1h', 'one hour', an empty string, or a value with whitespace.

Common situations: Users copy duration formats from other Flink options (like '10 s' style durations) or from AWS CLI examples; typos; trailing units; environment variable interpolation producing an empty string.

Related errors

AI-assisted analysis of apache/flink@2f3c205e92 (2026-08-14). Data as JSON: /api/errors/4f291d83b1703422. Report an issue: GitHub.