{"record":{"id":"ac7c5a1482618335","repo":"apache/hadoop","slug":"simpleawscredentialsprovider-no-aws-credentials-i","errorCode":null,"errorMessage":"SimpleAWSCredentialsProvider: No AWS credentials in the Hadoop configuration","messagePattern":"SimpleAWSCredentialsProvider: No AWS credentials in the Hadoop configuration","errorType":"exception","errorClass":"NoAwsCredentialsException","httpStatus":null,"severity":"error","filePath":"hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/SimpleAWSCredentialsProvider.java","lineNumber":85,"sourceCode":"  /**\n   * Instantiate from a login tuple.\n   * For testing, hence package-scoped.\n   * @param login login secrets\n   * @throws IOException failure\n   */\n  @VisibleForTesting\n  SimpleAWSCredentialsProvider(final S3xLoginHelper.Login login)\n      throws IOException {\n    this.accessKey = login.getUser();\n    this.secretKey = login.getPassword();\n  }\n\n  @Override\n  public AwsCredentials resolveCredentials() {\n    if (!StringUtils.isEmpty(accessKey) && !StringUtils.isEmpty(secretKey)) {\n      return AwsBasicCredentials.create(accessKey, secretKey);\n    }\n    throw new NoAwsCredentialsException(\"SimpleAWSCredentialsProvider\",\n        \"No AWS credentials in the Hadoop configuration\");\n  }\n\n  @Override\n  public String toString() {\n    return \"SimpleAWSCredentialsProvider{\" +\n        \"accessKey.empty=\" + accessKey.isEmpty() +\n        \", secretKey.empty=\" + secretKey.isEmpty() +\n        '}';\n  }\n\n}\n","sourceCodeStart":67,"sourceCodeEnd":98,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/SimpleAWSCredentialsProvider.java#L67-L98","documentation":"NoAwsCredentialsException thrown by SimpleAWSCredentialsProvider.resolveCredentials() when the access key or secret key (fs.s3a.access.key / fs.s3a.secret.key, or their URI/password forms) is empty. This provider maps static long-term keys from Hadoop configuration; when either half is missing it reports it has nothing, and if no other provider in fs.s3a.aws.credentials.provider can authenticate, S3 calls fail.","triggerScenarios":"fs.s3a.aws.credentials.provider includes SimpleAWSCredentialsProvider (or the default chain reaches it) but fs.s3a.access.key/fs.s3a.secret.key are unset, blank, or only one of the pair is set; secrets expected from a credential provider file that did not load.","commonSituations":"Removing static keys to move to IAM roles but leaving the simple provider in the chain; property name typos; JCEKS store missing on worker nodes; only one of the two keys migrated to the new cluster.","solutions":["Set both fs.s3a.access.key and fs.s3a.secret.key (config, URI, or Hadoop credential store)","If you intend environment/instance-profile auth, remove SimpleAWSCredentialsProvider from fs.s3a.aws.credentials.provider so the chain does not require static keys","Verify the credential store actually contains both entries: hadoop credential list -provider ...","Check for typos and per-bucket overrides that may blank the values"],"exampleFix":"<!-- before: provider in chain, keys missing -->\n<property><name>fs.s3a.aws.credentials.provider</name>\n  <value>org.apache.hadoop.fs.s3a.SimpleAWSCredentialsProvider</value></property>\n\n<!-- after: supply the pair ... -->\n<property><name>fs.s3a.access.key</name><value>AKIA...</value></property>\n<property><name>fs.s3a.secret.key</name><value>...</value></property>\n<!-- ...or drop the provider entry and rely on IAM instance profiles -->","handlingStrategy":"validation","validationCode":"if (conf.get(\"fs.s3a.aws.credentials.provider\", \"\")\n    .contains(\"SimpleAWSCredentialsProvider\")) {\n  String ak = conf.get(\"fs.s3a.access.key\", \"\");\n  String sk = conf.get(\"fs.s3a.secret.key\", \"\");\n  if (ak.isEmpty() || sk.isEmpty()) {\n    throw new IOException(\"SimpleAWSCredentialsProvider requires both\"\n        + \" fs.s3a.access.key and fs.s3a.secret.key\");\n  }\n}","typeGuard":null,"tryCatchPattern":"catch NoAwsCredentialsException at the first S3 operation or fs init; treat as a configuration error - print the provider chain and where each property should come from; do not retry","preventionTips":["Keep the provider chain and the credential properties it needs in one reviewed config unit","Prefer Hadoop credential stores over XML for static keys","On EC2, prefer the default chain with the IAM instance profile provider"],"tags":["s3a","hadoop-aws","credentials","authentication","configuration"],"backgroundTag":"missing-aws-credentials","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}