{"record":{"id":"d45b9bf861d5b231","repo":"apache/beam","slug":"failed-to-access-private-field-s-of-aws-credential-provider","errorCode":null,"errorMessage":"Failed to access private field '%s' of AWS credential provider type '%s' with reflection","messagePattern":"Failed to access private field '(.+?)' of AWS credential provider type '(.+?)' with reflection","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/options/AwsModule.java","lineNumber":308,"sourceCode":"        jsonGenerator.writeStringField(ROLE_ARN, provider.assumedRoleArn());\n        jsonGenerator.writeStringField(WEBID_TOKEN_FQCN, provider.webIdTokenProviderFQCN());\n        Integer sessionDurationSecs = provider.sessionDurationSecs();\n        if (sessionDurationSecs != null) {\n          jsonGenerator.writeNumberField(SESSION_DURATION_SECONDS, sessionDurationSecs);\n        }\n      } else if (!SINGLETON_CREDENTIAL_PROVIDERS.contains(providerClass)) {\n        throw new IllegalArgumentException(\n            \"Unsupported AWS credentials provider type \" + providerClass);\n      }\n      // BEAM-11958 Use deprecated Jackson APIs to be compatible with older versions of jackson\n      typeSerializer.writeTypeSuffixForObject(credentialsProvider, jsonGenerator);\n    }\n\n    private Object readField(AwsCredentialsProvider provider, String fieldName) throws IOException {\n      try {\n        return FieldUtils.readField(provider, fieldName, true);\n      } catch (IllegalArgumentException | IllegalAccessException e) {\n        throw new IOException(\n            String.format(\n                \"Failed to access private field '%s' of AWS credential provider type '%s' with reflection\",\n                fieldName, provider.getClass().getSimpleName()),\n            e);\n      }\n    }\n  }\n\n  /** A mixin to add Jackson annotations to {@link ProxyConfiguration}. */\n  @JsonDeserialize(builder = ProxyConfiguration.Builder.class)\n  @JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)\n  @JsonIgnoreProperties(value = {\"host\", \"port\", \"scheme\"})\n  @JsonInclude(value = JsonInclude.Include.NON_EMPTY)\n  private static class ProxyConfigurationMixin {\n    @JsonPOJOBuilder(withPrefix = \"\")\n    static class Builder {}\n  }\n","sourceCodeStart":290,"sourceCodeEnd":326,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/options/AwsModule.java#L290-L326","documentation":"AwsModule.readField uses commons-lang FieldUtils.readField(provider, fieldName, true) to read private fields of AWS credential providers during (de)serialization. If reflection fails with IllegalArgumentException or IllegalAccessException, it wraps the cause in this IOException. It indicates the AWS SDK's provider class changed shape (field renamed/removed) or access was denied, so Beam cannot extract the needed attribute.","triggerScenarios":"Serializing or deserializing a profile or web-identity-token credentials provider whose private field (e.g. profileName, request supplier) no longer exists under the expected name because the AWS SDK version differs from what AwsModule was written against.","commonSituations":"Mixing incompatible versions of software.amazon.awssdk with Beam's AWS2 SDK module; shading/relocation breaking reflective field access; provider classes changed in an SDK upgrade.","solutions":["Pin the AWS SDK v2 version to the one declared by the Beam version you use (check Beam's dependency BOM).","Upgrade both Beam and AWS SDK together so AwsModule's expected field names match the provider classes.","Avoid shading/relocating the AWS SDK classes used by Beam, which can break reflective access."],"exampleFix":"// before (pom.xml)\n<dependency><groupId>software.amazon.awssdk</groupId><artifactId>kinesis</artifactId><version>2.30.0</version></dependency>\n// after — use the Beam-managed version\n<dependency><groupId>software.amazon.awssdk</groupId><artifactId>kinesis</artifactId><version>${beam-aws-sdk.version}</version></dependency>","handlingStrategy":"try-catch","validationCode":"// pin AWS SDK version to Beam's managed version in your build\n// and fail fast in a smoke test that round-trips serialize/deserialize the provider","typeGuard":null,"tryCatchPattern":"try {\n  json = AwsSerializableUtils.serializeAwsCredentialsProvider(provider);\n} catch (IllegalArgumentException | IOException e) {\n  log.error(\"Provider reflection failed; check AWS SDK/Beam version alignment\", e);\n}","preventionTips":["Use the AWS SDK version managed by the Beam BOM","Run a round-trip serialization test when upgrading the AWS SDK","Avoid shaded/relocated AWS SDK classes with Beam"],"tags":["aws","reflection","credentials","version-compatibility"],"backgroundTag":"incompatible-source-type","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}