apache/hadoop · error · InvalidCredentialsException

AccessKeyId and AccessKeySecret should not be null or empty.

Error message

AccessKeyId and AccessKeySecret should not be null or empty.

What it means

Error "AccessKeyId and AccessKeySecret should not be null or empty." thrown in apache/hadoop.

Source

Thrown at hadoop-tools/hadoop-aliyun/src/main/java/org/apache/hadoop/fs/aliyun/oss/AliyunCredentialsProvider.java:57

    String accessKeyId;
    String accessKeySecret;
    String securityToken;
    try {
      accessKeyId = AliyunOSSUtils.getValueWithKey(conf, ACCESS_KEY_ID);
      accessKeySecret = AliyunOSSUtils.getValueWithKey(conf, ACCESS_KEY_SECRET);
    } catch (IOException e) {
      throw new InvalidCredentialsException(e);
    }

    try {
      securityToken = AliyunOSSUtils.getValueWithKey(conf, SECURITY_TOKEN);
    } catch (IOException e) {
      securityToken = null;
    }

    if (StringUtils.isEmpty(accessKeyId)
        || StringUtils.isEmpty(accessKeySecret)) {
      throw new InvalidCredentialsException(
          "AccessKeyId and AccessKeySecret should not be null or empty.");
    }

    if (StringUtils.isNotEmpty(securityToken)) {
      credentials = new DefaultCredentials(accessKeyId, accessKeySecret,
          securityToken);
    } else {
      credentials = new DefaultCredentials(accessKeyId, accessKeySecret);
    }
  }

  @Override
  public void setCredentials(Credentials creds) {
    if (creds == null) {
      throw new InvalidCredentialsException("Credentials should not be null.");
    }

    credentials = creds;

View on GitHub (pinned to 2add963021)

Solutions

1. Set fs.oss.accessKeyId and fs.oss.accessKeySecret (or provide credentials via a credentials provider) with non-empty values.
2. If using temporary/instance-role credentials, configure the matching provider class instead of static keys.

Example fix

<property><name>fs.oss.accessKeyId</name><value>YOUR_ID</value></property>
<property><name>fs.oss.accessKeySecret</name><value>YOUR_SECRET</value></property>

When it happens

Trigger: Thrown by AliyunCredentialsProvider when fs.oss.accessKeyId or fs.oss.accessKeySecret is missing or empty in the configuration. Set both credentials (or use a credentials provider/temporary token) before accessing OSS.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/eaee047be50aa989. Report an issue: GitHub.