apache/hadoop · error · CredentialInitializationException

Provider {this} has no credentials: {initializationException

Error message

Provider {this} has no credentials: {initializationException}

What it means

CredentialInitializationException from AbstractSessionCredentialsProvider.resolveCredentials(): initialization ran (or previously failed) but awsCredentials is still null, so the message embeds the recorded initializationException for diagnosis. Subclasses such as IAMInstanceCredentialsProvider load credentials lazily from the EC2/ECS metadata service; this is the 'tried and got nothing' outcome.

Source

Thrown at hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/auth/AbstractSessionCredentialsProvider.java:133

   * @throws SdkException if one was raised during init
   * @throws CredentialInitializationException on other failures.
   */
  public AwsCredentials resolveCredentials() throws SdkException {
    // do an on-demand init then raise an AWS SDK exception if
    // there was a failure.
    try {
      if (!isInitialized()) {
        init();
      }
    } catch (IOException e) {
      if (e.getCause() instanceof SdkException) {
        throw (SdkException) e.getCause();
      } else {
        throw new CredentialInitializationException(e.getMessage(), e);
      }
    }
    if (awsCredentials == null) {
      throw new CredentialInitializationException(
          "Provider " + this + " has no credentials: " +
             (initializationException != null ? initializationException.toString() : ""),
          initializationException);
    }
    return awsCredentials;
  }

  public final boolean hasCredentials() {
    return awsCredentials != null;
  }

  @Override
  public String toString() {
    return getClass().getSimpleName();
  }

  /**
   * Get any IOE raised during initialization.

View on GitHub (pinned to 2add963021)

Solutions

Read the embedded initializationException in the message - it carries the root cause (timeout, 404 from IMDS, access denied)
On EC2, attach an IAM instance profile and verify IMDS: curl http://169.254.169.254/latest/meta-data/iam/security-credentials/
For IMDSv2 in containers, raise the metadata hop limit to 2 or fix token settings
Where metadata access is impossible, switch to explicit credentials or the assumed-role provider

Example fix

# before: provider relies on IMDS but the node has no role / IMDS blocked
fs.s3a.aws.credentials.provider=org.apache.hadoop.fs.s3a.auth.IAMInstanceCredentialsProvider

# after: attach a role to the instance (run once per node)
aws ec2 associate-iam-instance-profile \
  --instance-id i-0123456789abcdef0 \
  --iam-instance-profile Name=s3-access-role

Defensive patterns

Strategy: retry

Validate before calling

// Preflight on EC2: the metadata service must serve role credentials
HttpURLConnection c = (HttpURLConnection) new URL(
    "http://169.254.169.254/latest/meta-data/iam/security-credentials/")
    .openConnection();
c.setConnectTimeout(2000);
if (c.getResponseCode() != 200) {
  throw new IOException("No instance-role credentials reachable via IMDS");
}

Try / catch

catch CredentialInitializationException (an SdkException surfacing at client build); inspect the embedded initializationException - retry once after a short delay for transient IMDS hiccups, otherwise fail with infrastructure guidance

Prevention

Attach IAM roles to every node that touches S3
Keep IMDS reachable: correct hop limit for containerized workloads
Where IMDS is flaky, prefer the assumed-role provider with static base credentials

When it happens

Trigger: The provider's init() failed to fetch credentials - IMDS/EC2 metadata service unreachable or timing out, no instance role attached, STS errors - and resolveCredentials() is then asked for credentials during S3 client construction.

Common situations: EC2 nodes without an attached instance profile; IMDS blocked by security groups, proxies, or IMDSv2 hop-limit problems (common in containers); metadata service throttling or transient outages at refresh time.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/7c96fd32b07aec24. Report an issue: GitHub.