{"record":{"id":"81ab345471946920","repo":"weaviate/weaviate","slug":"initialize-s3-export-client","errorCode":null,"errorMessage":"initialize S3 export client","messagePattern":"initialize S3 export client","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/backup-s3/module.go","lineNumber":115,"sourceCode":"\n\t// Create a separate export client with no default bucket or path.\n\t// The export scheduler supplies both via EXPORT_DEFAULT_BUCKET and\n\t// EXPORT_DEFAULT_PATH. When EXPORT_S3_ROLE_ARN is set the export\n\t// client additionally uses STS AssumeRole for cross-account access.\n\texportCfg := newConfig(os.Getenv(s3Endpoint), \"\", \"\", useSSL)\n\tif exportRoleARN := os.Getenv(exportS3RoleARN); exportRoleARN != \"\" {\n\t\texportCfg.RoleARN = exportRoleARN\n\t\texportCfg.ExternalID = os.Getenv(exportS3ExternalID)\n\t\texportCfg.STSEndpoint = os.Getenv(exportS3STSEndpoint)\n\t\texportCfg.RoleSessionName = os.Getenv(exportS3RoleSessionName)\n\t\tif exportCfg.RoleSessionName == \"\" {\n\t\t\texportCfg.RoleSessionName = \"weaviate-export-s3\"\n\t\t}\n\t}\n\texportCfg.SkipAccessCheck = params.GetConfig().Export.SkipAccessCheck\n\texportClient, err := newClient(exportCfg, m.logger, m.dataPath)\n\tif err != nil {\n\t\treturn errors.Wrap(err, \"initialize S3 export client\")\n\t}\n\tm.exportClient = exportClient\n\n\treturn nil\n}\n\n// ExportBackend returns the export-specific backend. It has no default\n// bucket or path; the export scheduler supplies both via\n// EXPORT_DEFAULT_BUCKET and EXPORT_DEFAULT_PATH.\nfunc (m *Module) ExportBackend() modulecapabilities.BackupBackend {\n\treturn &exportS3Backend{m.exportClient}\n}\n\n// exportS3Backend wraps an s3Client to satisfy the full BackupBackend\n// interface (s3Client is missing IsExternal and Name).\ntype exportS3Backend struct {\n\t*s3Client\n}","sourceCodeStart":97,"sourceCodeEnd":133,"githubUrl":"https://github.com/weaviate/weaviate/blob/75aa4b6d11f8818305aafd4440b4e32794f7ca04/modules/backup-s3/module.go#L97-L133","documentation":"Wraps errors from constructing the separate S3 export client in Init. This client is built from EXPORT_* env vars (bucket, path, optional role ARN) and is distinct from the backup client, so it can fail even when backups are configured correctly.","triggerScenarios":"EXPORT_S3_ROLE_ARN misconfigured/unassumable, invalid EXPORT_DEFAULT_BUCKET or endpoint, credential chain failing for the assumed role, or SkipAccessCheck=false and the export bucket not accessible.","commonSituations":"Export scheduler feature enabled with EXPORT_S3_ROLE_ARN pointing to a role the pod identity cannot assume; export bucket in a different region/account than backup bucket; missing EXPORT_DEFAULT_BUCKET.","solutions":["Inspect the wrapped error for the AWS root cause (e.g. NoCredentialProviders, AccessDenied on AssumeRole)","Verify EXPORT_S3_ROLE_ARN is correct and the pod's identity is trusted by the role's trust policy","Set EXPORT_DEFAULT_BUCKET/EXPORT_DEFAULT_PATH to valid values or enable export skip access check","Test role assumption with aws sts assume-role from inside the container"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if exportEnabled && os.Getenv(\"EXPORT_DEFAULT_BUCKET\") == \"\" {\n    return errors.New(\"export enabled but EXPORT_DEFAULT_BUCKET missing\")\n}\n// verify role assumability out-of-band:\n// aws sts assume-role --role-arn $EXPORT_S3_ROLE_ARN --role-session-name test","typeGuard":null,"tryCatchPattern":"if err := m.Init(ctx, params); err != nil {\n    if strings.Contains(err.Error(), \"initialize S3 export client\") {\n        // disable export features, keep backup path alive\n    }\n}","preventionTips":["Test role assumption with sts assume-role from the same runtime identity","Keep export and backup buckets in the same region/account when possible","Document EXPORT_* env vars separately from BACKUP_S3_*","Enable CloudTrail/IAM logs to debug AccessDenied on AssumeRole"],"tags":["s3","export","aws-iam","initialization"],"backgroundTag":"s3-client-init-failed","analyzedSha":"75aa4b6d11f8818305aafd4440b4e32794f7ca04","analyzedAt":"2026-09-04T14:58:20.392Z","contentChangedAt":"2026-09-04T14:58:20.392Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}