{"record":{"id":"41192026aa586d26","repo":"apache/hadoop","slug":"session-credentials-in-hadoop-configuration-no-aw","errorCode":null,"errorMessage":"Session credentials in Hadoop configuration: No AWS Credentials","messagePattern":"Session credentials in Hadoop configuration: No AWS Credentials","errorType":"exception","errorClass":"NoAwsCredentialsException","httpStatus":null,"severity":"error","filePath":"hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/TemporaryAWSCredentialsProvider.java","lineNumber":100,"sourceCode":"  /**\n   * The credentials here must include a session token, else this operation\n   * will raise an exception.\n   * @param config the configuration\n   * @return temporary credentials.\n   * @throws IOException on any failure to load the credentials.\n   * @throws NoAuthWithAWSException validation failure\n   * @throws NoAwsCredentialsException the credentials are actually empty.\n   */\n  @Override\n  protected AwsCredentials createCredentials(Configuration config)\n      throws IOException {\n    MarshalledCredentials creds = MarshalledCredentialBinding.fromFileSystem(\n        getUri(), config);\n    MarshalledCredentials.CredentialTypeRequired sessionOnly\n        = MarshalledCredentials.CredentialTypeRequired.SessionOnly;\n    // treat only having non-session creds as empty.\n    if (!creds.isValid(sessionOnly)) {\n      throw new NoAwsCredentialsException(COMPONENT);\n    }\n    return MarshalledCredentialBinding.toAWSCredentials(creds,\n        sessionOnly, COMPONENT);\n  }\n\n}\n","sourceCodeStart":82,"sourceCodeEnd":107,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/TemporaryAWSCredentialsProvider.java#L82-L107","documentation":"NoAwsCredentialsException thrown by TemporaryAWSCredentialsProvider.createCredentials: the marshalled credentials read from configuration are not valid SessionOnly credentials. The provider reads fs.s3a.access.key/fs.s3a.secret.key/fs.s3a.session.key and deliberately treats having only long-term (non-session) credentials as empty, so a missing session token is the usual cause.","triggerScenarios":"fs.s3a.aws.credentials.provider includes TemporaryAWSCredentialsProvider but fs.s3a.session.key is unset/blank; or only long-term access/secret keys are present, which fails the SessionOnly validation.","commonSituations":"Default provider chain left in place after switching to static keys; STS session credentials pasted incompletely (access+secret but no token); token stored in a credential store entry missing on some nodes; expired session where only the token was refreshed.","solutions":["Provide all three properties: fs.s3a.access.key, fs.s3a.secret.key, and fs.s3a.session.key (the STS session token)","If you do not use session tokens, remove TemporaryAWSCredentialsProvider from fs.s3a.aws.credentials.provider","If tokens expire, refresh them into the credential store or config on a schedule","Check per-bucket overrides that may define the provider without the session key"],"exampleFix":"<!-- before: session provider in the chain, token missing -->\n<property><name>fs.s3a.aws.credentials.provider</name>\n  <value>org.apache.hadoop.fs.s3a.TemporaryAWSCredentialsProvider</value></property>\n\n<!-- after: the full session triple -->\n<property><name>fs.s3a.access.key</name><value>ASIA...</value></property>\n<property><name>fs.s3a.secret.key</name><value>...</value></property>\n<property><name>fs.s3a.session.key</name><value>FQoG...</value></property>","handlingStrategy":"validation","validationCode":"if (conf.get(\"fs.s3a.aws.credentials.provider\", \"\")\n    .contains(\"TemporaryAWSCredentialsProvider\")) {\n  String ak = conf.get(\"fs.s3a.access.key\", \"\");\n  String sk = conf.get(\"fs.s3a.secret.key\", \"\");\n  String st = conf.get(\"fs.s3a.session.key\", \"\");\n  if (ak.isEmpty() || sk.isEmpty() || st.isEmpty()) {\n    throw new IOException(\"TemporaryAWSCredentialsProvider needs access key,\"\n        + \" secret key AND session key\");\n  }\n}","typeGuard":null,"tryCatchPattern":"catch NoAwsCredentialsException from TemporaryAWSCredentialsProvider; it means session-credentials are incomplete - fix or drop the provider from the chain; not retryable unless tokens were mid-refresh","preventionTips":["Treat access+secret+session as one atomic set when templating configs","Automate STS token refresh into the credential store before expiry","Remove unused providers from the chain when changing the auth model"],"tags":["s3a","hadoop-aws","credentials","session-token","sts","authentication"],"backgroundTag":"missing-aws-credentials","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}