{"record":{"id":"97a992d646b800f4","repo":"apache/beam","slug":"aws-credential-provider-type-s-is-not-supported","errorCode":null,"errorMessage":"AWS credential provider type '%s' is not supported","messagePattern":"AWS credential provider type '(.+?)' is not supported","errorType":"validation","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/options/AwsModule.java","lineNumber":208,"sourceCode":"                StsClient.builder()\n                    .region(Region.AWS_GLOBAL)\n                    .credentialsProvider(AnonymousCredentialsProvider.create())\n                    .build())\n            .build();\n      } else if (typeName.equals(\n          StsAssumeRoleForFederatedCredentialsProvider.class.getSimpleName())) {\n        return StsAssumeRoleForFederatedCredentialsProvider.builder()\n            .setAudience(getNotNull(json, AUDIENCE, typeName))\n            .setAssumedRoleArn(getNotNull(json, ROLE_ARN, typeName))\n            .setWebIdTokenProviderFQCN(getNotNull(json, WEBID_TOKEN_FQCN, typeName))\n            .setSessionDurationSecs(\n                Optional.ofNullable(json.get(SESSION_DURATION_SECONDS))\n                    .map(JsonNode::asInt)\n                    .orElse(\n                        StsAssumeRoleForFederatedCredentialsProvider.DEFAULT_SESSION_DURATION_SECS))\n            .build();\n      } else {\n        throw new IOException(\n            String.format(\"AWS credential provider type '%s' is not supported\", typeName));\n      }\n    }\n\n    private String getNotNull(JsonNode json, String key, String typeName) {\n      JsonNode node = json.get(key);\n      checkNotNull(node, \"AWS credentials provider type '%s' is missing '%s'\", typeName, key);\n      return node.textValue();\n    }\n\n    private boolean hasName(Class<? extends AwsCredentialsProvider> clazz, String typeName) {\n      return clazz.getSimpleName().equals(typeName);\n    }\n  }\n\n  private static class AWSCredentialsProviderSerializer\n      extends JsonSerializer<AwsCredentialsProvider> {\n    // These providers are singletons, so don't require any serialization, other than type.","sourceCodeStart":190,"sourceCodeEnd":226,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/options/AwsModule.java#L190-L226","documentation":"AwsModule's credentials provider deserializer (deserializeWithType) reads the 'type' name from JSON and constructs the matching AwsCredentialsProvider. If the JSON type string matches none of the supported provider types (default, basic, profile, session, web-identity-token, sts-assume-role, etc.), it throws this IOException. It means serialized AWS options contain a credential provider type this Beam version cannot deserialize.","triggerScenarios":"Deserializing AwsCredentialsProvider JSON (e.g. from serialized pipeline options or job submission) whose type field was produced by a different Beam version or manually crafted with an unknown type value.","commonSituations":"Beam version mismatch between pipeline authoring and runner: newer Beam serialized a provider type the older AwsModule doesn't know; hand-edited pipeline option JSON; typo in the credential provider type name.","solutions":["Align Beam versions — run the pipeline with the same (or newer) Beam version that serialized the credentials provider.","Use a supported provider type when configuring AwsOptions (e.g. DEFAULT, BASIC, PROFILE, SESSION, WEB_IDENTITY_TOKEN, STS_ASSUME_ROLE).","Re-serialize the pipeline/options with the correct provider type instead of hand-editing JSON."],"exampleFix":"// before (JSON)\n{\"type\": \"myCustomProvider\", ...}\n// after\n{\"type\": \"default\"}","handlingStrategy":"validation","validationCode":"// verify provider type before deserialization\nSet<String> supported = Set.of(\"default\",\"basic\",\"profile\",\"session\",\"web-identity-token\",\"sts-assume-role\",\"sts-assume-role-with-web-identity\",\"process\");\nif (!supported.contains(jsonType)) throw new IllegalArgumentException(\"Unsupported type: \" + jsonType);","typeGuard":null,"tryCatchPattern":"try {\n  provider = deserializeAwsCredentialsProvider(json);\n} catch (IOException e) {\n  // fall back to DefaultCredentialsProvider and warn\n}","preventionTips":["Keep Beam versions consistent between job authoring and runner","Never hand-edit serialized credential provider JSON","Only use documented AwsCredentialsProvider types"],"tags":["aws","deserialization","jackson","credentials"],"backgroundTag":"unsupported-enum-value","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}