{"record":{"id":"4f291d83b1703422","repo":"apache/flink","slug":"invalid-assume-role-session-duration-s-for-buck","errorCode":null,"errorMessage":"Invalid assume-role.session-duration '%s' for bucket '%s'. Must be a valid integer (e.g., 3600)","messagePattern":"Invalid assume-role\\.session-duration '(.+?)' for bucket '(.+?)'\\. Must be a valid integer \\(e\\.g\\., 3600\\)","errorType":"validation","errorClass":"IllegalConfigurationException","httpStatus":null,"severity":"error","filePath":"flink-filesystems/flink-s3-fs-native/src/main/java/org/apache/flink/fs/s3native/BucketConfigProvider.java","lineNumber":69,"sourceCode":"\n    private static final Logger LOG = LoggerFactory.getLogger(BucketConfigProvider.class);\n    static final String BUCKET_CONFIG_PREFIX = \"s3.bucket.\";\n    static final Map<String, BiConsumer<S3BucketConfig.Builder, String>> PROPERTY_APPLICATORS;\n    static final List<String> KNOWN_PROPERTIES_BY_LENGTH;\n\n    static {\n        final Map<String, BiConsumer<S3BucketConfig.Builder, String>> applicators =\n                new LinkedHashMap<>();\n        applicators.put(\"access-key\", S3BucketConfig.Builder::accessKey);\n        applicators.put(\"assume-role.arn\", S3BucketConfig.Builder::assumeRoleArn);\n        applicators.put(\"assume-role.external-id\", S3BucketConfig.Builder::assumeRoleExternalId);\n        applicators.put(\n                \"assume-role.session-duration\",\n                (b, v) -> {\n                    try {\n                        b.assumeRoleSessionDurationSeconds(Integer.parseInt(v));\n                    } catch (NumberFormatException e) {\n                        throw new IllegalConfigurationException(\n                                String.format(\n                                        \"Invalid assume-role.session-duration '%s' for bucket '%s'. \"\n                                                + \"Must be a valid integer (e.g., 3600)\",\n                                        v, b.getBucketName()),\n                                e);\n                    }\n                });\n        applicators.put(\"assume-role.session-name\", S3BucketConfig.Builder::assumeRoleSessionName);\n        applicators.put(\"aws.credentials.provider\", S3BucketConfig.Builder::credentialsProvider);\n        applicators.put(\"endpoint\", S3BucketConfig.Builder::endpoint);\n        applicators.put(\n                \"path-style-access\",\n                (b, v) -> {\n                    if (!\"true\".equalsIgnoreCase(v) && !\"false\".equalsIgnoreCase(v)) {\n                        throw new IllegalConfigurationException(\n                                String.format(\n                                        \"Invalid path-style-access '%s' for bucket '%s'. \"\n                                                + \"Must be 'true' or 'false'\",","sourceCodeStart":51,"sourceCodeEnd":87,"githubUrl":"https://github.com/apache/flink/blob/2f3c205e9266cb30240eb7f4fdab15cad629a70f/flink-filesystems/flink-s3-fs-native/src/main/java/org/apache/flink/fs/s3native/BucketConfigProvider.java#L51-L87","documentation":"BucketConfigProvider throws IllegalConfigurationException when parsing the per-bucket property 'assume-role.session-duration' because Integer.parseInt failed. The value must be a plain integer number of seconds (e.g. 3600). The exception names both the bad value and the bucket, and chains the original NumberFormatException.","triggerScenarios":"Configuring a bucket entry with s3.bucket.<bucket>.assume-role.session-duration set to a non-integer such as '3600s', '1h', 'one hour', an empty string, or a value with whitespace.","commonSituations":"Users copy duration formats from other Flink options (like '10 s' style durations) or from AWS CLI examples; typos; trailing units; environment variable interpolation producing an empty string.","solutions":["Set the value to a bare integer of seconds, e.g. assume-role.session-duration: 3600.","Remove quotes/units/whitespace from the value in the bucket config file or flink-conf.","Confirm IAM role constraints: AWS accepts 900..43200 seconds, so use an integer inside that range."],"exampleFix":"# before\ns3.bucket.my-bucket.assume-role.session-duration: 1h\n\n# after\ns3.bucket.my-bucket.assume-role.session-duration: 3600","handlingStrategy":"validation","validationCode":"static int parseSessionDuration(String raw, String bucket) {\n    String v = raw == null ? null : raw.trim();\n    if (v == null || !v.matches(\"\\\\d+\")) {\n        throw new IllegalArgumentException(\"assume-role.session-duration for '\" + bucket + \"' must be an integer like 3600, got: \" + raw);\n    }\n    int seconds = Integer.parseInt(v);\n    if (seconds < 900 || seconds > 43200) {\n        throw new IllegalArgumentException(\"session duration must be within 900..43200 seconds\");\n    }\n    return seconds;\n}","typeGuard":null,"tryCatchPattern":"try {\n    Integer.parseInt(config.get(\"assume-role.session-duration\"));\n} catch (NumberFormatException e) {\n    // surface a clear config error before job submission, pointing at the bucket entry\n}","preventionTips":["Use bare integers in seconds for AWS session durations; never '1h'/'30m' style.","Add config linting in CI that validates all s3.bucket.*.assume-role.* values parse.","Remember the AWS-valid range is 900-43200 seconds."],"tags":["s3","configuration","assume-role","validation"],"backgroundTag":null,"analyzedSha":"2f3c205e9266cb30240eb7f4fdab15cad629a70f","analyzedAt":"2026-08-14T08:48:24.518Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}