{"record":{"id":"a957723ed943af8a","repo":"apache/beam","slug":"unsupported-aws-credentials-provider-type","errorCode":null,"errorMessage":"Unsupported AWS credentials provider type ","messagePattern":"Unsupported AWS credentials provider type ","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/options/AwsModule.java","lineNumber":297,"sourceCode":"        Supplier<AssumeRoleWithWebIdentityRequest> reqSupplier =\n            (Supplier<AssumeRoleWithWebIdentityRequest>)\n                readField(credentialsProvider, \"assumeRoleWithWebIdentityRequest\");\n        serializer\n            .findValueSerializer(AssumeRoleWithWebIdentityRequest.serializableBuilderClass())\n            .unwrappingSerializer(NameTransformer.NOP)\n            .serialize(reqSupplier.get().toBuilder(), jsonGenerator, serializer);\n      } else if (credentialsProvider instanceof StsAssumeRoleForFederatedCredentialsProvider) {\n        StsAssumeRoleForFederatedCredentialsProvider provider =\n            (StsAssumeRoleForFederatedCredentialsProvider) credentialsProvider;\n        jsonGenerator.writeStringField(AUDIENCE, provider.audience());\n        jsonGenerator.writeStringField(ROLE_ARN, provider.assumedRoleArn());\n        jsonGenerator.writeStringField(WEBID_TOKEN_FQCN, provider.webIdTokenProviderFQCN());\n        Integer sessionDurationSecs = provider.sessionDurationSecs();\n        if (sessionDurationSecs != null) {\n          jsonGenerator.writeNumberField(SESSION_DURATION_SECONDS, sessionDurationSecs);\n        }\n      } else if (!SINGLETON_CREDENTIAL_PROVIDERS.contains(providerClass)) {\n        throw new IllegalArgumentException(\n            \"Unsupported AWS credentials provider type \" + providerClass);\n      }\n      // BEAM-11958 Use deprecated Jackson APIs to be compatible with older versions of jackson\n      typeSerializer.writeTypeSuffixForObject(credentialsProvider, jsonGenerator);\n    }\n\n    private Object readField(AwsCredentialsProvider provider, String fieldName) throws IOException {\n      try {\n        return FieldUtils.readField(provider, fieldName, true);\n      } catch (IllegalArgumentException | IllegalAccessException e) {\n        throw new IOException(\n            String.format(\n                \"Failed to access private field '%s' of AWS credential provider type '%s' with reflection\",\n                fieldName, provider.getClass().getSimpleName()),\n            e);\n      }\n    }\n  }","sourceCodeStart":279,"sourceCodeEnd":315,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/options/AwsModule.java#L279-L315","documentation":"AwsModule's credentials provider serializer (serializeWithType) writes the provider to JSON; for provider classes that are neither composite (profile/session/etc.) nor in SINGLETON_CREDENTIAL_PROVIDERS, it throws this IllegalArgumentException. It means a custom AwsCredentialsProvider implementation was supplied that Beam's serializer does not know how to represent.","triggerScenarios":"Setting AwsOptions.setAwsCredentialsProvider to a custom AwsCredentialsProvider implementation (or one from a different SDK extension) that is not one of the supported singleton types, then serializing the pipeline options.","commonSituations":"Users plugging a bespoke credentials provider into Beam's AwsOptions and submitting the job — serialization of the pipeline fails at job submission time.","solutions":["Use one of Beam's supported provider types (DefaultCredentialsProvider, BasicAWSCredentialsProvider, ProfileCredentialsProvider, etc.).","If a custom provider is required, add it to SINGLETON_CREDENTIAL_PROVIDERS handling in AwsModule (fork/patch) or upstream it to Beam.","Configure credentials via static configuration (profile/keys/environment) instead of a custom provider object."],"exampleFix":"// before\noptions.setAwsCredentialsProvider(myCustomProvider);\n// after\noptions.setAwsCredentialsProvider(ProfileCredentialsProvider.create(\"my-profile\"));","handlingStrategy":"validation","validationCode":"Class<?> c = provider.getClass();\nif (!(c == DefaultCredentialsProvider.class || c == ProfileCredentialsProvider.class\n    || c == EnvironmentVariableCredentialsProvider.class || c == SystemPropertyCredentialsProvider.class\n    || c == ContainerCredentialsProvider.class || c == InstanceProfileCredentialsProvider.class)) {\n  throw new IllegalArgumentException(\"Provider not serializable by Beam: \" + c);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Configure credentials via profiles, environment or static keys instead of custom providers","Check SINGLETON_CREDENTIAL_PROVIDERS support before plugging in a provider"],"tags":["aws","serialization","credentials","unsupported-type"],"backgroundTag":"unsupported-operation","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}