apache/hadoop · error · InstantiationIOException

Class {className} AWS provider class cannot be used (configu

Error message

Class {className} AWS provider class cannot be used (configuration key {key})

What it means

InstantiationIOException raised while building a credential provider chain: after v1-to-v2 class remapping, the requested class is on that chain's forbidden list (Kind.Forbidden, reason E_FORBIDDEN_AWS_PROVIDER). Forbidden lists prevent loops and delegation problems - most notably AssumedRoleCredentialProvider may not appear inside the sub-chains it builds (fs.s3a.assumed.role.credentials.provider forbids itself).

Source

Thrown at hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/auth/CredentialProviderListFactory.java:243

    // each provider
    AWSCredentialProviderList providers = new AWSCredentialProviderList();
    for (String className : awsClasses) {
      if (v1v2CredentialProviderMap.containsKey(className)) {
        // mapping

        final String mapped = v1v2CredentialProviderMap.get(className);
        LOG_REMAPPED_ENTRY.warn("Credentials option {} contains AWS v1 SDK entry {}; mapping to {}",
            key, className, mapped);
        className = mapped;
      } else if (awsCredsMappedClasses != null && awsCredsMappedClasses.containsKey(className)) {
        final String mapped = awsCredsMappedClasses.get(className);
        LOG_REMAPPED_ENTRY.debug("Credential entry {} is mapped to {}", className, mapped);
        className = mapped;
      }
      // now scan the forbidden list. doing this after any mappings ensures the v1 names
      // are also blocked
      if (forbiddenClassnames.contains(className)) {
        throw new InstantiationIOException(InstantiationIOException.Kind.Forbidden,
            binding, className, key, E_FORBIDDEN_AWS_PROVIDER, null);
      }

      AwsCredentialsProvider provider;
      try {
        provider = createAWSV2CredentialProvider(conf, className, binding, key);
      } catch (InstantiationIOException e) {
        // failed to create a v2; try to see if it is a v1
        if (e.getKind() == InstantiationIOException.Kind.IsNotImplementation) {
          if (isAwsV1SdkAvailable()) {
            // try to create v1
            LOG.debug("Failed to create {} as v2 credentials, trying to instantiate as v1",
                className);
            try {
              provider =
                  AwsV1BindingSupport.createAWSV1CredentialProvider(conf, className, binding, key);
              LOG_REMAPPED_ENTRY.warn("Credentials option {} contains AWS v1 SDK entry {}",
                  key, className);

View on GitHub (pinned to 2add963021)

Solutions

1. Remove AssumedRoleCredentialProvider from the inner list (fs.s3a.assumed.role.credentials.provider) - only base providers (simple, environment, profile, instance profile) may feed STS
2. Read the error message: it names both the offending class and the configuration key that contained it
3. For role chaining, use IAM/STS trust policies instead of nesting S3A providers
4. Make sure classnames are spelled exactly and are AWS SDK v2 providers (v1 names are remapped with a warning)

Example fix

<!-- before: assumed-role provider nested inside its own inner chain -->
<property><name>fs.s3a.assumed.role.credentials.provider</name>
  <value>org.apache.hadoop.fs.s3a.auth.AssumedRoleCredentialProvider,
         org.apache.hadoop.fs.s3a.SimpleAWSCredentialsProvider</value></property>

<!-- after: only base providers feed STS -->
<property><name>fs.s3a.assumed.role.credentials.provider</name>
  <value>org.apache.hadoop.fs.s3a.SimpleAWSCredentialsProvider</value></property>

for (String c : conf.getTrimmedStrings("fs.s3a.assumed.role.credentials.provider")) {
  if (c.endsWith("AssumedRoleCredentialProvider")) {
    throw new IOException("Forbidden provider in inner chain: " + c);
  }
}

catch InstantiationIOException at fs initialization; the message names the class and the configuration key - remove the forbidden entry from that property; never retry

When it happens

Trigger: Listing a forbidden class where a sub-chain is built: org.apache.hadoop.fs.s3a.auth.AssumedRoleCredentialProvider inside fs.s3a.assumed.role.credentials.provider (nested assumed roles), or forbidden entries in the session-token binding's chain. The error names the class and the configuration key involved.

Common situations: Copying the full fs.s3a.aws.credentials.provider list into fs.s3a.assumed.role.credentials.provider; attempts to chain assumed roles through config; hadoop-aws upgrades where v1 provider names are remapped and forbidden lists changed.

Related errors

• Unset property fs.s3a.assumed.role.arn
• Cannot find password option {key}
• SSE-C is enabled but no encryption key was declared in fs.s3
• SimpleAWSCredentialsProvider: No AWS credentials in the Hado
• getCredentials failed: {e}

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/e96767a983d045dc. Report an issue: GitHub.