apache/iceberg · error · RuntimeException

Failed to create RRSA OSS client

Error message

Failed to create RRSA OSS client

What it means

After the RRSA credential provider is built, the OSS client itself is constructed with OSSClientBuilder. Any exception during client construction/first-time setup is wrapped as RuntimeException("Failed to create RRSA OSS client", e). It indicates the OSS client could not be created under RRSA auth.

Source

Thrown at aliyun/src/main/java/org/apache/iceberg/aliyun/AliyunClientFactories.java:165

                    if (cred.getExpiration() > 0) {
                      expirationSeconds =
                          (cred.getExpiration() - System.currentTimeMillis()) / 1000;
                    }
                    this.currentCredentials =
                        new BasicCredentials(
                            cred.getAccessKeyId(),
                            cred.getAccessKeySecret(),
                            cred.getSecurityToken(),
                            expirationSeconds);
                    return this.currentCredentials;
                  } catch (Exception e) {
                    throw new RuntimeException("Failed to get RRSA credentials", e);
                  }
                }
              };
          return new OSSClientBuilder().build(endpoint, ossCredProvider);
        } catch (Exception e) {
          throw new RuntimeException("Failed to create RRSA OSS client", e);
        }
      } else if (Strings.isNullOrEmpty(aliyunProperties.securityToken())) {
        return new OSSClientBuilder()
            .build(
                aliyunProperties.ossEndpoint(),
                aliyunProperties.accessKeyId(),
                aliyunProperties.accessKeySecret());
      } else {
        return new OSSClientBuilder()
            .build(
                aliyunProperties.ossEndpoint(),
                aliyunProperties.accessKeyId(),
                aliyunProperties.accessKeySecret(),
                aliyunProperties.securityToken());
      }
    }

    @Override

View on GitHub (pinned to 86d9c8fc54)

Solutions

1. Read the wrapped cause to see whether the endpoint or the credential provider failed; fix that first.
2. Verify oss.endpoint is a valid OSS regional endpoint (e.g. https://oss-cn-hangzhou.aliyuncs.com).
3. Confirm all RRSA properties are set consistently (provider ARN, role ARN, session name).
4. Test OSS connectivity from the host (DNS/firewall).

Example fix

// before
conf.set("oss.endpoint", "oss-cn-hangzhou");

// after
conf.set("oss.endpoint", "https://oss-cn-hangzhou.aliyuncs.com");

String ep = properties.get("oss.endpoint");
if (ep == null || !ep.matches("https?://oss-[a-z0-9-]+\.aliyuncs\.com")) {
  throw new IllegalArgumentException("oss.endpoint is not a valid OSS regional endpoint: " + ep);
}

When it happens

Trigger: newOSSClient invoked with RRSA enabled: invalid oss.endpoint value, OSSClientBuilder failing due to malformed endpoint URL, or the credential provider throwing during client initialization.

Common situations: Wrong endpoint region (e.g. missing https:// or wrong region domain); DNS resolution failure; RRSA properties partially set so provider construction half-fails.

Related errors

• Failed to get RRSA credentials
• Location already exists: %s
• Unable to load metrics class: '{}', falling back to null met
• Unclosed input stream created by: {}
• Failed to delete staging file: {}

AI-assisted analysis of apache/iceberg@86d9c8fc54 (2026-09-12). Data as JSON: /api/errors/5a4e6a9eb9ed4bea. Report an issue: GitHub.