{"record":{"id":"860558aa4e8e4949","repo":"apache/hadoop","slug":"getcredentials-failed-e","errorCode":null,"errorMessage":"getCredentials failed: {e}","messagePattern":"getCredentials failed: (.+?)","errorType":"exception","errorClass":"CredentialInitializationException","httpStatus":null,"severity":"error","filePath":"hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/auth/AssumedRoleCredentialProvider.java","lineNumber":187,"sourceCode":"\n  /**\n   * Get credentials.\n   * @return the credentials\n   * @throws StsException if none could be obtained.\n   */\n  @Override\n  @Retries.RetryRaw\n  public AwsCredentials resolveCredentials() {\n    try {\n      return invoker.retryUntranslated(\"resolveCredentials\",\n          true,\n          stsProvider::resolveCredentials);\n    } catch (IOException e) {\n      // this is in the signature of retryUntranslated;\n      // its hard to see how this could be raised, but for\n      // completeness, it is wrapped as an Amazon Client Exception\n      // and rethrown.\n      throw new CredentialInitializationException(\n          \"getCredentials failed: \" + e,\n          e);\n    } catch (SdkClientException e) {\n      LOG.error(\"Failed to resolve credentials for role {}\",\n          arn, e);\n      throw e;\n    }\n  }\n\n  /**\n   * Propagate the close() call to the inner stsProvider.\n   */\n  @Override\n  public void close() {\n    S3AUtils.closeAutocloseables(LOG, stsProvider, credentialsToSTS, stsClient);\n  }\n\n  @Override","sourceCodeStart":169,"sourceCodeEnd":205,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/auth/AssumedRoleCredentialProvider.java#L169-L205","documentation":"CredentialInitializationException from AssumedRoleCredentialProvider.resolveCredentials(): the retrying call to the STS provider's resolveCredentials (AssumeRole) raised an IOException that is not an SdkClientException, so it is wrapped as 'getCredentials failed'. The credentials used with STS come from the inner chain fs.s3a.assumed.role.credentials.provider (default: SimpleAWSCredentialsProvider + EnvironmentVariableCredentialsProvider).","triggerScenarios":"Assumed-role auth where the STS AssumeRole call keeps failing through retries: no route to the STS endpoint, a misconfigured fs.s3a.assumed.role.sts.endpoint/region, the inner provider chain erroring with an IOException, or invalid session parameters.","commonSituations":"VPC without internet egress or STS endpoint; custom STS endpoint typos or wrong region; role trust policy rejecting the caller; base credentials for the inner chain missing so STS cannot be signed; proxies blocking STS.","solutions":["Inspect the wrapped IOException - it carries the underlying STS failure detail","Verify the inner chain resolves base credentials (simple/env providers by default) and its keys are valid","Check network access to STS (sts.<region>.amazonaws.com): create a VPC endpoint or set fs.s3a.assumed.role.sts.endpoint and fs.s3a.assumed.role.sts.region","Confirm the role's trust policy allows this principal and session options (name, duration, policy) are valid"],"exampleFix":"# before: locked-down VPC, no STS egress -> getCredentials failed\n\n<!-- after: point S3A at an STS VPC endpoint -->\n<property>\n  <name>fs.s3a.assumed.role.sts.endpoint</name>\n  <value>https://vpce-0abc.sts.eu-west-1.vpce.amazonaws.com</value>\n</property>\n<property>\n  <name>fs.s3a.assumed.role.sts.region</name>\n  <value>eu-west-1</value>\n</property>","handlingStrategy":"try-catch","validationCode":"// Preflight STS reachability before jobs depend on assumed-role auth\nnew URL(\"https://sts.\" + region + \".amazonaws.com\")\n    .openConnection().setConnectTimeout(3000); // throws on no route","typeGuard":null,"tryCatchPattern":"catch CredentialInitializationException with message 'getCredentials failed'; unwrap getCause() to get the STS detail - fix network/endpoint/inner-credentials rather than retrying (the provider already retried)","preventionTips":["Preflight one S3 operation at job start to fail fast on auth setup","Ensure STS reachability (VPC endpoint or egress) in locked-down networks","Keep the inner provider chain's base credentials valid and refreshable"],"tags":["s3a","hadoop-aws","credentials","assumed-role","sts","network"],"backgroundTag":"credentials-initialization-failed","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}