{"record":{"id":"532f6ad9eb133615","repo":"apache/flink","slug":"class-does-not-implement-awscredentialsprovider","errorCode":null,"errorMessage":"Class {} does not implement AwsCredentialsProvider","messagePattern":"Class (.+?) does not implement AwsCredentialsProvider","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"flink-filesystems/flink-s3-fs-native/src/main/java/org/apache/flink/fs/s3native/S3ClientProvider.java","lineNumber":921,"sourceCode":"                    chain.stream()\n                            .map(p -> p.getClass().getSimpleName())\n                            .collect(Collectors.joining(\" -> \")));\n\n            return AwsCredentialsProviderChain.builder().credentialsProviders(chain).build();\n        }\n\n        /**\n         * Instantiates an {@link AwsCredentialsProvider} from a class name. Accepts fully-qualified\n         * SDK v2 class names or simple names resolved from the {@code\n         * software.amazon.awssdk.auth.credentials} package (e.g. {@code\n         * AnonymousCredentialsProvider}).\n         */\n        private AwsCredentialsProvider instantiateCredentialsProvider(String className) {\n            String resolvedClassName = resolveProviderClassName(className);\n            try {\n                Class<?> clazz = Class.forName(resolvedClassName);\n                if (!AwsCredentialsProvider.class.isAssignableFrom(clazz)) {\n                    throw new IllegalArgumentException(\n                            \"Class \"\n                                    + resolvedClassName\n                                    + \" does not implement AwsCredentialsProvider\");\n                }\n\n                try {\n                    Method createMethod = clazz.getMethod(\"create\");\n                    if (Modifier.isStatic(createMethod.getModifiers())\n                            && AwsCredentialsProvider.class.isAssignableFrom(\n                                    createMethod.getReturnType())) {\n                        return (AwsCredentialsProvider) createMethod.invoke(null);\n                    }\n                } catch (NoSuchMethodException ignored) {\n                }\n\n                return (AwsCredentialsProvider) clazz.getDeclaredConstructor().newInstance();\n            } catch (Exception e) {\n                throw new IllegalArgumentException(","sourceCodeStart":903,"sourceCodeEnd":939,"githubUrl":"https://github.com/apache/flink/blob/2f3c205e9266cb30240eb7f4fdab15cad629a70f/flink-filesystems/flink-s3-fs-native/src/main/java/org/apache/flink/fs/s3native/S3ClientProvider.java#L903-L939","documentation":"instantiateCredentialsProvider() loads each class named in fs.s3.aws.credentials.provider (after resolveProviderClassName maps simple names to software.amazon.awssdk.auth.credentials.*). If the class loads but does not implement the AWS SDK v2 marker interface software.amazon.awssdk.auth.credentials.AwsCredentialsProvider, this IllegalArgumentException is thrown. It is a config-type error: the named class exists but is not usable as a credentials provider.","triggerScenarios":"Naming an SDK v1 provider (com.amazonaws.auth.InstanceProfileCredentialsProvider) in fs.s3.aws.credentials.provider; naming a user class that implements the v1 interface or merely exposes credentials; simple-name resolution picking an unrelated class with the same simple name in the awssdk package.","commonSituations":"Migrating configs from the presto/hadoop S3 filesystems or SDK v1 examples to the native SDK v2 filesystem; user companies with in-house v1 credential refreshers; typo'ing a simple name that accidentally matches another class in the awssdk credentials package.","solutions":["Use an SDK v2 provider implementing software.amazon.awssdk.auth.credentials.AwsCredentialsProvider, e.g. software.amazon.awssdk.auth.credentials.InstanceProfileCredentialsProvider or EnvironmentVariableCredentialsProvider.","Port custom providers to SDK v2: implement resolveCredentials() returning AwsCredentials (v2 types), not com.amazonaws.auth.AWSCredentialsProvider.","If you rely on session/STS chaining, wrap your logic in a v2 AwsCredentialsProvider implementation or use StsAssumeRoleCredentialsProvider (v2)."],"exampleFix":"# before (flink-conf.yaml) — SDK v1 class, fails\nfs.s3.aws.credentials.provider: com.amazonaws.auth.InstanceProfileCredentialsProvider\n\n# after — SDK v2 class\nfs.s3.aws.credentials.provider: software.amazon.awssdk.auth.credentials.InstanceProfileCredentialsProvider","handlingStrategy":"type-guard","validationCode":"// Validate each configured class implements the v2 interface before handing config to Flink\nstatic void checkProviderClasses(String csv) {\n    for (String n : csv.split(\",\")) {\n        String name = n.trim();\n        if (name.isEmpty()) continue;\n        String fqcn = name.contains(\".\") ? name : \"software.amazon.awssdk.auth.credentials.\" + name;\n        Class<?> c = Class.forName(fqcn);\n        if (!software.amazon.awssdk.auth.credentials.AwsCredentialsProvider.class.isAssignableFrom(c))\n            throw new IllegalArgumentException(fqcn + \" is not an SDK v2 AwsCredentialsProvider\");\n    }\n}","typeGuard":"static boolean isV2CredentialsProvider(String fqcn) { try { return AwsCredentialsProvider.class.isAssignableFrom(Class.forName(fqcn)); } catch (ClassNotFoundException e) { return false; } }","tryCatchPattern":null,"preventionTips":["Always use software.amazon.awssdk.* (v2) class names in this module's config; com.amazonaws.* (v1) names always fail.","When porting configs from hadoop-aws or presto filesystems, re-check every credential class name against the v2 javadoc.","Simple names are auto-resolved to software.amazon.awssdk.auth.credentials.* — use simple names only for built-ins."],"tags":["configuration","credentials","aws-sdk-v2","migration","s3","flink"],"backgroundTag":null,"analyzedSha":"2f3c205e9266cb30240eb7f4fdab15cad629a70f","analyzedAt":"2026-08-14T08:48:24.518Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}