{"record":{"id":"96462d2b17d9b90f","repo":"risingwavelabs/risingwave","slug":"s3-access-key-and-s3-secret-key-is-required-with-a","errorCode":null,"errorMessage":"s3.access.key and s3.secret.key is required with aws s3","messagePattern":"s3\\.access\\.key and s3\\.secret\\.key is required with aws s3","errorType":"validation","errorClass":"SinkError","httpStatus":null,"severity":"error","filePath":"src/connector/src/sink/deltalake.rs","lineNumber":151,"sourceCode":"            Ok(DeltaTableUrl::Gcs(path.to_owned()))\n        } else if let Some(path) = path.strip_prefix(\"file://\") {\n            Ok(DeltaTableUrl::Local(path.to_owned()))\n        } else {\n            Err(SinkError::DeltaLake(anyhow!(\n                \"path should start with 's3://','s3a://'(s3) ,gs://(gcs) or file://(local)\"\n            )))\n        }\n    }\n\n    async fn build_delta_lake_config_for_aws(&self) -> Result<HashMap<String, String>> {\n        let mut storage_options = HashMap::new();\n        storage_options.insert(AWS_ALLOW_HTTP.to_owned(), \"true\".to_owned());\n        storage_options.insert(AWS_S3_ALLOW_UNSAFE_RENAME.to_owned(), \"true\".to_owned());\n        let sdk_config = self.aws_auth_props.build_config().await?;\n        let credentials = sdk_config\n            .credentials_provider()\n            .ok_or_else(|| {\n                SinkError::Config(anyhow!(\n                    \"s3.access.key and s3.secret.key is required with aws s3\"\n                ))\n            })?\n            .as_ref()\n            .provide_credentials()\n            .await\n            .map_err(|e| SinkError::Config(e.into()))?;\n        let region = sdk_config.region();\n        let endpoint = sdk_config.endpoint_url();\n        storage_options.insert(\n            AWS_ACCESS_KEY_ID.to_owned(),\n            credentials.access_key_id().to_owned(),\n        );\n        storage_options.insert(\n            AWS_SECRET_ACCESS_KEY.to_owned(),\n            credentials.secret_access_key().to_owned(),\n        );\n        if endpoint.is_none() && region.is_none() {","sourceCodeStart":133,"sourceCodeEnd":169,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/connector/src/sink/deltalake.rs#L133-L169","documentation":"Raised while building the AWS S3 (or S3-compatible) configuration for a DeltaLake sink. After resolving AWS credentials from the user's `aws_auth_props`, the SDK returned no credentials provider, meaning static access/secret keys were not configured. DeltaLake S3 writes require concrete static credentials; assumed-role or instance-profile resolution without them is rejected here.","triggerScenarios":"Creating a DeltaLake sink with `connector='s3'` (aws mode) where `s3.access.key` / `s3.secret.key` are absent from WITH properties, so `aws_auth_props.build_config()` yields a config whose `credentials_provider()` is None.","commonSituations":"Users relying on IAM roles or environment credentials instead of explicit keys; typos in the `s3.access.key`/`s3.secret.key` property names; copying a config template and leaving key fields blank.","solutions":["Add `s3.access.key` and `s3.secret.key` to the sink WITH options","Verify property names are spelled exactly (no typos, correct dots)","If using temporary credentials, also supply `s3.session.token`","Alternatively configure an S3-compatible endpoint mode where credentials come from other supported sources"],"exampleFix":"// before\nWITH (\n  connector = 'deltalake',\n  location = 's3://bucket/table',\n  s3.region = 'us-east-1'\n)\n// after\nWITH (\n  connector = 'deltalake',\n  location = 's3://bucket/table',\n  s3.access.key = 'AKIA...',\n  s3.secret.key = '...',\n  s3.region = 'us-east-1'\n)","handlingStrategy":"validation","validationCode":"fn validate_s3_creds(props: &BTreeMap<String, String>) -> Result<(), String> {\n    if props.get(\"s3.access.key\").map_or(true, |v| v.is_empty())\n        || props.get(\"s3.secret.key\").map_or(true, |v| v.is_empty()) {\n        return Err(\"s3.access.key and s3.secret.key must be set and non-empty\".into());\n    }\n    Ok(())\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always include s3.access.key and s3.secret.key in the WITH clause for S3 DeltaLake sinks","Keep credentials in a secret manager and template them into the DDL","Verify property key spellings before running CREATE SINK"],"tags":["aws","s3","deltalake","config","credentials"],"backgroundTag":"missing-credentials","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}