{"record":{"id":"639bea7324b0a65d","repo":"dotnet/orleans","slug":"aws-named-profile-this-profilename-provided","errorCode":null,"errorMessage":"AWS named profile '{this._profileName}' provided, but credentials could not be retrieved","messagePattern":"AWS named profile '(.+?)' provided, but credentials could not be retrieved","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/AWS/Shared/Storage/DynamoDBStorage.cs","lineNumber":176,"sourceCode":"                var credentials = new BasicAWSCredentials(this._accessKey, this.secretKey);\n                this._ddbClient = new AmazonDynamoDBClient(credentials, new AmazonDynamoDBConfig { RegionEndpoint = AWSUtils.GetRegionEndpoint(this._service) });\n            }\n            else if (!string.IsNullOrEmpty(this._profileName))\n            {\n                // AWS DynamoDB instance (auth via explicit credentials and token found in a named profile)\n                var chain = new CredentialProfileStoreChain();\n                if (chain.TryGetAWSCredentials(this._profileName, out var credentials))\n                {\n                    this._ddbClient = new AmazonDynamoDBClient(\n                        credentials,\n                        new AmazonDynamoDBConfig\n                        {\n                            RegionEndpoint = AWSUtils.GetRegionEndpoint(this._service)\n                        });\n                }\n                else\n                {\n                    throw new InvalidOperationException(\n                        $\"AWS named profile '{this._profileName}' provided, but credentials could not be retrieved\");\n                }\n            }\n            else\n            {\n                // AWS DynamoDB instance (implicit auth - EC2 IAM Roles etc)\n                this._ddbClient = new AmazonDynamoDBClient(new AmazonDynamoDBConfig { RegionEndpoint = AWSUtils.GetRegionEndpoint(this._service) });\n            }\n        }\n\n        private async Task<TableDescription?> GetTableDescription(string tableName, CancellationToken cancellationToken = default)\n        {\n            try\n            {\n                var description = await _ddbClient.DescribeTableAsync(tableName, cancellationToken);\n                if (description.Table != null)\n                    return description.Table;\n            }","sourceCodeStart":158,"sourceCodeEnd":194,"githubUrl":"https://github.com/dotnet/orleans/blob/fca799fa70ecb6ad975224271703ca43221f58de/src/AWS/Shared/Storage/DynamoDBStorage.cs#L158-L194","documentation":"Thrown by DynamoDBStorage.CreateClient when a ProfileName was configured but CredentialProfileStoreChain.TryGetAWSCredentials could not find credentials for that named profile. The provider prefers explicit access/secret keys, then a named profile, then implicit (EC2/ECS IAM) auth; the profile branch failing means the named profile is unknown to the AWS SDK's credential store on this host.","triggerScenarios":"Produced during DynamoDBStorage construction (silo init) when options.ProfileName is set but no matching profile exists in the shared AWS credentials file (~/.aws/credentials) or the SDK credential store. Triggered by a deployment that expects a named profile that was never created, was created under a different user, or lives on a different machine/container image.","commonSituations":"Local profile name set in config but the credentials file is missing in the container; CI/CD running as a user without ~/.aws/credentials; profile name typo; AWS_PROFILE env var mismatch; running in EC2 where IAM role auth should be used instead of a named profile.","solutions":["Create the named profile in ~/.aws/credentials (or the configured credential store) on the host/container running the silo.","If running on EC2/ECS/EKS with an IAM role, remove ProfileName so the implicit-auth branch is used.","Switch to explicit AccessKey/SecretKey/Token in config (or, better, a secrets store) if a named profile is not feasible.","Double-check the profile name spelling and that the process runs as the user that owns the credentials file."],"exampleFix":"// before: named profile that does not exist on the host\nopt.ProfileName = \"prod-deploy\";\n\n// after (option A): create the profile on the host\n// [prod-deploy]\n// aws_access_key_id = ...\n// aws_secret_access_key = ...\n\n// after (option B): drop the profile and rely on the EC2/ECS IAM role\nopt.ProfileName = null;\n// (or set explicit keys from a secrets manager)","handlingStrategy":"validation","validationCode":"// If a named profile is configured, verify it resolves before starting the silo\nvar chain = new CredentialProfileStoreChain();\nif (!string.IsNullOrEmpty(opt.ProfileName) && !chain.TryGetAWSCredentials(opt.ProfileName, out _))\n    throw new InvalidOperationException($\"AWS profile '{opt.ProfileName}' not found; create it or drop ProfileName to use IAM role auth\");","typeGuard":"static bool ProfileResolves(string? profileName)\n{\n    if (string.IsNullOrEmpty(profileName)) return true;\n    return new CredentialProfileStoreChain().TryGetAWSCredentials(profileName, out _);\n}","tryCatchPattern":"try { silo.StartAsync(); }\ncatch (InvalidOperationException ix) when (ix.Message.Contains(\"credentials could not be retrieved\"))\n{\n    _logger.LogCritical(\"AWS named profile not found on this host; create it or rely on IAM role auth\");\n    throw;\n}","preventionTips":["On EC2/ECS/EKS, omit ProfileName and rely on the IAM role.","When using a named profile, bake the credentials file into the container image or mount it.","Run the silo as the user that owns ~/.aws/credentials.","CI check: verify the profile resolves in your deploy environment before starting the silo."],"tags":["aws","credentials","named-profile","config","iam"],"backgroundTag":null,"analyzedSha":"fca799fa70ecb6ad975224271703ca43221f58de","analyzedAt":"2026-08-13T19:55:57.938Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}