{"record":{"id":"27e6672101f13803","repo":"dutchcoders/transfer.sh","slug":"access-key-not-set","errorCode":null,"errorMessage":"access-key not set.","messagePattern":"access-key not set\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/cmd.go","lineNumber":488,"sourceCode":"\t\tif ipWhitelist := c.String(\"ip-whitelist\"); ipWhitelist != \"\" {\n\t\t\tapplyIPFilter = true\n\t\t\tipFilterOptions.AllowedIPs = strings.Split(ipWhitelist, \",\")\n\t\t\tipFilterOptions.BlockByDefault = true\n\t\t}\n\n\t\tif ipBlacklist := c.String(\"ip-blacklist\"); ipBlacklist != \"\" {\n\t\t\tapplyIPFilter = true\n\t\t\tipFilterOptions.BlockedIPs = strings.Split(ipBlacklist, \",\")\n\t\t}\n\n\t\tif applyIPFilter {\n\t\t\toptions = append(options, server.FilterOptions(ipFilterOptions))\n\t\t}\n\n\t\tswitch provider := c.String(\"provider\"); provider {\n\t\tcase \"s3\":\n\t\t\tif accessKey := c.String(\"aws-access-key\"); accessKey == \"\" {\n\t\t\t\treturn errors.New(\"access-key not set.\")\n\t\t\t} else if secretKey := c.String(\"aws-secret-key\"); secretKey == \"\" {\n\t\t\t\treturn errors.New(\"secret-key not set.\")\n\t\t\t} else if bucket := c.String(\"bucket\"); bucket == \"\" {\n\t\t\t\treturn errors.New(\"bucket not set.\")\n\t\t\t} else if store, err := storage.NewS3Storage(c.Context, accessKey, secretKey, bucket, purgeDays, c.String(\"s3-region\"), c.String(\"s3-endpoint\"), c.Bool(\"s3-no-multipart\"), c.Bool(\"s3-path-style\"), logger); err != nil {\n\t\t\t\treturn err\n\t\t\t} else {\n\t\t\t\toptions = append(options, server.UseStorage(store))\n\t\t\t}\n\t\tcase \"gdrive\":\n\t\t\tchunkSize := c.Int(\"gdrive-chunk-size\") * 1024 * 1024\n\n\t\t\tif clientJSONFilepath := c.String(\"gdrive-client-json-filepath\"); clientJSONFilepath == \"\" {\n\t\t\t\treturn errors.New(\"gdrive-client-json-filepath not set.\")\n\t\t\t} else if localConfigPath := c.String(\"gdrive-local-config-path\"); localConfigPath == \"\" {\n\t\t\t\treturn errors.New(\"gdrive-local-config-path not set.\")\n\t\t\t} else if basedir := c.String(\"basedir\"); basedir == \"\" {\n\t\t\t\treturn errors.New(\"basedir not set.\")","sourceCodeStart":470,"sourceCodeEnd":506,"githubUrl":"https://github.com/dutchcoders/transfer.sh/blob/c37bfd95797fd6da8a6da53fc13d191994b3f687/cmd/cmd.go#L470-L506","documentation":"Thrown by the transfer.sh CLI when --provider s3 is selected but the --aws-access-key flag is empty. S3 storage requires credentials to sign requests, and the startup code validates all mandatory S3 flags (access key, secret key, bucket) in order before constructing the storage backend. The command exits immediately with this validation error instead of starting the server.","triggerScenarios":"Running with --provider s3 but no --aws-access-key value — omitted from the command line, missing in the systemd unit/Dockerfile, or supplied via an environment variable (e.g. AWS_ACCESS_KEY_ID) that the CLI does not consult.","commonSituations":"Container deployments where AWS env vars are present so the operator assumed credentials were configured; shared config snippets where the access-key line was removed for a gist; rotating credentials where the new key was never added to the service config.","solutions":["Add --aws-access-key <your-key> to the command line next to --provider s3","Also provide --aws-secret-key and --bucket since they are validated next and will fail with their own errors","If using env vars, export them explicitly into the flags or wrapper script (e.g. --aws-access-key \"$AWS_ACCESS_KEY_ID\")","Check the actual process arguments (ps, Docker inspect, systemd ExecStart) to confirm the flag is present and not empty due to shell quoting"],"exampleFix":"// before\ntransfer.sh --provider s3 --aws-secret-key secret --bucket uploads\n// after\ntransfer.sh --provider s3 --aws-access-key AKIAXXXXXXXX --aws-secret-key secret --bucket uploads","handlingStrategy":"validation","validationCode":"# verify required S3 flags before launch\n: \"${AWS_ACCESS_KEY_ID:?aws access key required}\"\nargs+=(--aws-access-key \"$AWS_ACCESS_KEY_ID\")","typeGuard":null,"tryCatchPattern":"if err := cmd.Root.Execute(); err != nil {\n  if strings.Contains(err.Error(), \"access-key not set\") {\n    log.Fatalf(\"S3 provider selected but --aws-access-key is missing\")\n  }\n  os.Exit(1)\n}","preventionTips":["When using --provider s3, always set access key, secret key, and bucket together","Inject credentials from a secret manager into the process args at startup","Lint deployment manifests for the presence of all three s3 flags"],"tags":["cli","configuration","s3","aws","startup-validation"],"backgroundTag":"missing-required-flag","analyzedSha":"c37bfd95797fd6da8a6da53fc13d191994b3f687","analyzedAt":"2026-09-05T10:21:07.548Z","contentChangedAt":"2026-09-05T10:21:07.548Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}