{"record":{"id":"2c0019d42bc09378","repo":"apache/beam","slug":"snowflake-credentials-are-not-set-correctly","errorCode":null,"errorMessage":"Snowflake credentials are not set correctly.","messagePattern":"Snowflake credentials are not set correctly\\.","errorType":"validation","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"sdks/python/apache_beam/io/snowflake.py","lineNumber":488,"sourceCode":"  before writing to it.\n  \"\"\"\n  APPEND = 'APPEND'\n  EMPTY = 'EMPTY'\n  TRUNCATE = 'TRUNCATE'\n\n  @staticmethod\n  def VerifyParam(field):\n    if field and not hasattr(WriteDisposition, field):\n      raise RuntimeError(\n          'Write disposition has to be one of the following values:'\n          'APPEND, EMPTY, TRUNCATE. Got: {}'.format(field))\n\n\ndef verify_credentials(\n    username, password, private_key_path, raw_private_key, o_auth_token):\n  if not (o_auth_token or (username and password) or\n          (username and (private_key_path or raw_private_key))):\n    raise RuntimeError('Snowflake credentials are not set correctly.')\n","sourceCodeStart":470,"sourceCodeEnd":489,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/python/apache_beam/io/snowflake.py#L470-L489","documentation":"The Snowflake connector's verify_credentials() enforces that exactly one complete credential scheme is present: an OAuth token, a username+password pair, or a username plus a private key (file path or raw PEM contents). It raises RuntimeError when none of these combinations is satisfied, since Snowflake cannot authenticate without one.","triggerScenarios":"Calling WriteToSnowflake/ReadFromSnowflake with username but no password or private key, with a private key path but no username, or with all credentials None.","commonSituations":"Missing environment variables in CI, pointing at a private_key_path that was never configured, providing only an OAuth token without the rest being validated, or partial config migrations.","solutions":["Provide one complete scheme: o_auth_token, or username+password, or username+private_key_path/raw_private_key","Check that environment variables/options are actually set at runtime, not just defined","If using key-pair auth, pass both username and private_key_path (or raw_private_key contents)","Never mix schemes unnecessarily — ensure the intended scheme's values are not None/empty strings"],"exampleFix":"// before\nWriteToSnowflake(username='user')  # no password or key\n// after\nWriteToSnowflake(username='user', private_key_path='/path/to/key.p8')","handlingStrategy":"validation","validationCode":"def snowflake_credentials_ok(username, password, private_key_path, raw_private_key, o_auth_token):\n    return bool(o_auth_token or (username and password) or (username and (private_key_path or raw_private_key)))","typeGuard":"def has_complete_credential_scheme(u, p, k, r, o):\n    return bool(o) or bool(u and p) or bool(u and (k or r))","tryCatchPattern":"try:\n    transform = snowflake.WriteToSnowflake(**creds)\nexcept RuntimeError as e:\n    raise RuntimeError('Configure OAuth, password, or key-pair credentials for Snowflake') from e","preventionTips":["Validate all credential env vars are non-empty at pipeline startup","Provide exactly one full scheme (token, password, or key pair)","Fail fast with a clear message before launching the pipeline"],"tags":["apache-beam","python","snowflake","credentials"],"backgroundTag":"missing-credentials","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-20T03:17:13.778Z"}