apache/hadoop · error · NoAwsCredentialsException

{component}: No AWS credentials

Error message

{component}: No AWS credentials

What it means

NoAwsCredentialsException from MarshalledCredentialBinding.toAWSCredentials: the marshalled credential set is empty (access key and secret key both blank) when binding config/URI/delegation-token credentials into AWS SDK credentials. The component prefix names the caller (e.g. TemporaryAWSCredentialsProvider or a delegation-token binding); it is the generic 'nothing was supplied' signal on marshalling paths.

Source

Thrown at hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/auth/MarshalledCredentialBinding.java:165

   *
   * This code would seem to fit into (@link MarshalledCredentials}, and
   * while it would from a code-hygiene perspective, to keep all AWS
   * SDK references out of that class, the logic is implemented here instead,
   * @param marshalled marshalled credentials
   * @param typeRequired type of credentials required
   * @param component component name for exception messages.
   * @return a new set of credentials
   * @throws NoAuthWithAWSException validation failure
   * @throws NoAwsCredentialsException the credentials are actually empty.
   */
  public static AwsCredentials toAWSCredentials(
      final MarshalledCredentials marshalled,
      final MarshalledCredentials.CredentialTypeRequired typeRequired,
      final String component)
      throws NoAuthWithAWSException, NoAwsCredentialsException {

    if (marshalled.isEmpty()) {
      throw new NoAwsCredentialsException(component, NO_AWS_CREDENTIALS);
    }
    if (!marshalled.isValid(typeRequired)) {
      throw new NoAuthWithAWSException(component + ":" +
          marshalled.buildInvalidCredentialsError(typeRequired));
    }
    final String accessKey = marshalled.getAccessKey();
    final String secretKey = marshalled.getSecretKey();
    if (marshalled.hasSessionToken()) {
      // a session token was supplied, so return session credentials
      return AwsSessionCredentials.create(accessKey, secretKey,
          marshalled.getSessionToken());
    } else {
      // these are full credentials
      return AwsBasicCredentials.create(accessKey, secretKey);
    }
  }

  /**

View on GitHub (pinned to 2add963021)

Solutions

1. Supply credentials in a supported place: fs.s3a.access.key/fs.s3a.secret.key, URI userinfo, environment variables, or a Hadoop credential store
2. If credentials come from delegation tokens, verify the token was actually fetched and carries marshalled secrets
3. Otherwise change the chain to providers that can authenticate here (IAM instance profile, assumed role)
4. Use S3A logs/diagnostics to see which component reported the empty set

Example fix

<!-- before: chain demands marshalled credentials, none configured -->
<property><name>fs.s3a.aws.credentials.provider</name>
  <value>org.apache.hadoop.fs.s3a.TemporaryAWSCredentialsProvider</value></property>

<!-- after: supply the credential triple, or switch to a provider with a real source -->
<property><name>fs.s3a.access.key</name><value>ASIA...</value></property>
<property><name>fs.s3a.secret.key</name><value>...</value></property>
<property><name>fs.s3a.session.key</name><value>...</value></property>

String ak = conf.get("fs.s3a.access.key", "");
String envAk = System.getenv("AWS_ACCESS_KEY_ID");
boolean iamPossible = System.getenv("AWS_CONTAINER_CREDENTIALS_RELATIVE_URI") != null;
if (ak.isEmpty() && envAk == null && !iamPossible) {
  throw new IOException("No credential source configured for S3A"
      + " (no static keys, no env vars, no IAM metadata source)");
}

catch NoAwsCredentialsException at the first S3 call; treat as an environment/configuration gap - print which component reported it and fix the credential source; do not retry

When it happens

Trigger: Binding marshalled credentials where none exist: no fs.s3a.access.key/fs.s3a.secret.key, URI userinfo, environment variables, or credential store entries, while a provider that requires marshalled credentials (session/delegation paths) is in the chain; delegation tokens issued without marshalled secrets.

Common situations: Defaulting to the standard provider chain on a node with no credential source at all; delegation-token deployments where the token lacks credential secrets; config templates that strip credential properties in the name of hygiene.

Related errors

• SimpleAWSCredentialsProvider: No AWS credentials in the Hado
• Session credentials in Hadoop configuration: No AWS Credenti
• Cannot find password option {key}
• SSE-C is enabled but no encryption key was declared in fs.s3
• Provider {this} has no credentials: {initializationException

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/272f8e7b76b140b9. Report an issue: GitHub.