apache/seatunnel · error · java.lang.IllegalArgumentException

accessId and accesskey must be provided when sts_token is us

Error message

accessId and accesskey must be provided when sts_token is used.

What it means

MaxcomputeUtil.getAccount builds ODPS credentials from the job config. When an sts_token is supplied, the SDK also requires the matching accessId and accessKey (the STS temporary credentials' owner pair); if either is empty it throws IllegalArgumentException before any connection is attempted.

Source

Thrown at seatunnel-connectors-v2/connector-maxcompute/src/main/java/org/apache/seatunnel/connectors/seatunnel/maxcompute/util/MaxcomputeUtil.java:69

            tableTunnel.setEndpoint(readonlyConfig.get(MaxcomputeBaseOptions.TUNNEL_ENDPOINT));
        }
        if (StringUtils.isNotEmpty(readonlyConfig.get(MaxcomputeBaseOptions.TUNNEL_NAME))) {
            tableTunnel
                    .getConfig()
                    .setQuotaName(readonlyConfig.get(MaxcomputeBaseOptions.TUNNEL_NAME));
        }
        return tableTunnel;
    }

    public static Account getAccount(ReadonlyConfig readonlyConfig) {
        String stsToken = readonlyConfig.getOptional(MaxcomputeBaseOptions.STS_TOKEN).orElse(null);
        String accessId = readonlyConfig.getOptional(MaxcomputeBaseOptions.ACCESS_ID).orElse(null);
        String accessKey =
                readonlyConfig.getOptional(MaxcomputeBaseOptions.ACCESS_KEY).orElse(null);

        if (StringUtils.isNotEmpty(stsToken)) {
            if (StringUtils.isEmpty(accessId) || StringUtils.isEmpty(accessKey)) {
                throw new IllegalArgumentException(
                        "accessId and accesskey must be provided when sts_token is used.");
            }
            return new StsAccount(accessId, accessKey, stsToken);
        } else if (StringUtils.isNotEmpty(accessId) && StringUtils.isNotEmpty(accessKey)) {
            return new AliyunAccount(accessId, accessKey);
        } else {
            return new AklessAccount(new DefaultCredentialsProvider());
        }
    }

    public static Odps getOdps(ReadonlyConfig readonlyConfig) {
        Account account = getAccount(readonlyConfig);
        Odps odps = new Odps(account);
        odps.setEndpoint(readonlyConfig.get(MaxcomputeBaseOptions.ENDPOINT));
        odps.setDefaultProject(readonlyConfig.get(MaxcomputeBaseOptions.PROJECT));
        odps.setCurrentSchema(
                readonlyConfig.getOptional(MaxcomputeBaseOptions.SCHEMA_NAME).orElse(null));
        return odps;

View on GitHub (pinned to cf67b549a7)

Solutions

1. Add access_id and access_key alongside sts_token in the MaxCompute source/sink config.
2. If using environment-based credentials, verify the env vars are actually present in the runtime (container/task) environment.
3. If STS is not needed, remove sts_token so the plain accessId/accessKey path is used.
4. Check that the STS token was fetched together with its paired temporary AK/SK, not from a mismatched credential set.

Example fix

// before
Maxcompute {
  url = "..."
  sts_token = "..."
}
// after
Maxcompute {
  url = "..."
  access_id = "<sts-access-id>"
  access_key = "<sts-access-key>"
  sts_token = "..."
}

if (config.hasPath("sts_token") && !config.getString("sts_token").isEmpty()) {
    if (!config.hasPath("access_id") || config.getString("access_id").isEmpty()
        || !config.hasPath("access_key") || config.getString("access_key").isEmpty()) {
        throw new IllegalArgumentException("access_id and access_key are required with sts_token");
    }
}

boolean stsCredentialsComplete(Map<String,String> cfg) {
    boolean hasSts = cfg.get("sts_token") != null && !cfg.get("sts_token").isEmpty();
    boolean hasAk = cfg.get("access_id") != null && !cfg.get("access_id").isEmpty()
                 && cfg.get("access_key") != null && !cfg.get("access_key").isEmpty();
    return !hasSts || hasAk;
}

try {
    Account account = MaxcomputeUtil.account(readonlyConfig);
} catch (IllegalArgumentException e) {
    throw new ConfigException("MaxCompute credential config incomplete: " + e.getMessage());
}

When it happens

Trigger: Calling getAccount (via account()) with MaxcomputeBaseOptions.STS_TOKEN (or equivalent auth token) set in readonlyConfig while ACCESS_ID or ACCESS_KEY is null/empty.

Common situations: Users configure only an STS token thinking it is sufficient for authentication; partial copy-paste of Aliyun credential config; credentials supplied via env vars that are unset in the runtime environment.

Related errors

• Option '${valuesAndOptions[index + 1]}' is not valid for the
• AzureCosmosDB requires key, primary_key, secondary_key, or a
• Invalid user/password specified
• The GCS service_account_key_file option must not be blank
• Cannot resolve insert strategy: [%s]. Supported values are:

AI-assisted analysis of apache/seatunnel@cf67b549a7 (2026-09-10). Data as JSON: /api/errors/8c746c320a1bbfe9. Report an issue: GitHub.