{"record":{"id":"268c7e3a0f8ff9e8","repo":"alibaba/spring-ai-alibaba","slug":"oss-ak-or-sk-should-be-set","errorCode":null,"errorMessage":"oss ak or sk should be set.","messagePattern":"oss ak or sk should be set\\.","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":500,"severity":"critical","filePath":"spring-ai-alibaba-admin/spring-ai-alibaba-admin-server-core/src/main/java/com/alibaba/cloud/ai/studio/core/base/manager/OssManager.java","lineNumber":277,"sourceCode":"\t\t}\n\t\tfinally {\n\t\t\tIOUtils.closeQuietly(is);\n\t\t\tIOUtils.closeQuietly(bos);\n\t\t\tIOUtils.closeQuietly(ossObject);\n\t\t}\n\t}\n\n\t@Override\n\tpublic void afterPropertiesSet() {\n\t\tif (!Objects.equals(properties.getUploadMethod(), UploadType.OSS.getValue())) {\n\t\t\treturn;\n\t\t}\n\n\t\tString ak = properties.getOss().getAccessKeyId();\n\t\tString sk = properties.getOss().getAccessKeySecret();\n\t\tString region = properties.getOss().getRegion();\n\t\tif (StringUtils.isBlank(ak) || StringUtils.isBlank(sk)) {\n\t\t\tthrow new IllegalArgumentException(\"oss ak or sk should be set.\");\n\t\t}\n\n\t\tcredentialsProvider = new DefaultCredentialProvider(ak, sk);\n\n\t\t// this is for public access like\n\t\tossClient = OSSClientBuilder.create()\n\t\t\t.endpoint(properties.getOss().getEndpoint())\n\t\t\t.credentialsProvider(credentialsProvider)\n\t\t\t.region(region)\n\t\t\t.build();\n\n\t\t// This is for vpc internet access\n\t\tossClientInternal = OSSClientBuilder.create()\n\t\t\t.endpoint(properties.getOss().getInternalEndpoint())\n\t\t\t.credentialsProvider(credentialsProvider)\n\t\t\t.region(region)\n\t\t\t.build();\n\t}","sourceCodeStart":259,"sourceCodeEnd":295,"githubUrl":"https://github.com/alibaba/spring-ai-alibaba/blob/f82da0b50f35744c13968191be2b1cd2452ef550/spring-ai-alibaba-admin/spring-ai-alibaba-admin-server-core/src/main/java/com/alibaba/cloud/ai/studio/core/base/manager/OssManager.java#L259-L295","documentation":"OssManager.afterPropertiesSet (a Spring InitializingBean callback) validates OSS configuration at bean startup and throws IllegalArgumentException('oss ak or sk should be set.') when the access key id or secret from properties.getOss() is blank. This fails application startup because the OSS client cannot be built without credentials.","triggerScenarios":"Application startup with spring-ai-alibaba studio config where oss.access-key-id or oss.access-key-secret is unset, empty, or only whitespace (e.g. env var not injected, YAML key misspelled, profile not activated).","commonSituations":"Deploying without the secret injected by the secret manager; renaming env vars so placeholders resolve to empty; running locally without application-local.yml; config server not returning the oss block.","solutions":["Set the OSS accessKeyId and accessKeySecret in your configuration (YAML properties oss.access-key-id / oss.access-key-secret)","Ensure the backing environment variables or secrets are actually injected into the runtime environment","Check that the active Spring profile/config source includes the oss block","Validate at deploy time with a startup config check to fail fast with a clear message"],"exampleFix":"// before (application.yml)\nspring:\n  ai:\n    alibaba:\n      studio:\n        oss:\n          region: cn-beijing\n// after\nspring:\n  ai:\n    alibaba:\n      studio:\n        oss:\n          region: cn-beijing\n          access-key-id: ${OSS_ACCESS_KEY_ID}\n          access-key-secret: ${OSS_ACCESS_KEY_SECRET}","handlingStrategy":"validation","validationCode":"// fail fast before Spring context starts\nOssProperties oss = props.getOss();\nif (oss.getAccessKeyId() == null || oss.getAccessKeyId().isBlank()\n    || oss.getAccessKeySecret() == null || oss.getAccessKeySecret().isBlank()) {\n    throw new IllegalStateException(\"Set oss.access-key-id and oss.access-key-secret\");\n}","typeGuard":"boolean ossCredentialsPresent(OssProperties oss) {\n    return oss != null && oss.getOss() != null\n        && notBlank(oss.getOss().getAccessKeyId())\n        && notBlank(oss.getOss().getAccessKeySecret());\n}","tryCatchPattern":"try {\n    applicationContext.refresh(); // or startup path that builds OssManager\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"oss ak or sk should be set\")) {\n        System.err.println(\"FATAL: OSS credentials missing; set OSS_ACCESS_KEY_ID/OSS_ACCESS_KEY_SECRET\");\n        System.exit(1);\n    }\n    throw e;\n}","preventionTips":["Manage OSS credentials via injected secrets, never hard-coded","Add a CI/deploy-time config lint that asserts required oss keys exist","Check env var names match the placeholders in application.yml","Verify the active Spring profile includes the oss config block"],"tags":["oss","configuration","startup","credentials"],"backgroundTag":"missing-credentials","analyzedSha":"f82da0b50f35744c13968191be2b1cd2452ef550","analyzedAt":"2026-09-09T15:32:42.421Z","contentChangedAt":"2026-09-09T15:32:42.421Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}