{"record":{"id":"4e776333085ab3e4","repo":"pentaho/pentaho-kettle","slug":"filesystemexception-wrapping-sdkclientexception","errorCode":null,"errorMessage":"FileSystemException wrapping SdkClientException","messagePattern":"FileSystemException wrapping SdkClientException","errorType":"exception","errorClass":"FileSystemException","httpStatus":null,"severity":"error","filePath":"plugins/s3-vfs/core/src/main/java/org/pentaho/amazon/s3/S3VfsFileChooserBaseDialog.java","lineNumber":125,"sourceCode":"      String accessKey = \"\";\n      String secretKey = \"\";\n      /* For legacy transformations containing AWS S3 access credentials, {@link Const#KETTLE_USE_AWS_DEFAULT_CREDENTIALS} can force Spoon to use\n       * the Amazon Default Credentials Provider Chain instead of using the credentials embedded in the transformation metadata. */\n      if ( !ValueMetaBase.convertStringToBoolean( Const.NVL( EnvUtil.getSystemProperty( Const.KETTLE_USE_AWS_DEFAULT_CREDENTIALS ), \"N\" ) ) ) {\n        accessKey = System.getProperty( S3Util.ACCESS_KEY_SYSTEM_PROPERTY );\n        secretKey = System.getProperty( S3Util.SECRET_KEY_SYSTEM_PROPERTY );\n      } else {\n        AWSCredentials credentials = S3CredentialsProvider.getAWSCredentials();\n        if ( credentials != null ) {\n          accessKey = credentials.getAWSAccessKeyId();\n          secretKey = credentials.getAWSSecretKey();\n        }\n      }\n      StaticUserAuthenticator userAuthenticator = new StaticUserAuthenticator( null, secretKey, accessKey );\n      DefaultFileSystemConfigBuilder.getInstance().setUserAuthenticator( opts, userAuthenticator );\n\n    } catch ( SdkClientException e ) {\n      throw new FileSystemException( e );\n    }\n    return opts;\n  }\n\n  private VariableSpace getVariableSpace() {\n    if ( Spoon.getInstance().getActiveTransformation() != null ) {\n      return Spoon.getInstance().getActiveTransformation();\n    } else if ( Spoon.getInstance().getActiveJob() != null ) {\n      return Spoon.getInstance().getActiveJob();\n    } else {\n      return new Variables();\n    }\n  }\n}\n","sourceCodeStart":107,"sourceCodeEnd":140,"githubUrl":"https://github.com/pentaho/pentaho-kettle/blob/f3058517a153da500bf4551f46d79b91bf8ec552/plugins/s3-vfs/core/src/main/java/org/pentaho/amazon/s3/S3VfsFileChooserBaseDialog.java#L107-L140","documentation":"getFileSystemOptions builds commons-vfs FileSystemOptions for the S3 chooser, reading AWS credentials (which may trigger SdkClientException, e.g. from the AWS credentials chain). Because the method declares FileSystemException, SdkClientException is wrapped and rethrown. The root cause is the nested SdkClientException.","triggerScenarios":"resolveFile -> getFileSystemOptions where resolving AWS credentials (environment, profile, or the dialog's secret/access key fields) throws SdkClientException — e.g. no credentials found or profile file unreadable.","commonSituations":"No AWS credentials anywhere in the chain (env vars, ~/.aws/credentials, IAM role); malformed or unreadable AWS profile file; blank access/secret keys in the Spoon connection dialog; SDK version upgrade changing default credential chain behavior.","solutions":["Fix the AWS credential chain: set AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, repair ~/.aws/credentials, or enter keys in the dialog.","Check the nested SdkClientException message to see which credential source failed.","Verify the AWS profile name exists and the profile file has correct permissions.","Confirm the AWS SDK dependency versions are consistent after plugin upgrades."],"exampleFix":"// before\nStaticUserAuthenticator userAuthenticator = new StaticUserAuthenticator( null, secretKey, accessKey );\n// after: fail fast with a clear message when keys are absent\nif ( accessKey == null || secretKey == null ) {\n  throw new FileSystemException( \"AWS access/secret key is required to browse S3\" );\n}\nStaticUserAuthenticator userAuthenticator = new StaticUserAuthenticator( null, secretKey, accessKey );","handlingStrategy":"validation","validationCode":"// ensure credentials exist before building options\nboolean hasCreds = ( accessKey != null && secretKey != null )\n  || System.getenv( \"AWS_ACCESS_KEY_ID\" ) != null\n  || new java.io.File( System.getProperty( \"user.home\" ), \".aws/credentials\" ).exists();\nif ( !hasCreds ) throw new IllegalStateException( \"No AWS credentials found in chain\" );","typeGuard":null,"tryCatchPattern":"try {\n  FileSystemOptions opts = dialog.getFileSystemOptions();\n} catch ( org.apache.commons.vfs2.FileSystemException e ) {\n  Throwable cause = e.getCause();\n  if ( cause instanceof software.amazon.awssdk.core.exception.SdkClientException ) {\n    logError( \"AWS credential resolution failed: \" + cause.getMessage() );\n  }\n}","preventionTips":["Configure at least one credential source (env, profile, dialog fields)","Verify ~/.aws/credentials exists and is readable","Pin consistent AWS SDK versions in the plugin","Check the nested SdkClientException for the failing chain link"],"tags":["aws","s3","vfs","credentials"],"backgroundTag":"missing-credentials","analyzedSha":"f3058517a153da500bf4551f46d79b91bf8ec552","analyzedAt":"2026-09-13T14:04:16.340Z","contentChangedAt":"2026-09-13T14:04:16.340Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}