{"record":{"id":"ade3d111f7170728","repo":"apache/beam","slug":"failed-to-create-gcs-client","errorCode":null,"errorMessage":"failed to create GCS client","messagePattern":"failed to create GCS client","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"sdks/go/pkg/beam/artifact/gcsproxy/retrieval.go","lineNumber":46,"sourceCode":"\n// RetrievalServer is a artifact retrieval server backed by Google\n// Cloud Storage (GCS). It serves a single manifest and ignores\n// the worker id. The server performs no caching or pre-fetching.\ntype RetrievalServer struct {\n\tmd    *jobpb.Manifest\n\tblobs map[string]string\n}\n\n// ReadProxyManifest reads and parses the proxy manifest from GCS.\nfunc ReadProxyManifest(ctx context.Context, object string) (*jobpb.ProxyManifest, error) {\n\tbucket, obj, err := gcsx.ParseObject(object)\n\tif err != nil {\n\t\treturn nil, errors.Wrapf(err, \"invalid manifest object %v\", object)\n\t}\n\n\tcl, err := gcsx.NewClient(ctx, storage.ScopeReadOnly)\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"failed to create GCS client\")\n\t}\n\tcontent, err := gcsx.ReadObject(ctx, cl, bucket, obj)\n\tif err != nil {\n\t\treturn nil, errors.Wrapf(err, \"failed to read manifest %v\", object)\n\t}\n\tvar md jobpb.ProxyManifest\n\tif err := proto.Unmarshal(content, &md); err != nil {\n\t\treturn nil, errors.Wrapf(err, \"invalid manifest %v\", object)\n\t}\n\treturn &md, nil\n}\n\n// NewRetrievalServer creates a artifact retrieval server for the\n// given manifest. It requires that the locations are in GCS.\nfunc NewRetrievalServer(md *jobpb.ProxyManifest) (*RetrievalServer, error) {\n\tif err := validate(md); err != nil {\n\t\treturn nil, err\n\t}","sourceCodeStart":28,"sourceCodeEnd":64,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/go/pkg/beam/artifact/gcsproxy/retrieval.go#L28-L64","documentation":"ReadProxyManifest creates a read-only Google Cloud Storage client after parsing the object path. This error wraps the underlying client-creation failure, meaning authentication or client construction failed before any manifest was read.","triggerScenarios":"Calling ReadProxyManifest when gcsx.NewClient fails: missing Application Default Credentials, GOOGLE_APPLICATION_CREDENTIALS unset/invalid, or the Cloud Storage client library failing to initialize.","commonSituations":"Running outside GCE/Cloud Run without a service account, expired or malformed credential JSON files, or disabled Cloud Storage API on the project.","solutions":["Set up Application Default Credentials: run gcloud auth application-default login locally or attach a service account with Storage Object Viewer.","Set GOOGLE_APPLICATION_CREDENTIALS to a valid service-account JSON key file.","Confirm the Cloud Storage API is enabled in the project and the environment has network access to storage.googleapis.com."],"exampleFix":"// before (no credentials configured)\nmd, err := ReadProxyManifest(ctx, objPath)\n// after\nos.Setenv(\"GOOGLE_APPLICATION_CREDENTIALS\", \"/path/to/sa.json\")\nmd, err := ReadProxyManifest(ctx, objPath)","handlingStrategy":"retry","validationCode":"creds := os.Getenv(\"GOOGLE_APPLICATION_CREDENTIALS\")\nif creds == \"\" { if _, err := gcp.DefaultCredentials(ctx); err != nil { return fmt.Errorf(\"no GCS credentials: %w\", err) } }","typeGuard":null,"tryCatchPattern":"var md *jobpb.ProxyManifest\nerr := retry.Exponential(ctx, 3, func() error { var e error; md, e = ReadProxyManifest(ctx, obj); return e })","preventionTips":["Attach Storage Object Viewer credentials to any service reading manifests.","Pre-flight-check credentials with a lightweight GCS call before starting jobs."],"tags":["gcs","authentication","network","beam"],"backgroundTag":"missing-credentials","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-20T03:17:13.778Z"}