{"record":{"id":"9b2f652f48aadf1d","repo":"alibaba/nacos","slug":"500-9b2f65","errorCode":"500","errorMessage":"can not get security credentials, responseCode: {}, response: {}","messagePattern":"can not get security credentials, responseCode: (.+?), response: (.+?)","errorType":"exception","errorClass":"NacosRuntimeException","httpStatus":500,"severity":"error","filePath":"client-basic/src/main/java/com/alibaba/nacos/client/auth/ram/identify/StsCredentialHolder.java","lineNumber":90,"sourceCode":"            stsCredential.getExpiration());\n        return stsCredential;\n    }\n    \n    private static String getStsResponse() {\n        String securityCredentials = StsConfig.getInstance().getSecurityCredentials();\n        if (securityCredentials != null) {\n            return securityCredentials;\n        }\n        String securityCredentialsUrl = StsConfig.getInstance().getSecurityCredentialsUrl();\n        try {\n            HttpRestResult<String> result = HttpClientManager.getInstance().getNacosRestTemplate()\n                .get(securityCredentialsUrl, Header.EMPTY, Query.EMPTY, String.class);\n            \n            if (!result.ok()) {\n                LOGGER.error(\n                    \"can not get security credentials, securityCredentialsUrl: {}, responseCode: {}, response: {}\",\n                    securityCredentialsUrl, result.getCode(), result.getMessage());\n                throw new NacosRuntimeException(NacosException.SERVER_ERROR,\n                    \"can not get security credentials, responseCode: \" + result.getCode()\n                        + \", response: \" + result\n                            .getMessage());\n            }\n            return result.getData();\n        } catch (Exception e) {\n            LOGGER.error(\"can not get security credentials\", e);\n            throw new NacosRuntimeException(NacosException.SERVER_ERROR, e);\n        }\n    }\n}\n","sourceCodeStart":72,"sourceCodeEnd":102,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/client-basic/src/main/java/com/alibaba/nacos/client/auth/ram/identify/StsCredentialHolder.java#L72-L102","documentation":"Thrown by StsCredentialHolder.getStsResponse() as a NacosRuntimeException with code SERVER_ERROR (500) when the HTTP response from the STS (Security Token Service) credentials URL is not OK (result.ok() returns false). The exception message includes the HTTP response code and response body. A separate catch block wraps any other Exception (e.g. connection failure) into the same NacosRuntimeException. This is part of Alibaba Cloud RAM authentication where the client fetches temporary security credentials from a metadata service or STS endpoint.","triggerScenarios":"The configured securityCredentialsUrl returns a non-2xx HTTP status (e.g. 403, 404, 500). The URL is obtained from StsConfig.getInstance().getSecurityCredentialsUrl(). Common in ECS/ACK environments where the metadata service is inaccessible or the RAM role is not attached.","commonSituations":"Running on an ECS/ACK instance without the required RAM role attached; the instance metadata service (e.g. http://100.100.100.200/...) is blocked by network policy; STS token has expired and the refresh endpoint returns an error; misconfigured securityCredentialsUrl in StsConfig.","solutions":["Check the responseCode and response body in the exception message to diagnose the STS error.","Verify the ECS/ACK instance has the correct RAM role attached and the metadata service is reachable.","If not running on Alibaba Cloud, set credentials directly via PropertyKeyConst.ACCESS_KEY and PropertyKeyConst.SECRET_KEY instead of relying on STS.","Ensure network policies allow access to the metadata service or STS endpoint URL."],"exampleFix":"// before — relying on STS metadata service that is unreachable\n// (no explicit credentials set)\n\n// after — provide credentials directly\nprops.setProperty(PropertyKeyConst.ACCESS_KEY, \"your-access-key\");\nprops.setProperty(PropertyKeyConst.SECRET_KEY, \"your-secret-key\");","handlingStrategy":"try-catch","validationCode":"String securityUrl = StsConfig.getInstance().getSecurityCredentialsUrl();\ntry {\n    HttpRestResult<String> testResult = HttpClientManager.getInstance().getNacosRestTemplate()\n        .get(securityUrl, Header.EMPTY, Query.EMPTY, String.class);\n    if (!testResult.ok()) {\n        // Fall back to explicit credentials\n        props.setProperty(PropertyKeyConst.ACCESS_KEY, explicitAk);\n        props.setProperty(PropertyKeyConst.SECRET_KEY, explicitSk);\n    }\n} catch (Exception e) {\n    props.setProperty(PropertyKeyConst.ACCESS_KEY, explicitAk);\n    props.setProperty(PropertyKeyConst.SECRET_KEY, explicitSk);\n}","typeGuard":null,"tryCatchPattern":"try {\n    StsCredentialHolder.getInstance().getStsCredential();\n} catch (NacosRuntimeException e) {\n    if (e.getCode() == NacosException.SERVER_ERROR) {\n        // STS unavailable — use static credentials as fallback\n        CredentialService.getInstance().setCredential(new Credential(staticAk, staticSk));\n    } else {\n        throw e;\n    }\n}","preventionTips":["Attach the correct RAM role to ECS/ACK instances before deploying Nacos clients.","Provide explicit ACCESS_KEY and SECRET_KEY as a fallback when STS is unavailable.","Ensure network policies allow access to the metadata service (100.100.100.200)."],"tags":["auth","ram","sts","network","credentials"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}