{"record":{"id":"60f4f81b2078d221","repo":"risingwavelabs/risingwave","slug":"missing-aws-credentials-provider","errorCode":null,"errorMessage":"missing aws credentials_provider","messagePattern":"missing aws credentials_provider","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/connector/src/source/kafka/client_context.rs","lineNumber":67,"sourceCode":"    /// Credential and region for AWS MSK\n    auth: Option<IamAuthEnv>,\n}\n\nimpl KafkaContextCommon {\n    pub async fn new(\n        broker_rewrite_map: Option<BTreeMap<String, String>>,\n        identifier: Option<String>,\n        metrics: Option<Arc<RdKafkaStats>>,\n        auth: AwsAuthProps,\n        is_aws_msk_iam: bool,\n    ) -> ConnectorResult<Self> {\n        let addr_rewriter =\n            BrokerAddrRewriter::new(PrivateLinkContextRole::Consumer, broker_rewrite_map)?;\n        let auth = if is_aws_msk_iam {\n            let config = auth.build_config().await?;\n            let credentials_provider = config\n                .credentials_provider()\n                .ok_or_else(|| anyhow!(\"missing aws credentials_provider\"))?;\n            let region = config\n                .region()\n                .ok_or_else(|| anyhow!(\"missing aws region\"))?\n                .clone();\n            Some(IamAuthEnv {\n                credentials_provider,\n                region,\n                signer_timeout_sec: auth\n                    .msk_signer_timeout_sec\n                    .unwrap_or(Self::default_msk_signer_timeout_sec()),\n            })\n        } else {\n            None\n        };\n        Ok(Self {\n            addr_rewriter,\n            identifier,\n            metrics,","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/connector/src/source/kafka/client_context.rs#L49-L85","documentation":"When creating a Kafka source/sink with AWS MSK IAM authentication enabled, RisingWave builds an AWS SDK config and expects it to contain a credentials provider. If `build_config()` produced a config with no resolvable credentials, this error aborts context creation because IAM SASL/OAUTHBEARER signing is impossible without credentials.","triggerScenarios":"Creating a KafkaContextCommon with `is_aws_msk_iam=true` while the AwsAuthProps carry no usable credentials (no access_key/secret_key, no session_token where required, no profile, and no instance/IRSA role available).","commonSituations":"User sets `aws.auth.msk_iam = true` but forgets access/secret keys; running outside AWS (e.g. on-prem) where the default credential chain finds nothing; typo in the AWS profile name; IAM auth configured for an MSK cluster without any credentials source.","solutions":["Provide explicit credentials in the WITH options: set `aws.credentials.access_key_id`, `aws.credentials.secret_access_key` (and `aws.credentials.session_token` for temporary creds) alongside `aws.auth.msk_iam = true`","If relying on environment/instance credentials, verify the node runs where the default AWS credential chain resolves (env vars, ~/.aws/credentials, IMDS/IRSA) and the region is set (`aws.region` option)","Ensure the configured AWS profile exists and is readable; try the same credentials with `aws sts get-caller-identity` to confirm they resolve"],"exampleFix":"// before\nCREATE SOURCE s WITH (\n  connector='kafka',\n  aws.auth.msk_iam='true'\n) ...\n// after\nCREATE SOURCE s WITH (\n  connector='kafka',\n  aws.auth.msk_iam='true',\n  aws.region='us-east-1',\n  aws.credentials.access_key_id='AKIA...',\n  aws.credentials.secret_access_key='...'\n) ...","handlingStrategy":"validation","validationCode":"if msk_iam && (access_key_id.is_none() || secret_access_key.is_none()) && !ambient_aws_creds_available() {\n    return Err(\"msk_iam requires explicit aws.credentials.access_key_id/secret_access_key or a resolvable default credential chain\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always set aws.region when enabling aws.auth.msk_iam","Pass explicit access/secret keys unless running inside AWS with a known role profile","Test credential resolution with `aws sts get-caller-identity` on the deployment environment"],"tags":["kafka","aws","msk","iam","authentication"],"backgroundTag":"missing-credentials","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}