{"record":{"id":"07f06bcfe4d0609a","repo":"home-assistant/core","slug":"invalid-credentials","errorCode":"invalid_credentials","errorMessage":"Bucket cannot be accessed using provided combination of access key ID and secret access key.","messagePattern":"Bucket cannot be accessed using provided combination of access key ID and secret access key\\.","errorType":"exception","errorClass":"ConfigEntryError","httpStatus":null,"severity":"error","filePath":"homeassistant/components/aws_s3/__init__.py","lineNumber":43,"sourceCode":"_LOGGER = logging.getLogger(__name__)\n\n\nasync def async_setup_entry(hass: HomeAssistant, entry: S3ConfigEntry) -> bool:\n    \"\"\"Set up S3 from a config entry.\"\"\"\n\n    data = cast(dict, entry.data)\n    try:\n        session = AioSession()\n        # pylint: disable-next=unnecessary-dunder-call\n        client = await session.create_client(\n            \"s3\",\n            endpoint_url=data.get(CONF_ENDPOINT_URL),\n            aws_secret_access_key=data[CONF_SECRET_ACCESS_KEY],\n            aws_access_key_id=data[CONF_ACCESS_KEY_ID],\n        ).__aenter__()\n        await client.head_bucket(Bucket=data[CONF_BUCKET])\n    except ClientError as err:\n        raise ConfigEntryError(\n            translation_domain=DOMAIN,\n            translation_key=\"invalid_credentials\",\n        ) from err\n    except ParamValidationError as err:\n        if \"Invalid bucket name\" in str(err):\n            raise ConfigEntryError(\n                translation_domain=DOMAIN,\n                translation_key=\"invalid_bucket_name\",\n            ) from err\n    except ValueError as err:\n        raise ConfigEntryError(\n            translation_domain=DOMAIN,\n            translation_key=\"invalid_endpoint_url\",\n        ) from err\n    except ConnectionError as err:\n        raise ConfigEntryNotReady(\n            translation_domain=DOMAIN,\n            translation_key=\"cannot_connect\",","sourceCodeStart":25,"sourceCodeEnd":61,"githubUrl":"https://github.com/home-assistant/core/blob/58a3fdb3ea0538617f0a07efcfba6294de64fd59/homeassistant/components/aws_s3/__init__.py#L25-L61","documentation":"Raised as ConfigEntryError (translation_key invalid_credentials) by the aws_s3 integration when session.create_client(...).head_bucket(Bucket=...) raises botocore ClientError — AWS rejected the access key ID / secret pair, or the key has no permission on the bucket. ConfigEntryError marks the entry as errored (no automatic retry) and surfaces a translated message to the user.","triggerScenarios":"head_bucket with the configured access key ID and secret returns 403 InvalidAccessKeyId / SignatureDoesNotMatch / AccessDenied: wrong keys, deleted IAM user, or an IAM policy lacking s3:ListBucket/GetBucketLocation on the target bucket.","commonSituations":"Typo pasting keys; rotated/deleted access keys; IAM policy missing s3:HeadBucket permission; keys from a different AWS account than the bucket owner.","solutions":["Re-enter the access key ID and secret in the aws_s3 config entry (reconfigure/re-auth flow) and verify they are exact, with no trailing whitespace.","Test the same keys with aws s3api head-bucket --bucket <name> — if that also fails, fix IAM.","Grant the IAM principal s3:ListBucket (and s3:GetBucketLocation) on the bucket in its policy.","If the key belongs to another account, add a bucket policy allowing it, or use keys from the bucket-owning account."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"import re\n\ndef keys_well_formed(access_key_id: str, secret: str) -> bool:\n    return bool(re.fullmatch(r\"[A-Z0-9]{16,128}\", access_key_id or \"\")) and len(secret or \"\") >= 16\n","typeGuard":null,"tryCatchPattern":"from botocore.exceptions import ClientError\n\ntry:\n    await client.head_bucket(Bucket=bucket)\nexcept ClientError as err:\n    code = err.response[\"Error\"][\"Code\"]\n    if code in (\"InvalidAccessKeyId\", \"SignatureDoesNotMatch\", \"AccessDenied\"):\n        # credentials/permission problem — do not retry\n        raise","preventionTips":["Verify keys with aws s3api head-bucket before configuring the integration.","Grant s3:ListBucket on the exact bucket ARN in the IAM policy.","Re-enter credentials on rotation; avoid shared keys across services."],"tags":["home-assistant","aws","s3","iam","credentials","config-entry"],"backgroundTag":null,"analyzedSha":"58a3fdb3ea0538617f0a07efcfba6294de64fd59","analyzedAt":"2026-08-14T20:54:38.818Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}