{"record":{"id":"7c96fd32b07aec24","repo":"apache/hadoop","slug":"provider-this-has-no-credentials-initializatio","errorCode":null,"errorMessage":"Provider {this} has no credentials: {initializationException}","messagePattern":"Provider (.+?) has no credentials: (.+?)","errorType":"exception","errorClass":"CredentialInitializationException","httpStatus":null,"severity":"error","filePath":"hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/auth/AbstractSessionCredentialsProvider.java","lineNumber":133,"sourceCode":"   * @throws SdkException if one was raised during init\n   * @throws CredentialInitializationException on other failures.\n   */\n  public AwsCredentials resolveCredentials() throws SdkException {\n    // do an on-demand init then raise an AWS SDK exception if\n    // there was a failure.\n    try {\n      if (!isInitialized()) {\n        init();\n      }\n    } catch (IOException e) {\n      if (e.getCause() instanceof SdkException) {\n        throw (SdkException) e.getCause();\n      } else {\n        throw new CredentialInitializationException(e.getMessage(), e);\n      }\n    }\n    if (awsCredentials == null) {\n      throw new CredentialInitializationException(\n          \"Provider \" + this + \" has no credentials: \" +\n             (initializationException != null ? initializationException.toString() : \"\"),\n          initializationException);\n    }\n    return awsCredentials;\n  }\n\n  public final boolean hasCredentials() {\n    return awsCredentials != null;\n  }\n\n  @Override\n  public String toString() {\n    return getClass().getSimpleName();\n  }\n\n  /**\n   * Get any IOE raised during initialization.","sourceCodeStart":115,"sourceCodeEnd":151,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/auth/AbstractSessionCredentialsProvider.java#L115-L151","documentation":"CredentialInitializationException from AbstractSessionCredentialsProvider.resolveCredentials(): initialization ran (or previously failed) but awsCredentials is still null, so the message embeds the recorded initializationException for diagnosis. Subclasses such as IAMInstanceCredentialsProvider load credentials lazily from the EC2/ECS metadata service; this is the 'tried and got nothing' outcome.","triggerScenarios":"The provider's init() failed to fetch credentials - IMDS/EC2 metadata service unreachable or timing out, no instance role attached, STS errors - and resolveCredentials() is then asked for credentials during S3 client construction.","commonSituations":"EC2 nodes without an attached instance profile; IMDS blocked by security groups, proxies, or IMDSv2 hop-limit problems (common in containers); metadata service throttling or transient outages at refresh time.","solutions":["Read the embedded initializationException in the message - it carries the root cause (timeout, 404 from IMDS, access denied)","On EC2, attach an IAM instance profile and verify IMDS: curl http://169.254.169.254/latest/meta-data/iam/security-credentials/","For IMDSv2 in containers, raise the metadata hop limit to 2 or fix token settings","Where metadata access is impossible, switch to explicit credentials or the assumed-role provider"],"exampleFix":"# before: provider relies on IMDS but the node has no role / IMDS blocked\nfs.s3a.aws.credentials.provider=org.apache.hadoop.fs.s3a.auth.IAMInstanceCredentialsProvider\n\n# after: attach a role to the instance (run once per node)\naws ec2 associate-iam-instance-profile \\\n  --instance-id i-0123456789abcdef0 \\\n  --iam-instance-profile Name=s3-access-role","handlingStrategy":"retry","validationCode":"// Preflight on EC2: the metadata service must serve role credentials\nHttpURLConnection c = (HttpURLConnection) new URL(\n    \"http://169.254.169.254/latest/meta-data/iam/security-credentials/\")\n    .openConnection();\nc.setConnectTimeout(2000);\nif (c.getResponseCode() != 200) {\n  throw new IOException(\"No instance-role credentials reachable via IMDS\");\n}","typeGuard":null,"tryCatchPattern":"catch CredentialInitializationException (an SdkException surfacing at client build); inspect the embedded initializationException - retry once after a short delay for transient IMDS hiccups, otherwise fail with infrastructure guidance","preventionTips":["Attach IAM roles to every node that touches S3","Keep IMDS reachable: correct hop limit for containerized workloads","Where IMDS is flaky, prefer the assumed-role provider with static base credentials"],"tags":["s3a","hadoop-aws","credentials","iam","imds","instance-profile","initialization"],"backgroundTag":"credentials-initialization-failed","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}