{"record":{"id":"b1747a74f42423ab","repo":"apache/flink","slug":"failed-to-instantiate-credentials-provider","errorCode":null,"errorMessage":"Failed to instantiate credentials provider: {}","messagePattern":"Failed to instantiate credentials provider: (.+?)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"flink-filesystems/flink-s3-fs-native/src/main/java/org/apache/flink/fs/s3native/S3ClientProvider.java","lineNumber":939,"sourceCode":"                    throw new IllegalArgumentException(\n                            \"Class \"\n                                    + resolvedClassName\n                                    + \" does not implement AwsCredentialsProvider\");\n                }\n\n                try {\n                    Method createMethod = clazz.getMethod(\"create\");\n                    if (Modifier.isStatic(createMethod.getModifiers())\n                            && AwsCredentialsProvider.class.isAssignableFrom(\n                                    createMethod.getReturnType())) {\n                        return (AwsCredentialsProvider) createMethod.invoke(null);\n                    }\n                } catch (NoSuchMethodException ignored) {\n                }\n\n                return (AwsCredentialsProvider) clazz.getDeclaredConstructor().newInstance();\n            } catch (Exception e) {\n                throw new IllegalArgumentException(\n                        \"Failed to instantiate credentials provider: \" + resolvedClassName, e);\n            }\n        }\n\n        private static String resolveProviderClassName(String className) {\n            if (!className.contains(\".\")) {\n                return \"software.amazon.awssdk.auth.credentials.\" + className;\n            }\n            return className;\n        }\n\n        private StsClient buildStsClient(AwsCredentialsProvider baseProvider, Region awsRegion) {\n            return StsClient.builder().region(awsRegion).credentialsProvider(baseProvider).build();\n        }\n\n        private AwsCredentialsProvider buildAssumeRoleProvider(StsClient stsClient) {\n            AssumeRoleRequest.Builder requestBuilder =\n                    AssumeRoleRequest.builder()","sourceCodeStart":921,"sourceCodeEnd":957,"githubUrl":"https://github.com/apache/flink/blob/2f3c205e9266cb30240eb7f4fdab15cad629a70f/flink-filesystems/flink-s3-fs-native/src/main/java/org/apache/flink/fs/s3native/S3ClientProvider.java#L921-L957","documentation":"After the class passes the AwsCredentialsProvider check, instantiateCredentialsProvider() tries (1) a static no-arg create() method and (2) a no-arg constructor. Any reflective failure — missing both create() and a public no-arg constructor, non-public constructor, or the constructor/create() itself throwing — is wrapped in this IllegalArgumentException with the resolved class name and original cause. The message parameter {} is the fully-qualified resolved class name.","triggerScenarios":"Listing a provider class whose only constructors take arguments (e.g. some profile- or role-based providers); an abstract class or interface name; a provider whose no-arg constructor throws because required configuration/env (profile file, web-idenity token, STS endpoint) is absent at instantiation time.","commonSituations":"Using providers that need builder-time config (assume-role with role ARN) which cannot be expressed as a bare class name; provider constructor calling external metadata service in an offline test env; user provider with constructor injection (Spring) that has no default ctor.","solutions":["Prefer built-in providers that support no-arg creation: AnonymousCredentialsProvider, DefaultCredentialsProvider, InstanceProfileCredentialsProvider (v2 class names or simple names).","For custom providers, add a public no-arg constructor (or static create()) that internally reads config from Flink options/environment instead of constructor params.","Read the chained cause: if it is an NPE/IllegalState from inside the constructor, fix that prerequisite (e.g. provide the profile/role env) rather than the instantiation mechanism.","For assume-role flows, use the provider's env-var-driven v2 variant (e.g. StsAssumeRoleCredentialsProvider via AWS_ROLE_ARN) instead of a constructor-arg provider."],"exampleFix":"// before: custom provider with only an arg constructor — instantiation fails\npublic class MyProvider implements AwsCredentialsProvider {\n    public MyProvider(String roleArn) { ... }\n    public AwsCredentials resolveCredentials() { ... }\n}\n\n// after: public no-arg constructor reading config from the environment\npublic class MyProvider implements AwsCredentialsProvider {\n    public MyProvider() { this(System.getenv(\"AWS_ROLE_ARN\")); }\n    private MyProvider(String roleArn) { ... }\n    public AwsCredentials resolveCredentials() { ... }\n}","handlingStrategy":"validation","validationCode":"// Verify the provider is instantiable the way the module instantiates it\nstatic boolean instantiable(String fqcn) {\n    try {\n        Class<?> c = Class.forName(fqcn);\n        if (!AwsCredentialsProvider.class.isAssignableFrom(c)) return false;\n        try {\n            java.lang.reflect.Method m = c.getMethod(\"create\");\n            if (java.lang.reflect.Modifier.isStatic(m.getModifiers())) return true;\n        } catch (NoSuchMethodException ignored) {}\n        c.getDeclaredConstructor().newInstance();\n        return true;\n    } catch (ReflectiveOperationException e) { return false; }\n}","typeGuard":null,"tryCatchPattern":"catch (IllegalArgumentException e) { if (e.getMessage().startsWith(\"Failed to instantiate credentials provider\")) { read e.getCause(): construction-time failure -> fix provider's prerequisites; no no-arg ctor -> use a different provider or add one; } else throw e; }","preventionTips":["Custom providers must expose a public no-arg constructor or static create().","Make custom constructors side-effect free — external calls (STS, metadata) belong in resolveCredentials().","Prefer SDK built-ins for assume-role flows driven by AWS_ROLE_ARN env instead of constructor-arg providers."],"tags":["credentials","reflection","configuration","aws-sdk-v2","s3","flink"],"backgroundTag":null,"analyzedSha":"2f3c205e9266cb30240eb7f4fdab15cad629a70f","analyzedAt":"2026-08-14T08:48:24.518Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}