{"record":{"id":"791ad61e71ad8b78","repo":"apache/hadoop","slug":"unset-property-fs-s3a-assumed-role-arn","errorCode":null,"errorMessage":"Unset property fs.s3a.assumed.role.arn","messagePattern":"Unset property fs\\.s3a\\.assumed\\.role\\.arn","errorType":"exception","errorClass":"PathIOException","httpStatus":null,"severity":"error","filePath":"hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/auth/AssumedRoleCredentialProvider.java","lineNumber":110,"sourceCode":"\n  private final StsClient stsClient;\n\n  /**\n   * Instantiate.\n   * This calls {@link #resolveCredentials()} to fail fast on the inner\n   * role credential retrieval.\n   * @param fsUri possibly null URI of the filesystem.\n   * @param conf configuration\n   * @throws IOException on IO problems and some parameter checking\n   * @throws IllegalArgumentException invalid parameters\n   * @throws StsException problems getting credentials\n   */\n  public AssumedRoleCredentialProvider(@Nullable URI fsUri, Configuration conf)\n      throws IOException {\n\n    arn = conf.getTrimmed(ASSUMED_ROLE_ARN, \"\");\n    if (StringUtils.isEmpty(arn)) {\n      throw new PathIOException(String.valueOf(fsUri), E_NO_ROLE);\n    }\n\n    // build up the base provider\n    credentialsToSTS = buildAWSProviderList(fsUri, conf,\n        ASSUMED_ROLE_CREDENTIALS_PROVIDER,\n        Arrays.asList(\n            SimpleAWSCredentialsProvider.class,\n            EnvironmentVariableCredentialsProvider.class),\n        Sets.newHashSet(getClass()));\n    LOG.debug(\"Credentials used to obtain role credentials: {}\", credentialsToSTS);\n\n    // then the STS binding\n    sessionName = conf.getTrimmed(ASSUMED_ROLE_SESSION_NAME,\n        buildSessionName());\n    duration = conf.getTimeDuration(ASSUMED_ROLE_SESSION_DURATION,\n        ASSUMED_ROLE_SESSION_DURATION_DEFAULT, TimeUnit.SECONDS);\n    String policy = conf.getTrimmed(ASSUMED_ROLE_POLICY, \"\");\n    String externalId = conf.getTrimmed(ASSUMED_ROLE_EXTERNAL_ID, \"\");","sourceCodeStart":92,"sourceCodeEnd":128,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/auth/AssumedRoleCredentialProvider.java#L92-L128","documentation":"PathIOException (E_NO_ROLE) thrown from the AssumedRoleCredentialProvider constructor: the provider is listed in fs.s3a.aws.credentials.provider but fs.s3a.assumed.role.arn is empty. Assumed-role authentication always needs a role ARN to assume, so construction fails immediately.","triggerScenarios":"Adding org.apache.hadoop.fs.s3a.auth.AssumedRoleCredentialProvider to fs.s3a.aws.credentials.provider without setting fs.s3a.assumed.role.arn, or with a whitespace-only value, or when a bucket-scoped config enables the provider but misses the ARN.","commonSituations":"Copy-pasted provider lists from documentation; property name typos (fs.s3a.assume.role.arn); job-level config overriding the cluster config and dropping the ARN; templates that parameterize the provider but not the role.","solutions":["Set fs.s3a.assumed.role.arn to the full role ARN, e.g. arn:aws:iam::123456789012:role/s3-reader","Check the exact property name and bucket-scoped variant (fs.s3a.bucket.<bucket>.assumed.role.arn)","Ensure the ARN is visible where the filesystem is initialized - job configs can override cluster configs","If assumed roles are not intended, remove AssumedRoleCredentialProvider from the chain"],"exampleFix":"<!-- before -->\n<property><name>fs.s3a.aws.credentials.provider</name>\n  <value>org.apache.hadoop.fs.s3a.auth.AssumedRoleCredentialProvider</value></property>\n\n<!-- after -->\n<property><name>fs.s3a.aws.credentials.provider</name>\n  <value>org.apache.hadoop.fs.s3a.auth.AssumedRoleCredentialProvider</value></property>\n<property><name>fs.s3a.assumed.role.arn</name>\n  <value>arn:aws:iam::123456789012:role/s3-reader</value></property>","handlingStrategy":"validation","validationCode":"boolean usesRole = conf.get(\"fs.s3a.aws.credentials.provider\", \"\")\n    .contains(\"AssumedRoleCredentialProvider\");\nif (usesRole && conf.getTrimmed(\"fs.s3a.assumed.role.arn\", \"\").isEmpty()) {\n  throw new IOException(\"fs.s3a.assumed.role.arn must be set when\"\n      + \" AssumedRoleCredentialProvider is in the provider chain\");\n}","typeGuard":null,"tryCatchPattern":"catch PathIOException with 'Unset property fs.s3a.assumed.role.arn' at fs init; set the ARN or remove the provider - not retryable","preventionTips":["Template the provider and its ARN as one unit","Remember whitespace-only values count as unset (values are trimmed)","Validate required property pairs in deploy-time config checks"],"tags":["s3a","hadoop-aws","credentials","assumed-role","iam","configuration"],"backgroundTag":"missing-configuration-property","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}