{"record":{"id":"665c090ed5a35765","repo":"apache/pulsar","slug":"couldn-t-get-the-access-key-id","errorCode":null,"errorMessage":"Couldn't get the access key id.","messagePattern":"Couldn't get the access key id\\.","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"tiered-storage/jcloud/src/main/java/org/apache/bookkeeper/mledger/offload/jcloud/provider/JCloudBlobStoreProvider.java","lineNumber":461,"sourceCode":"        String configId = config.getConfigProperty(S3_ID_FIELD);\n        String configSecret = config.getConfigProperty(S3_SECRET_FIELD);\n        if (StringUtils.isNotBlank(configId) || StringUtils.isNotBlank(configSecret)) {\n            if (StringUtils.isBlank(configId) || StringUtils.isBlank(configSecret)) {\n                throw new IllegalArgumentException(\n                        \"Both \" + S3_ID_FIELD + \" and \" + S3_SECRET_FIELD\n                                + \" must be set when providing offload credentials in the configuration\");\n            }\n            Credentials credentials = new Credentials(configId, configSecret);\n            config.setProviderCredentials(() -> credentials);\n            return;\n        }\n        String accountName = System.getenv().getOrDefault(\"ACCESS_KEY_ID\", \"\");\n        // For forward compatibility\n        if (StringUtils.isEmpty(accountName.trim())) {\n            accountName = System.getenv().getOrDefault(\"ALIYUN_OSS_ACCESS_KEY_ID\", \"\");\n        }\n        if (StringUtils.isEmpty(accountName.trim())) {\n            throw new IllegalArgumentException(\"Couldn't get the access key id.\");\n        }\n        String accountKey = System.getenv().getOrDefault(\"ACCESS_KEY_SECRET\", \"\");\n        if (StringUtils.isEmpty(accountKey.trim())) {\n            accountKey = System.getenv().getOrDefault(\"ALIYUN_OSS_ACCESS_KEY_SECRET\", \"\");\n        }\n        if (StringUtils.isEmpty(accountKey.trim())) {\n            throw new IllegalArgumentException(\"Couldn't get the access key secret.\");\n        }\n        Credentials credentials = new Credentials(\n                accountName, accountKey);\n        config.setProviderCredentials(() -> credentials);\n    };\n\n}\n","sourceCodeStart":443,"sourceCodeEnd":476,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/tiered-storage/jcloud/src/main/java/org/apache/bookkeeper/mledger/offload/jcloud/provider/JCloudBlobStoreProvider.java#L443-L476","documentation":"Thrown by the Aliyun OSS credential builder when no access key id can be found in the environment. It first checks ACCESS_KEY_ID, then falls back to the legacy ALIYUN_OSS_ACCESS_KEY_ID for forward compatibility; if both are empty/whitespace, the provider cannot authenticate to OSS and throws IllegalArgumentException.","triggerScenarios":"Using the aliyun-oss (OSS) offload driver without either ACCESS_KEY_ID or ALIYUN_OSS_ACCESS_KEY_ID set in the broker's process environment, or the variable set only to whitespace.","commonSituations":"Broker started by systemd/container that doesn't pass the env var through; credentials configured in config properties instead but using the S3 keys, which the OSS builder ignores; renamed variables after migration; missing env_file in docker-compose/K8s manifest.","solutions":["Export ACCESS_KEY_ID (or ALIYUN_OSS_ACCESS_KEY_ID) in the broker process environment before startup.","In containers/K8s, add the env var to the deployment/envFile so it reaches the JVM.","Alternatively supply credentials via the S3-prefixed config properties (both id and secret) so the env path isn't needed.","Restart the broker after setting the variable — env vars are read at credential-build time, not dynamically."],"exampleFix":"# before: no env vars\n# after\nexport ACCESS_KEY_ID=LTAI...\nexport ACCESS_KEY_SECRET=...\n# then restart the broker","handlingStrategy":"validation","validationCode":"String id = System.getenv(\"ACCESS_KEY_ID\");\nif (id == null || id.trim().isEmpty()) {\n    id = System.getenv(\"ALIYUN_OSS_ACCESS_KEY_ID\");\n}\nif (id == null || id.trim().isEmpty()) {\n    throw new IllegalStateException(\"OSS offload requires ACCESS_KEY_ID (or ALIYUN_OSS_ACCESS_KEY_ID) in the environment\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    provider.validateConfig(cfg);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"Couldn't get the access key id\")) {\n        log.error(\"OSS access key id missing from environment; set ACCESS_KEY_ID and restart\", e);\n    }\n}","preventionTips":["Set credentials in the broker's startup environment (systemd EnvironmentFile, K8s env, docker --env-file).","Verify with `sudo -u pulsar env | grep ACCESS_KEY` that the broker process actually sees the variables.","Restart the broker after changing environment variables.","Remember the OSS builder reads env, not config properties."],"tags":["configuration","environment-variables","aliyun-oss","credentials"],"backgroundTag":"missing-env-var","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}