apache/hadoop · error · InstantiationIOException

Class {className} {e} (configuration key fs.s3a.http.signer.

Error message

Class {className} {e} (configuration key fs.s3a.http.signer.class)

What it means

SignerFactory.createHttpSigner loads the class named by fs.s3a.http.signer.class and instantiates it reflectively with clazz.newInstance(). If instantiation fails (InstantiationException for abstract/interface classes or missing no-arg constructor, IllegalAccessException for non-public class/constructor) it throws InstantiationIOException with Kind.InstantiationFailure, carrying the class name, the config key, and the original exception. The signer chosen here produces the AuthScheme used to sign S3 requests.

Source

Thrown at hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/auth/SignerFactory.java:187

   * @param scheme scheme to bond to
   * @param configKey configuration key
   * @return the auth scheme
   * @throws InstantiationIOException failure to instantiate
   * @throws IllegalStateException if the signer class is not defined
   * @throws RuntimeException other configuration problems
   */
  public static AuthScheme<AwsCredentialsIdentity> createHttpSigner(
      Configuration conf, String scheme, String configKey) throws IOException {

    final Class<? extends HttpSigner> clazz = conf.getClass(HTTP_SIGNER_CLASS_NAME,
        null, HttpSigner.class);
    checkState(clazz != null, "No http signer class defined in %s", configKey);
    LOG.debug("Creating http signer {} from {}", clazz, configKey);
    try {
      return createAuthScheme(scheme, clazz.newInstance());

    } catch (InstantiationException | IllegalAccessException e) {
      throw new InstantiationIOException(
          InstantiationIOException.Kind.InstantiationFailure,
          null,
          clazz.getName(),
          HTTP_SIGNER_CLASS_NAME,
          e.toString(),
          e);
    }
  }

}

View on GitHub (pinned to 2add963021)

Solutions

  1. Give the signer class a public no-arg constructor and make the class itself public and concrete, implementing org.apache.hadoop.fs.s3a.auth.HttpSigner
  2. Move any configuration the signer needs out of the constructor into the initialize/configuration phase the factory drives
  3. Verify the FQCN in fs.s3a.http.signer.class is spelled exactly and resolvable on every client classpath
  4. Read the chained cause (toString in the message): IllegalAccessException means an access problem, InstantiationException means abstract/interface or no usable constructor

Example fix

// before: only an argument-taking constructor -> InstantiationException
public class MySigner implements HttpSigner {
  public MySigner(S3AInstrumentation stats) { ... }
}

// after: public nullary constructor, configure later
public class MySigner implements HttpSigner {
  public MySigner() { }
  @Override public void initialize(Configuration conf) { ... }
}
Defensive patterns

Strategy: validation

Validate before calling

String cn = conf.getTrimmed("fs.s3a.http.signer.class", "");
if (!cn.isEmpty()) {
  Class<?> c = Class.forName(cn);
  int m = c.getModifiers();
  boolean concrete = !Modifier.isAbstract(m) && !Modifier.isInterface(m);
  boolean noArg = Arrays.stream(c.getConstructors()).anyMatch(k -> k.getParameterCount() == 0);
  if (!HttpSigner.class.isAssignableFrom(c) || !concrete || !noArg) {
    throw new IOException(cn + " must be a public concrete HttpSigner with a public no-arg constructor");
  }
}

Type guard

static boolean isInstantiableHttpSigner(Class<?> c) {
  return HttpSigner.class.isAssignableFrom(c)
      && !Modifier.isAbstract(c.getModifiers())
      && !Modifier.isInterface(c.getModifiers())
      && Arrays.stream(c.getConstructors()).anyMatch(k -> k.getParameterCount() == 0);
}

Try / catch

try {
  AuthScheme<AwsCredentialsIdentity> scheme =
      SignerFactory.createHttpSigner(conf, scheme, "fs.s3a.http.signer.class");
} catch (InstantiationIOException e) {
  // construction defect in the configured signer: fix config/class, do not retry
  LOG.error("signer {} could not be instantiated: {}", e.getClassName(), e.getCause());
  throw e;
}

Prevention

When it happens

Trigger: fs.s3a.http.signer.class points at an abstract class, an interface, a class whose only constructors take arguments, or a non-public class. The failure happens at S3A client initialization, before any request is signed.

Common situations: Custom HttpSigner implementation written with a configuration-taking constructor instead of a nullary one; class not made public; deployment jars where a shading/relocation step changed accessibility; Hadoop upgrade that changed the HttpSigner interface so old custom signers no longer link.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/b1feaab05d5329d8. Report an issue: GitHub.